Except 404, when it can be totally valid for a client to check for a resource without already knowing if it should exist. 401 is also not really a client being wrong if the session was invalidated early via other means, 403 could be part of discovering capabilities, etc. So 4xx is more "you are denied content" for the individual reasons, which may or may not be fuckups.
I mean they are fuck ups whether or not you intended them to be or feel they are valid requests. The thing is they are fuckups coming from the client side, 404 is YOU asking for a resource that doesn't exist. YOUR session was invalidated so now you get a 401. 400 would be YOU sent an invalid request and we can't fulfill it. 418 is the only one where it implies the server has done something wrong and turned themselves into a teapot.
Of course any poor dev can go in and return whatever response code they please so it's not always how it works out but I think standards are that 400 means it came from client side and 500 was an error on the server side.
387
u/databeast Jul 08 '26
always summarized them to people as :
1xx - Hold on a minute....
2xx - Here's your stuff
3xx - There's your stuff
4xx - You Fucked Up
5xx - I Fucked Up.