6 ms·
999 Request Denied
- benjlcox 3y agoI’ve always used 418 for this kind of thing
- tommica 3y agoFor us lazy people: https://http.dev/418 https://http.dev/418
- mxuribe 3y agoAh, yes, the "I'm a teapot" status. Awesome! :-)
- 8organicbits 3y ago4xx seems more appropriate for sure. I'd say 400, 420, or 429 feel closest.
- Vanit 3y agoDitto, for me 418 has always meant "check response body for the application error code".
- duxup 3y agoI use 418 for “code should not have gotten here” type situations. It's a weird enough and unique enough error that I pretty much know what is possibly up the moment I see it.
- Joker_vD 3y agoI think somebody also used it as a response when they detected the request to be a CSRF attack?
- jpgvm 3y agoI always use 418 for anti-botting responses. First because it's hilarious and second because I want them to know that I know what they did heh.
- Waterluvian 3y agoI’m going to bet that every 999 could be defined more accurately using an existing code. For me, if the server cannot specifically tell you what kind of error happened, it’s by definition a 500. My API is internal, but it’s been nice to consider, “all 500-level errors are my team’s problem to fix or represent more accurately as a 400-level.”
- organsnyder 3y agoYep. 4xx: "You asked for something in a way that I can't respond" (auth error, unknown path, etc.) 5xx: "You asked for something in a valid way, but I can't respond right now" (outage, bug, etc.)
- captainmuon 3y agoI think the semantics of 999 is "bugger off, you are not supposed to be here. I will not grace you with a proper status code". Because sending a status code, even a 4xx or a 5xx, acknowledges the request and plays along by giving a well-formed answer. If you want to respond impolitely, you could just terminate the connection, or send plaintext "Don't scrape me, we are watching you" instead of a HTTP response, but I can imagine that doesn't work properly with proxies and middleware. The conventional nonsense response "418 I am a teapot" has been standardized unfortunately. But `return Response("Request Denied", status=999)` is easy to write and does the job.
- Waterluvian 3y ago> you are not supposed to be here Isn’t that a 403? I’m not sure what value there is in saying “beep boop” rather than “you can’t come in.” If you really intend what you’re saying, why not just drop the tcp connection without any http response as you suggest?
- mxuribe 3y agoI've never realized that http status 999 was a thing. I've often used 401 to tell user something similar to "denied"...which i get is different in that "unauthorized" (for 401) is the browser telling the user, while i suppose 999 would be the server telling the client to tell the user a generic "denied"...so there's a difference there, but a little nuanced i suppose. I guess TIL.
- irdc 3y ago> I've never realized that http status 999 was a thing. It’s not. That code does not conform to any standard.
- vesinisa 3y agoIt's not a thing and this post should be taken down before some bright kid figures it's a good idea to copy.
- soxocx 3y ago> When sending an HTTP GET or HEAD request to LinkedIn for a specific profile [...] > It will also be returned if there are too many HTTP requests in a single day. This is similar to the HTTP 429 Too Many Requests error message. Similar? That is excatly what 429 was made for, or not? This is weird or just lazy.
- rockwotj 3y agoI believe this is a meme making fun at LinkedIn for using the wrong status code…
- afavour 3y agoI’m assuming the logic is that LinkedIn uses 999 in combatting crawler bots so they don’t want to give reasons why the request is denied. That would help the bot overcome the restriction. e.g. it might be because you’ve sent too many requests but it also might be that your user agent is blocklisted. Obviously it’s bad practise to do this but I don’t think it’s a mystery why they’d want their denial to be opaque. I’m also having trouble getting that worked up about it. If its OK to return 418 as a joke it’s probably fine to return 999 to suspected crawlers.
- _cenw 3y agoThe correct status code for that is 400, the generic "something you did is wrong" or 403, the generic "go away".
- afavour 3y agoSure but I imagine you’d want to track real 400 errors (e.g. your POST request contains the wrong parameters) in analytics to ensure you haven’t introduced a bug in your code. Categorising bot repellant responses along with that would likely be very noisy. Again I’m not really defending the practise, I think it’s bad, I can just clearly see how they ended up where they ended up.
- 0xffff2 3y ago
- jto1218 3y agoReminds me of a similar one that only Shopify uses https://http.dev/430 https://http.dev/430 It says it’s deprecated but we still get them from their API from time to time.
- chrismorgan 3y agoThis is just wrong and bad. The uses described should very clearly be 403 Forbidden where it’s refusing to respond based on user-agent, and 429 Too Many Requests where it’s rate limiting. The spec says <https://www.rfc-editor.org/rfc/rfc9110#section-15-6 https://www.rfc-editor.org/rfc/rfc9110#section-15-6>: > Values outside the range 100..599 are invalid. Implementations often use three-digit integer values outside of that range (i.e., 600..999) for internal communication of non-HTTP status (e.g., library errors). A client that receives a response with an invalid status code SHOULD process the response as if it had a 5xx (Server Error) status code. So, the spec declares it invalid, and its suggested handling yields the wrong semantics (server rather than client error). Given the notes they have on things like 430, I’m astonished at them not noting the problems with this code.
- richbell 3y ago> The uses described should very clearly be 403 Forbidden where it’s refusing to respond based on user-agent, and 429 Too Many Requests where it’s rate limiting. That's precisely why LinkedIn returns 999, they're telling you to bugger off. Nobody thinks this is a good idea.
