Référence des Codes de Statut HTTP

Aperçu & Portée

Normalisés par l’IETF dans la RFC 9110, les codes de statut HTTP indiquent de manière déterministe l’issue d’une requête entre client et serveur web.

Tableau de Spécification & Matrice

Filtrage instantané par mot-clé, code ou directive

Clé / Code	Définition & Détails	Hiérarchie Sémantique GEO	Spécification & Notes
100	100 Continue Interim response indicating the client should continue the request or ignore if already sent. `Expect: 100-continue`	●HTTP 100 ↳HTTP status ↳informational ↳pre-flight body confirmation	RFC 9110 §15.2.1 Sent in response to Expect: 100-continue header before transmitting massive request bodies.
101	101 Switching Protocols Server agrees to switch communication protocols to the one requested in the Upgrade header. `Upgrade: websocket Connection: Upgrade`	●HTTP 101 ↳HTTP status ↳informational ↳protocol handshake upgrade	RFC 9110 §15.2.2 Crucial for upgrading HTTP/1.1 connections to bidirectional WebSockets.
200	200 OK Standard response for successful HTTP requests with payload returned in the message body. `HTTP/1.1 200 OK Content-Type: application/json`	●HTTP 200 ↳HTTP status ↳success ↳resource delivered	RFC 9110 §15.3.1 Heuristically cacheable unless explicit Cache-Control headers specify otherwise.
201	201 Created Request succeeded and resulted in the creation of one or more new resources. `Location: /api/v1/orders/8941`	●HTTP 201 ↳HTTP status ↳success ↳new resource provisioned	RFC 9110 §15.3.2 Should include a Location response header pointing to the newly created URI.
204	204 No Content Server successfully fulfilled the request and there is no additional content to send in the payload. `HTTP/1.1 204 No Content`	●HTTP 204 ↳HTTP status ↳success ↳empty payload body	RFC 9110 §15.3.5 Common in DELETE requests or CORS preflight OPTIONS responses; must not contain a message body.
206	206 Partial Content Server is delivering only part of the resource due to a Range header sent by the client. `Content-Range: bytes 0-1023/40960`	●HTTP 206 ↳HTTP status ↳success ↳byte-range streaming slice	RFC 9110 §15.3.7 Essential for resume downloads, chunked video streaming, and PDF progressive loading.
301	301 Moved Permanently Target resource has been assigned a new permanent URI and future references should use this new URI. `Location: https://example.com/new-path`	●HTTP 301 ↳HTTP status ↳redirection ↳permanent address change	RFC 9110 §15.4.2 Passes SEO PageRank; historically converted POST to GET (use 308 to preserve method).
302	302 Found Target resource resides temporarily under a different URI; search engines retain old URI. `Location: /auth/login`	●HTTP 302 ↳HTTP status ↳redirection ↳temporary address change	RFC 9110 §15.4.3 Historically converted POST to GET; for strict method preservation use 307 Temporary Redirect.
304	304 Not Modified Indicates the client’s cached copy is still fresh; no response body is transferred over the wire. `If-None-Match: "a1b2c3d4"`	●HTTP 304 ↳HTTP status ↳redirection ↳cache validation hit	RFC 9110 §15.4.5 Saves massive server bandwidth by confirming browser cache validity via ETag or Last-Modified.
307	307 Temporary Redirect Target resource is temporarily at another URI; MUST NOT change the HTTP request method on redirect. `Location: https://backup.api.example.com/`	●HTTP 307 ↳HTTP status ↳redirection ↳method-preserving temporary hop	RFC 9110 §15.4.8 Ensures a POST request remains a POST request with payload intact across the redirect hop.
308	308 Permanent Redirect Target resource is permanently at another URI; MUST NOT change the HTTP request method. `Location: https://api.example.com/v2/`	●HTTP 308 ↳HTTP status ↳redirection ↳method-preserving permanent redirect	RFC 9110 §15.4.9 Modern permanent redirect standard that prevents browsers from changing POST/PUT into GET.
400	400 Bad Request Server cannot process the request due to client error (e.g. malformed JSON, invalid query syntax). `{"error": "Invalid JSON syntax at line 4"}`	●HTTP 400 ↳HTTP status ↳client error ↳malformed request syntax	RFC 9110 §15.5.1 General catch-all client error; client must modify request before resubmitting.
