HTTP Status Codes

HTTP/1.1 100 Continue

HTTP/1.1 101 Switching Protocols
Upgrade: websocket
Connection: Upgrade

HTTP/1.1 102 Processing

HTTP/1.1 103 Early Hints
Link: </style.css>; rel=preload; as=style
Link: </script.js>; rel=preload; as=script

HTTP/1.1 200 OK
Content-Type: application/json
 
{
 "message": "Success banget!"
}

HTTP/1.1 201 Created
Location: /api/users/123
Content-Type: application/json
 
{
 "id": 123,
 "name": "Budi"
}

HTTP/1.1 202 Accepted
Content-Type: application/json
 
{
 "job_id": "abc123",
 "status": "processing"
}

HTTP/1.1 203 Non-Authoritative Information

HTTP/1.1 204 No Content

HTTP/1.1 205 Reset Content

HTTP/1.1 206 Partial Content
Content-Range: bytes 0-1023/10240
Content-Length: 1024
 
[partial data...]

HTTP/1.1 207 Multi-Status
Content-Type: application/xml
 
<?xml version="1.0"?>
<multistatus xmlns="DAV:">
 <response>...</response>
</multistatus>

HTTP/1.1 208 Already Reported

HTTP/1.1 226 IM Used
IM: vcdiff

HTTP/1.1 300 Multiple Choices
Content-Type: text/html
 
<ul>
 <li><a href="/doc.html">HTML version</a></li>
 <li><a href=

HTTP/1.1 301 Moved Permanently
Location: https://new-domain.com/page

// Express.js
app.get('/old-page', (req, res) => {
 res.redirect(301, '/new-page');
});

HTTP/1.1 302 Found
Location: /temporary-page

HTTP/1.1 303 See Other
Location: /success-page

// After form submission
app.post('/submit', (req, res) => {
 // Process form...
 res.redirect(303, '/success');
});

HTTP/1.1 304 Not Modified
ETag: "abc123"
Cache-Control: max-age=3600

HTTP/1.1 307 Temporary Redirect
Location: /temp-location

HTTP/1.1 308 Permanent Redirect
Location: /new-permanent-location

HTTP/1.1 400 Bad Request
Content-Type: application/json
 
{
 "error": "Invalid JSON syntax"
}

HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer realm="api"
 
{
 "error": "Token expired"
}

// JWT authentication
if (!token || !isValidToken(token)) {
 return res.status(401).json({
  error: 'Authentication required'
 });
}

HTTP/1.1 402 Payment Required

HTTP/1.1 403 Forbidden
 
{
 "error": "You don't have permission to access this resource"
}

// Kamu udah login, tapi bukan admin
if (!user.isAdmin) {
 return res.status(403).json({
  error: 'Admin only'
 });
}

HTTP/1.1 404 Not Found
 
{
 "error": "Resource not found"
}

app.use((req, res) => {
 res.status(404).json({
  error: 'Endpoint not found',
  path: req.path
 });
});

HTTP/1.1 405 Method Not Allowed
Allow: GET, POST
 
{
 "error": "DELETE method not allowed"
}

HTTP/1.1 406 Not Acceptable

HTTP/1.1 407 Proxy Authentication Required
Proxy-Authenticate: Basic realm="proxy"

HTTP/1.1 408 Request Timeout

HTTP/1.1 409 Conflict
 
{
 "error": "Email already exists"
}

// Email udah dipake
if (await User.findOne({ email })) {
 return res.status(409).json({
  error: 'Email already registered'
 });
}

HTTP/1.1 410 Gone
 
{
 "error": "This resource has been permanently deleted"
}

HTTP/1.1 411 Length Required

HTTP/1.1 412 Precondition Failed

HTTP/1.1 413 Payload Too Large
 
{
 "error": "File size exceeds 10MB limit"
}

app.use(express.json({ limit: '10mb' }));

HTTP/1.1 414 URI Too Long

HTTP/1.1 415 Unsupported Media Type
 
{
 "error": "Only JSON is supported",
 "received": "application/xml"
}

HTTP/1.1 416 Range Not Satisfiable
Content-Range: bytes */10240

HTTP/1.1 417 Expectation Failed

HTTP/1.1 418 I'm a teapot
 
{
 "error": "I'm a teapot, not a coffee maker! ☕"
}

HTTP/1.1 421 Misdirected Request

HTTP/1.1 422 Unprocessable Entity
 
{
 "errors": {
  "email": "Invalid email format",
  "age": "Must be at least 18"
 }
}

// Validation error
const errors = validateUser(req.body);
if (errors.length > 0) {
 return res.status(422).json({ errors });
}

HTTP/1.1 423 Locked

HTTP/1.1 424 Failed Dependency

HTTP/1.1 425 Too Early

HTTP/1.1 426 Upgrade Required
Upgrade: HTTP/2.0

HTTP/1.1 428 Precondition Required

HTTP/1.1 429 Too Many Requests
Retry-After: 3600
X-RateLimit-Limit: 100
X-RateLimit-Remaining: 0
X-RateLimit-Reset: 1640000000
 