- kgeist 3y agoLooks like it was designed be wrong and bad to break web crawlers.
- chupapimunyenyo 3y agoOk it doesn't comply with the spec so? What harm does it cause?
- alpaca128 3y agoLooks like it's the catch-all "I don't want to look up the proper status code for this" code.
- gostsamo 3y agoThis is super unprofessional. 999 means nothing, therefore it cannot be acted upon, therefore it is totally useless. Best description which I can come up with is "I don't like you and I won't say why, because I don't like you". The expected client behavior is sending in return an empty http post request with wtf header and value "I feel this server is passive aggressive towards me."
- Y_Y 3y agoTime to draft a pass-ag RFC
- AnimalMuppet 3y agoNo, see, if you draft a pass-ag RFC, then the response codes in there are in some sense standard ones. So if we're going to go pass-ag on you, we're going to use some other codes. And there's really no limit. If I'm going to be nonstandard, I could use more than three digits in the error code. I could use hex. I could use full text. The possibilities are limitless.
- capableweb 3y ago> therefore it cannot be acted upon, therefore it is totally useless From the examples, this seem to be the point. If you receive a 429, you know you can just backoff a bit and it'll work at a later point, but if you receive 999, you're not sure how to proceed, which seems to be what they (the service) wants.
- lsaferite 3y agoThen they should return a 400.
- kvdveer 3y ago> This is super unprofessional. 999 means nothing, therefore it cannot be acted upon Given that this seems to be bot-protection, that might actually be the point. It's basically saying; "I don't want you here, don't try to resolve this". Or in other words "F*ck off"
- Tepix 3y agoThe page explaining all the codes should make it clear that using status code 999 is a bad idea. One reason why it's bad is because it violates RFC 2616 (§6.1.1): The first digit of the Status-Code defines the class of response. The last two digits do not have any categorization role. There are 5 values for the first digit: - 1xx: Informational - Request received, continuing process - 2xx: Success - The action was successfully received, understood, and accepted - 3xx: Redirection - Further action must be taken in order to complete the request - 4xx: Client Error - The request contains bad syntax or cannot be fulfilled - 5xx: Server Error - The server failed to fulfill an apparently valid request
- IggleSniggle 3y agoSee, that would require knowing why they are rejecting you. Is it us? Is it you? Hell we don't know and couldn't be arsed to figure it out, so, just...Nein. Nein Nein Nein.
- dragonwriter 3y ago> One reason why it's bad is because it violates RFC 2616 RFC 2616 is obsolete, as are the RFCs which obsoleted it; the reference here should be to §15 of RFC 9110.
- jmholla 3y agoIt should be noted that nearly the same verbiage presented by the GP is used in RFC 9110. RFC 9110 also goes further to explicitly say that 999 is an invalid error code, but does indicate they should be treated as a 5xx. > Values outside the range 100..599 are invalid. Implementations often use three-digit integer values outside of that range (i.e., 600..999) for internal communication of non-HTTP status (e.g., library errors). A client that receives a response with an invalid status code SHOULD process the response as if it had a 5xx (Server Error) status code.
- dragonwriter 3y ago> It should be noted that nearly the same verbiage presented by the GP is used in RFC 9110. Yes, in case it wasn't clear, my intent was to correct the reference only, not the substance communicated by the reference.
- pachico 3y agoJust... Why?
- janfoeh 3y agoI am wondering if it might have been chosen as a joke... 999 is a homonym for the German "nein, nein, nein" (no, no, no), which is rather fitting for a "go away" status code.
- dcminter 3y agoOr in the UK it's the telephone number for the emergency services, so suggesting "I'll call the police on you!" to unwelcome traffic. More likely they just used it because it's one end of the 3 digit range and a "proper" code would leak information to the unwelcome traffic about what they did to get blocked (making it easier to avoid). Apparently some services already use 000 for other purposes (TIL).
- wongarsu 3y agoAnd any new first digit for some theoretical protocol extension would use 6xx, so 999 is extra future-proof. Not that this is likely to ever matter, unless we introduce a status code category for "the interplanetary gateway is at fault" or something like that.
- soxocx 3y agoAFAIK this is a reference to a movie and the scene in question is Hitler shouting "nein" multiple times. I highly doubt this is the origin. I think its just the last three digit number.
- colonwqbang 3y ago> 499 Please Spoof User Agent In A More Believeable Manner
- 38 3y agoI am getting 999 even in a browser, what the fuck http://www.linkedin.com/in/filwiese http://www.linkedin.com/in/filwiese
- pull_my_finger 3y agoNginx has a similar unofficial code 444 - which just closes without any other information and it's super helpful. 999 OTOH feels like you're just too lazy to use the correct response though. Edit: I should not that while you're using it in your Nginx config, you're not _actually_ returning it to the client. That's a fairly important distinction, and I think makes it more appropriate than the 999 thing.
- PaulAJ 3y agoHas anyone pointed out that in the UK 999 is the emergency number (like 911 in the US). So "999 Request Denied" sounds like a public safety issue to someone who doesn't speak tech. Make it 998 if you must.
- seized 3y agoI think if someone is looking at HTTP codes and extrapolating THAT from the response then there are other issues. At that point we might as well worry about people in Atlanta, GA not being able to call their mechanic if there's a 404 page.
- wintorez 3y agoWhat a beautiful website!
- jbverschoor 3y agoMight as well returned Status: /dev/null