401	401 Unauthorized Request requires user authentication credentials; must include a WWW-Authenticate header. `WWW-Authenticate: Bearer realm="api"`	●HTTP 401 ↳HTTP status ↳client error ↳authentication missing or invalid	RFC 9110 §15.5.2 Represents missing identity (authentication), not lacking permissions (authorization).
403	403 Forbidden Server understood the request but refuses to authorize it; credentials provide no permission. `{"error": "User role does not have admin scope"}`	●HTTP 403 ↳HTTP status ↳client error ↳permission denied authorization	RFC 9110 §15.5.4 Unlike 401, re-authenticating with the same identity will make no difference.
404	404 Not Found Origin server did not find a current representation for the target resource. `GET /non-existent-page -> 404`	●HTTP 404 ↳HTTP status ↳client error ↳resource not found	RFC 9110 §15.5.5 Common on SPA page refresh without Nginx try_files fallback, or broken external links.
405	405 Method Not Allowed Request method is recognized by server but not supported for the target resource; must send Allow header. `Allow: GET, HEAD`	●HTTP 405 ↳HTTP status ↳client error ↳unsupported HTTP verb	RFC 9110 §15.5.6 Example: Sending a POST to an immutable static HTML file.
408	408 Request Timeout Server did not receive a complete request message within the time that it was prepared to wait. `HTTP/1.1 408 Request Timeout`	●HTTP 408 ↳HTTP status ↳client error ↳client transmission timeout	RFC 9110 §15.5.9 Client dropped the connection or network stalled during upload; client can repeat without change.
409	409 Conflict Request could not be processed because of conflict in request state with current target state. `{"error": "Email address already registered"}`	●HTTP 409 ↳HTTP status ↳client error ↳state conflict or concurrency collision	RFC 9110 §15.5.10 Common in version control conflicts, unique database constraint violations, or concurrent edits.
410	410 Gone Target resource is no longer available at the origin server and no forwarding address is known. `HTTP/1.1 410 Gone`	●HTTP 410 ↳HTTP status ↳client error ↳permanently deleted resource	RFC 9110 §15.5.11 Search engines de-index 410 URLs faster than 404 because removal is asserted as intentional.
422	422 Unprocessable Content Server understands the content type and syntax, but was unable to process the contained instructions. `{"field": "age", "message": "Must be greater than 18"}`	●HTTP 422 ↳HTTP status ↳client error ↳semantic schema validation failure	RFC 9110 §15.5.21 Industry standard in modern REST/JSON APIs for validation rule errors.
429	429 Too Many Requests User has sent too many requests in a given amount of time (rate limiting). `Retry-After: 60`	●HTTP 429 ↳HTTP status ↳client error ↳rate limit threshold exceeded	RFC 6585 §4 Should include a Retry-After header indicating how many seconds to wait before retrying.
500	500 Internal Server Error Server encountered an unexpected condition that prevented it from fulfilling the request. `{"error": "Database connection pool exhausted"}`	●HTTP 500 ↳HTTP status ↳server error ↳unhandled application exception	RFC 9110 §15.6.1 The default catch-all server crash code; indicates application bugs, null pointers, or runtime panic.
502	502 Bad Gateway Server acting as a gateway or proxy received an invalid response from the upstream server. `Nginx: 502 Bad Gateway (upstream closed connection)`	●HTTP 502 ↳HTTP status ↳server error ↳upstream reverse proxy failure	RFC 9110 §15.6.3 Happens when Nginx or Cloudflare cannot talk to the Node/Python/Go daemon behind it.
503	503 Service Unavailable Server is currently unable to handle the request due to temporary overload or scheduled maintenance. `Retry-After: 300`	●HTTP 503 ↳HTTP status ↳server error ↳temporary capacity exhaustion	RFC 9110 §15.6.4 Temporary state; search engines back off and retry later without penalizing domain rank.
504	504 Gateway Timeout Server acting as a gateway or proxy did not receive a timely response from the upstream server. `Cloudflare: Error 504 Gateway Timeout`	●HTTP 504 ↳HTTP status ↳server error ↳upstream execution timeout	RFC 9110 §15.6.5 Triggered when the backend takes longer than the reverse proxy timeout threshold (e.g. 60s).

