B.4 Client Failure Status Codes

The status codes in the 400 499 range are all client failure responses, or at least the server thinks the client is at fault. The request could be badly formatted, sent to the wrong place, illegal, or unauthorized.

B.4.1 400 Bad Request

400 Bad Request means that the server thinks the request is poorly or illegally formatted. This could include use of a method that the server does not support, a header with an illegal value, or a request body with incorrect syntax. It can be returned in response to any method.

Defined in HTTP/1.1.

B.4.2 401 Unauthorized

401 Unauthorized means that the client cannot perform the request it is making with the current authentication credentials. The implication is that if the client had different credentials, the request could be successful.

Usually, when clients receive this response and have not previously sent authentication information, the client will display a "log-in" dialog to get authentication information from the user. Thus, the response code should only be used when that approach may help. Compare to 403 Forbidden, for actions that wouldn't be allowed no matter how the user authenticated.

Defined in HTTP/1.1.

B.4.3 402 Payment Required

Similar to 401 Unauthorized, this response implies that if the client or user followed some payment procedure, the request could succeed. Unfortunately, no common payment protocols have arisen to fill this void, so in practice there's nothing clients can do when this error is received.

Defined in HTTP/1.1.

B.4.4 403 Forbidden

403 Forbidden is usually used for methods that are not allowed under any circumstances. In WebDAV, this is used frequently, and even more so in DeltaV. Some example situations:

• A property is read-only, and the client is trying to edit it.

• A MKCOL request is made in a location where a collection cannot be created.

• A MOVE or a COPY request is made when the source and destination URLs are the same (that is, it is forbidden to move or copy a resource over itself).

• A request is made for a depth-infinity lock, but the server doesn't allow that kind of lock.

Defined in HTTP/1.1.

B.4.5 404 Not Found

404 Not Found indicates the resource identified by the request URL could not be found on the server. Note that some servers may use this when the requesting user does not have permission to see the resource.

Defined in HTTP/1.1.

B.4.6 405 Method Not Allowed

405 Method Not Allowed is used when the resource identified in the request URL does not support the method in the request. In WebDAV, this status code is used when a MKCOL request is made to a resource that already exists. MKCOL is only allowed on URLs that do not map to existing resources.

Defined in HTTP/1.1.

B.4.7 406 Not Acceptable

406 Not Acceptable has a very specific meaning; it doesn't just mean that the server didn't like the request. It is related to the "Accept" family of headers that the client may send in the request. If the client sends one of these headers (e.g., Accept-Language or Accept-Encoding) with values such that the server cannot pick or format an acceptable response, this error is returned. Thus, this status code should never be used unless the client used one of these headers in the request.

Defined in HTTP/1.1.

B.4.8 407 Proxy Authentication Required

407 Proxy Authentication Required is similar to 401 Unauthenticated, but the client must authenticate the user to the proxy server, not the content server.

Defined in HTTP/1.1.

B.4.9 408 Request Time-out

408 Request Time-out is used when the client's request is taking too long to finish and the server must cancel. This status code is intended for use when the client's request is incomplete or not even started, not when the server processing is taking too long.

Defined in HTTP/1.1.

B.4.10 409 Conflict

409 Conflict is defined as "the request could not be completed due to a conflict with the current state of the resource." This is ambiguous enough to make this error code very attractive as a general-purpose error code. However, the HTTP/1.1 specification is very clear that this should only be used when there is a reasonable expectation that the client could fix the state of the resource, resubmit the same request to the same resource, and have it work.

WebDAV makes frequent use of this status code to indicate that an operation cannot succeed because the expected parent resources do not exist yet. For example, a request to create a collection called /chris/public/photos cannot succeed if /chris and /chris/public do not exist yet. However, the client can clearly detect this, create those collections, and make the photos collection successfully.

If there is no way the client can make the request succeed, use 403 Forbidden or some other status code.

Defined in HTTP/1.1.

B.4.11 410 Gone

410 Gone means the resource used to exist here but doesn't any longer. It may have been moved, but there is no new address. This could theoretically be used in response to any method.

Defined in HTTP/1.1.

B.4.12 411 Length Required

411 Length Required may be used if the client's request did not have a Content-Length header. This indicates a serious client error because the server simply has no way of knowing when the body ends without a Content-Length header.

Defined in HTTP/1.1.

B.4.13 412 Precondition Failed

The 412 Precondition Failed status response must only be used when specific headers are in the request. In this case, it's used if the conditions specified in any conditional header do not hold true. Conditional headers in HTTP include If-Match, If-None-Match, or If-Unmodified-Since. WebDAV adds the If header to this list.

Defined in HTTP/1.1.

B.4.14 413 Request Entity Too Large

413 Request Entity Too Large is pretty self-descriptive. The server can refuse to handle a request that is too large, by the server's definition. This is rarely a problem in practice; some Web servers can handle PUT request with file bodies that are hundreds of megabytes long.

Defined in HTTP/1.1.

B.4.15 414 Request-URI Too Large

414 Request-URI Too Large is similar to 413 Request Entity Too Large: It's at the server's discretion to refuse a request if it thinks the Request-URI is problematically large. In Apache, the limit appears to commonly be 8190 bytes [Gossamer02].

Defined in HTTP/1.1.

B.4.16 415 Unsupported Media Type

415 Unsupported Media Type refers specifically to the format of the request body. For example, an HTTP/1.1 server is quite likely to refuse to handle a POST method with a body such as a GIF or an XML file. WebDAV servers may also use this status code when a request method isn't expected to have a body at all, but the client sends a body with the request.

Defined in HTTP/1.1.

B.4.17 416 Requested Range Not Satisfiable

This error is used in response to requests with the Range header. If the Range header is in the proper syntax but the range is invalid or otherwise not obtainable, this is the error to use.

Defined in HTTP/1.1.

B.4.18 417 Expectation Failed

This error is used in response to requests with the Expect header. It is related to 100 Continue. When the client sends an Expect: 100-continue header, it waits for the server to respond before sending the body of the request. If the server doesn't want to handle the rest of the request, it should use this error code.

Defined in HTTP/1.1.

B.4.19 418-421

These status codes were not defined in HTTP. WebDAV skipped over these status codes due to a potential conflict with other HTTP extensions that had been proposed.

B.4.20 422 Unprocessable Entity

An "Unprocessable Entity" is a request body that the server cannot parse. For example:

• The client used a MIME-type that the server just does not support.

• The client sent a MIME-type that the server supports, but the body does not meet the requirements of that MIME-type (e.g., invalid XML body).

Defined in WebDAV.

B.4.21 423 Locked

423 Locked means that the resource (or one of the resources inside it) is locked, and therefore the operation requested cannot be performed. The operation requested could be a LOCK request for a new lock on an exclusively locked resource, or a request to perform a write operation on a write-locked resource.

Defined in WebDAV.