• 0 Posts
  • 431 Comments
Joined 1 year ago
cake
Cake day: July 2nd, 2023

help-circle










  • Theory is fine but in the real world I’ve never used a REST API that adhered to the stateless standard, but everyone will still call it REST. Regardless of if you want it or not REST is no longer the same as it’s original definition, the same way nobody pronounces gif as “jif” unless they’re being deliberately transgressive.

    403 can be thrown for all of those reasons - I just grabbed that from Wikipedia because I was too lazy to dig into our prod code to actually map out specifics.

    Looking at production code I see 13 different variations on 422, 2 different variations of 429…


  • 403 is a category, not a code. Yes I know they’re called http codes but REST calls are more complex than they were in 2001. There are hundreds of reasons you might not be authorized.

    Is it insufficient permissions? Authentication required? Blocked by security? Too many users concurrently active?

    I’d argue the minimum for modern services is:

    403 category
    Code for front end error displays
    Message as default front end code interpretation

    As json usually but if you’re all using protobuf, go off King.