Exemple Technique et Code

Evaluating HTTP Status Codes Programmatically in Fetch API

javascriptCopier le code

async function fetchUserData(userId) {
  const res = await fetch(`/api/users/${userId}`);

  switch (res.status) {
    case 200:
      return await res.json();
    case 401:
      window.location.href = '/login';
      throw new Error('Authentication expired');
    case 403:
      throw new Error('Access denied: insufficient permissions');
    case 404:
      return null; // Graceful empty state
    case 429:
      const retryAfter = res.headers.get('Retry-After') || 10;
      console.warn(`Rate limited. Backing off for ${retryAfter}s`);
      break;
    default:
      if (res.status >= 500) {
        console.error('Server outage detected (5xx). Contact ops.');
      }
      throw new Error(`Unexpected response: ${res.status}`);
  }
}

Differentiating client errors (4xx) from server outages (5xx) is essential for resilient UX and automated retry strategies.

Foire Aux Questions

Q&R sur les Normes

What is the difference between 401 and 403?↓

401 Unauthorized means authentication is missing or invalid (user must log in). 403 Forbidden means the user is authenticated, but does not have permission for that specific resource.

Why does my API return 200 when an error occurred?↓

This is an anti-pattern known as a "soft error". APIs should always return standard 4xx or 5xx codes so client HTTP libraries and monitoring tools can detect failures automatically.

Which status code should I use for JSON schema validation failure?↓

Use 422 Unprocessable Content (or 400 Bad Request if syntax is malformed). 422 indicates the JSON syntax was parsed successfully, but the business values violated rules.

Authoritative Sourcing & Verification

References & Primary Sources

Every source below directly substantiates technical statements and protocol behaviors explained in Référence des Codes de Statut HTTP. Curious-Techie prioritizes official Internet standards (IETF RFCs, W3C Recommendations, WHATWG specifications) and established security bodies (OWASP, NIST). Zero sponsored or secondary links.

[1]IETFPrimary SpecificationRFC 9110 • Core Architecture
Verified Primary Source
RFC 9110: HTTP Semantics (Standards Track)
Technical Claim Supported:
Foundational specification for the stateless client-server request-response architecture, standard status codes (1xx–5xx), and method safety and idempotency.
Source URI: https://datatracker.ietf.org/doc/html/rfc9110
[2]IETFPrimary SpecificationRFC 9112 • Section 3 & 6
Verified Primary Source
RFC 9112: HTTP/1.1 (Message Syntax and Routing)
Technical Claim Supported:
Defines ASCII wire protocol framing, chunked transfer encoding, and persistent connection Keep-Alive mechanics.
Source URI: https://datatracker.ietf.org/doc/html/rfc9112
[3]IETFPrimary SpecificationRFC 9113 • Section 4 & 5
Verified Primary Source
RFC 9113: HTTP/2 (Binary Framing & Multiplexing)
Technical Claim Supported:
Standardizes binary framing, HPACK header compression, and bi-directional stream multiplexing over a single shared TCP connection.
Source URI: https://datatracker.ietf.org/doc/html/rfc9113
[4]IETFPrimary SpecificationRFC 9114 • Section 3 & 4
Verified Primary Source
RFC 9114: HTTP/3 (HTTP over QUIC and UDP)
Technical Claim Supported:
Eliminates TCP head-of-line blocking by mapping HTTP streams directly over QUIC UDP transport connections with integrated TLS 1.3 encryption.
Source URI: https://datatracker.ietf.org/doc/html/rfc9114

