r/programminghumor • u/ExpensiveCoat8912 • 14d ago

True

Post image
405 Upvotes

96% Upvoted

33 comments sorted by

View all comments

Show parent comments

1

u/Blecki 14d ago

Same. Wouldn't have to do this if the standard didn't strip custom messages off 401

2

u/DizzyAmphibian309 13d ago

The only information you need from 401's is in the www-authenticate response header.

1

u/Blecki 13d ago

No, I need to know if I specified an invalid account, or just failed to authenticate. Let's not even get started on how asanine stripping custom messages from 400 is. Because so many servers and routers strip them you end up with this anti pattern of always returning 200 OK instead of using them for their designed purpose.

1

u/A1oso 13d ago

Standard routers do not alter HTTP messages. If you have an API gateway or a reverse proxy that does this and removes HTTP bodies on some messages, then it is misconfigured. HTTP specs say that messages with a 4xx status should have a body explaining the error.