This is just wrong and bad. The uses described should very clearly be 403 Forbidden where it’s refusing to respond based on user-agent, and 429 Too Many Reques

This is just wrong and bad. The uses described should very clearly be 403 Forbidden where it’s refusing to respond based on user-agent, and 429 Too Many Requests where it’s rate limiting. The spec says <https://www.rfc-editor.org/rfc/rfc9110#section-15-6 https://www.rfc-editor.org/rfc/rfc9110#section-15-6>: > Values outside the range 100..599 are invalid. Implementations often use three-digit integer values outside of that range (i.e., 600..999) for internal communication of non-HTTP status (e.g., library errors). A client that receives a response with an invalid status code SHOULD process the response as if it had a 5xx (Server Error) status code. So, the spec declares it invalid, and its suggested handling yields the wrong semantics (server rather than client error). Given the notes they have on things like 430, I’m astonished at them not noting the problems with this code.