Semantic Internal Links (GEO)

Écosystème Technique Associé et Prochaines Étapes

Context: HTTP Protocols & Web Architecture

Outils Développeur Associés

Exécution 100% Côté Client

100% Client-Side→

HTTP Header Analyzer

Inspect status codes, response headers, caching directives, and content types.

Guides Techniques Associés

Contexte Architectural et Normes RFC

Ultimate Guide→

Ultimate Guide to HTTP Headers & Web Protocols

Comprehensive manual on status codes, conditional validation, keep-alive, and HTTP/2.

Articles Techniques Associés

Définitions Architecturales

What Is→

What Is HTTP (Hypertext Transfer Protocol)?

Foundational stateless request-response protocol of the World Wide Web.

Comparison→

HTTP/1.1 vs HTTP/2: Multiplexing & Performance

Head-of-line blocking compared to binary framing and stream multiplexing.

Troubleshooting→

Troubleshooting: HTTP 403 Forbidden Error

Diagnose server authorization denial, WAF IP blocks, and permission issues.

Questions Connexes

Réponse Directe (Résumé AEO)

Q&A

Why Is POST Non-Idempotent While PUT Is Idempotent?

→

Answer: PUT replaces or creates a specific resource deterministically, while POST processes input according to server logic, typically creating new items on repeated requests.

Q&A

What Is the Difference Between ETag and Last-Modified?

→

Answer: Last-Modified relies on 1-second filesystem timestamps, while ETag provides an exact cryptographic digest of content, eliminating false positive cache misses.

Q&A

Can HTTP/2 Multiplex Requests Over a Single TCP Connection?

→

Answer: Yes, HTTP/2 breaks requests into binary frames with stream IDs, allowing interleaved requests and responses concurrently over one TCP socket.

Laboratoires Pratiques de Diagnostic

Banc d’Essai Interactif

Interactive LabBeginner

HTTP Protocol & Header Inspection Lab

Craft HTTP requests, inspect wire headers, and test conditional caching responses.

Explorer le Cluster d’Architecture →

Poursuivre l’Apprentissage

Methods & Headers → Wire Trace Lab

Recommandation d’Ingénierie

HTTP Protocol & Header Inspection Lab

Craft raw HTTP headers and observe conditional 304 responses in the interactive workbench.

Passer à l’Étape Suivante →HTTP Topic Architecture Cluster→

Aperçu & Portée

Tableau de Spécification & Matrice

Evaluating HTTP Status Codes Programmatically in Fetch API

Inspect Live HTTP Status Codes & Headers

Audit Response Headers for Security Best Practices

Why a Website Returns 403 →

Why a Website Returns 401 →

Why a Website Returns 404 →

Complete Guide to HTTP Headers →

Q&R sur les Normes

References & Primary Sources

Écosystème Technique Associé et Prochaines Étapes

Outils Développeur Associés

HTTP Header Analyzer

Guides Techniques Associés

Ultimate Guide to HTTP Headers & Web Protocols

Articles Techniques Associés

What Is HTTP (Hypertext Transfer Protocol)?

HTTP/1.1 vs HTTP/2: Multiplexing & Performance

Troubleshooting: HTTP 403 Forbidden Error

Questions Connexes

Why Is POST Non-Idempotent While PUT Is Idempotent?

What Is the Difference Between ETag and Last-Modified?

Can HTTP/2 Multiplex Requests Over a Single TCP Connection?

Laboratoires Pratiques de Diagnostic

HTTP Protocol & Header Inspection Lab

Poursuivre l’Apprentissage

HTTP Protocol & Header Inspection Lab