status codes

Overview

Every HTTP response opens with a three-digit status code that summarizes what happened: success, a redirect, a client mistake, or a server error. Reading status codes correctly is a fundamental HTTP skill and, in challenges, the codes themselves are clues — they tell you whether a path exists, whether you are authorized, or whether you tripped an error. This lesson explains the status code families and how to read them during authorized practice.

Learning objectives

• Explain what an HTTP status code is and where it appears.
• Describe the five status code classes and what each signals.
• Use status codes as signals when probing an authorized target.

Core concept

A status code is a three-digit number on the response's status line (for example HTTP/1.1 404 Not Found) that tells the client the outcome of its request. The first digit defines a class, so you can understand a response at a glance even without memorizing every code. Status codes are one of the clearest signals a server gives you: because they are standardized, a code often tells you why a request behaved as it did — information you can act on in a challenge.

How it works

The five classes, by leading digit:

• 1xx — Informational. The request was received and processing continues (rarely seen directly).
• 2xx — Success. The request succeeded. 200 OK is the common case; 201 Created follows a successful resource creation; 204 No Content succeeds with no body.
• 3xx — Redirection. Further action is needed, usually following a Location header. 301/302 redirect to another URL; 304 Not Modified says a cached copy is still valid.
• 4xx — Client error. The request was faulty. 400 Bad Request (malformed), 401 Unauthorized (authentication needed), 403 Forbidden (authenticated but not allowed), 404 Not Found (no such resource), 405 Method Not Allowed (wrong verb for this route), 429 Too Many Requests (rate limited).
• 5xx — Server error. The server failed to handle a valid request. 500 Internal Server Error is the generic case; 502/503 indicate gateway or availability problems.

The distinctions carry meaning. 401 versus 403 tells you whether the problem is who you are versus what you are allowed to do. 404 versus 403 can reveal whether a resource exists at all. 405 confirms a route exists but rejects your method — a direct hint to try a different verb.

Practical example

While mapping an authorized challenge app you request /admin and receive 403 Forbidden rather than 404 Not Found. That difference is a clue: the path exists but your current identity is not allowed, so the challenge is likely about gaining the right authorization rather than finding a hidden URL. Later you POST to a read-only endpoint and get 405 Method Not Allowed, which tells you the route is real but expects a different verb — so you check OPTIONS and try the allowed method. In both cases the numeric code, not the page text, pointed you to the next step.

Cybersecurity relevance

Status codes are a primary feedback channel when assessing an authorized web target. During enumeration, the pattern of 200, 403, and 404 responses helps map which paths exist and which are protected. 401 vs 403 clarifies whether an issue is authentication or authorization. 500 errors can indicate that unexpected input reached a fragile code path — a signal worth careful, in-scope follow-up. Defensively, teams sometimes normalize codes (returning 404 instead of 403) specifically to avoid confirming that protected resources exist. Reading codes accurately keeps you from misinterpreting what the server is telling you.

Common mistakes

• Treating all 4xx codes the same and missing the 401/403/404/405 distinctions that guide your next move.
• Ignoring the status code and only reading the body, which can hide the real outcome (e.g. a redirect or an error).
• Assuming a 200 always means real success — some apps return 200 with an error message in the body, so confirm the actual content.

Key takeaways

• The status code is a three-digit outcome on the response's status line; its first digit sets the class (1xx–5xx).
• 2xx is success, 3xx redirects, 4xx is a client error, and 5xx is a server error; specific codes like 401, 403, 404, and 405 carry precise meaning.
• Codes are signals: 403 vs 404 hints whether a resource exists, and 405 tells you a route exists but wants a different method — invaluable when probing an authorized target.

Check your understanding

• What is the practical difference between receiving 401, 403, and 404 when requesting a protected path?
• Why does a 405 Method Not Allowed response point you toward trying a different HTTP method?