{
 "error": "Rate limit exceeded. Try again in 1 hour"
}

// Rate limiting middleware
const rateLimit = require('express-rate-limit');
 
const limiter = rateLimit({
 windowMs: 15 * 60 * 1000, // 15 menit
 max: 100, // max 100 requests

HTTP/1.1 431 Request Header Fields Too Large

HTTP/1.1 451 Unavailable For Legal Reasons
 
{
 "error": "Content blocked due to legal reasons"
}

HTTP/1.1 500 Internal Server Error
 
{
 "error": "Something went wrong on our end"
}

app.use((err, req, res, next) => {
 console.error(err.stack); // Log di server
 res.status(500).json({
  error: 'Internal server error'
  // Jangan: error: err.message (bisa expose sensitive info)

HTTP/1.1 501 Not Implemented
 
{
 "error": "This method is not supported yet"
}

HTTP/1.1 502 Bad Gateway

HTTP/1.1 503 Service Unavailable
Retry-After: 3600
 
{
 "error": "Service temporarily unavailable",
 "retry_after": 3600
}

const MAINTENANCE_MODE = process.env.MAINTENANCE === 'true';
 
app.use((req, res, next) => {
 if (MAINTENANCE_MODE) {
  return res.status(503

HTTP/1.1 504 Gateway Timeout

HTTP/1.1 505 HTTP Version Not Supported

HTTP/1.1 506 Variant Also Negotiates

HTTP/1.1 507 Insufficient Storage

HTTP/1.1 508 Loop Detected

HTTP/1.1 510 Not Extended

HTTP/1.1 511 Network Authentication Required
 
{
 "error": "Network authentication required"
}

200 OK         → Request sukses
201 Created      → Resource dibuat
202 Accepted      → Async processing
204 No Content     → Sukses tapi gak ada data
206 Partial Content  → Partial data (streaming)

301 Moved Permanently   → Permanent redirect
302 Found         → Temporary redirect (method bisa berubah)
303 See Other      → POST-Redirect-GET
304 Not Modified     → Use cache
307 Temporary Redirect  → Temporary (method tetap)
308 Permanent Redirect  → Permanent (method tetap)

400 Bad Request       → Syntax/validation error
401 Unauthorized       → Gak authenticated
403 Forbidden        → Gak authorized
404 Not Found        → Resource gak ada
409 Conflict        → Duplicate/conflict
422 Unprocessable Entity  → Semantic validation error
429 Too Many Requests    → Rate limit exceeded

500 Internal Server Error  → Generic server error
502 Bad Gateway      → Invalid upstream response
503 Service Unavailable  → Temporary unavailable
504 Gateway Timeout    → Upstream timeout

// GET - Retrieve data
app.get('/users/:id', async (req, res) => {

// Error response standard
{
 "error": {
  "code": "VALIDATION_ERROR",
  "message": "Validation failed",
  "details": [
   {
    "field"

// 401 - Unauthenticated (belum login)
if (!req.user) {
 return res.status(401).json({
  error: 'Authentication required',
  message: 'Please login first'
 });
}
 
// 403 - Unauthorized (udah login tapi gak boleh)
if

// 304 Not Modified pattern
app.get('/data', (req, res) => {
 const data = getData();
 const etag = generateETag(data);
 
 // Check if client has latest version
 if (req.headers[

// 429 Too Many Requests
const rateLimit = new Map();
 
function checkRateLimit(userId) {
 const now = Date.now

// JANGAN GINI!
app.post('/users', async (req, res) => {
 try {
  const user = await User.create(req.body);
  res.status(200).

app.post('/users', async (req, res) => {
 try {
  const user = await User.create(req.body);
  res.status(201

// SALAH!
if (!user.isAdmin) {
 return res.status(401).json({ error: 'Not admin' }); // Harusnya 403
}

// Authentication (401)
if (!req.user) {
 return res.status(401).json({ error: 'Please login' });
}
 
// Authorization (403)
if (!req.user.isAdmin) {
 return res.status(403

// BAHAYA! Jangan expose stack trace
app.use((err, req, res, next) => {
 res.status(500).json({
  error: err.message,
  stack: err.stack // JANGAN!
 });
});

app.use((err, req, res, next) => {
 // Log di server
 console.error(err);
 
 // Return generic message
 res.status(500).json({
  error: 'Internal server error'

Request diterima
  ↓
Syntax valid?
  ├─ No → 400 Bad Request
  └─ Yes
    ↓
  Authenticated?
    ├─ No → 401 Unauthorized
    └─ Yes
      ↓
    Authorized?
      ├─ No → 403 Forbidden
      └─ Yes
        ↓
      Resource exists?
        ├─ No → 404 Not Found
        └─ Yes
          ↓
        Method allowed?
          ├─ No → 405 Method Not Allowed
          └─ Yes
            ↓

describe('User API', () => {
 test('POST /users - should return 201 on success', async () => {

describe('Error handling', () => {
 test('should return 401 when not authenticated', async () => {
  const res = await request