常见的 HTTP 状态码
Give some HTTP response status codes
先说五个类别，再举例 —— 这样显得有体系：1xx 信息、2xx 成功、3xx 重定向、4xx 客户端错、5xx 服务端错。
| 码 | 含义 | 什么时候用 |
|---|---|---|
| 200 OK | 成功 | GET / PUT / PATCH 成功 |
| 201 Created | 已创建 | POST 成功，建议带 Location 头 |
| 204 No Content | 成功但没内容 | DELETE 成功 |
| 301 / 302 | 永久 / 临时重定向 | 301 会被浏览器缓存，改错了很难收回 |
| 304 Not Modified | 没变，用缓存 | 配 ETag / Last-Modified |
| 400 Bad Request | 请求有问题 | 参数缺失、格式错、校验失败 |
| 401 Unauthorized | 没登录 / token 无效 | 「你是谁？」 |
| 403 Forbidden | 登录了但没权限 | 「知道你是谁，但你不能干这个」 |
| 404 Not Found | 资源不存在 | |
| 409 Conflict | 冲突 | 重复注册、并发修改 |
| 422 | 语义错误 | 格式对但业务上不合法 |
| 429 | 请求太多 | 限流 |
| 500 | 服务端异常 | 未捕获的错误 |
| 502 / 503 / 504 | 网关错 / 不可用 / 超时 | 上游故障、在维护、上游太慢 |
401 vs 403 是最常问的一对：401 是「没认证」，403 是「认证了但没授权」。
实践里有个细节：为了不泄露资源是否存在，有些接口会把「没权限」也返回 404。
会追问：「业务错误该用 4xx 还是 200 带错误码？」——REST 风格用 4xx（让 HTTP 语义承载错误），但要注意有些老网关会吞掉 4xx 的响应体。GraphQL 执行阶段的错误则一律返回 200，错误放在 errors 字段里 —— 因为一个请求可能部分成功，没法用单个状态码表达；请求本身语法或校验不通过时，Apollo Server 4 会返回 400。这个对比答出来很加分，Federation 那门课里 extensions.code就是干这个的。
Name the five classes first, then give examples — it reads as organised: 1xx informational, 2xx success, 3xx redirect, 4xx client error, 5xx server error.
| Code | Means | When |
|---|---|---|
| 200 OK | Success | A successful GET / PUT / PATCH |
| 201 Created | Created | A successful POST — send a Location header |
| 204 No Content | Success, nothing to return | A successful DELETE |
| 301 / 302 | Permanent / temporary redirect | Browsers cache 301, so a wrong one is hard to take back |
| 304 Not Modified | Unchanged, use your cache | Paired with ETag or Last-Modified |
| 400 Bad Request | The request is wrong | Missing parameter, bad format, failed validation |
| 401 Unauthorized | Not logged in, or the token is invalid | “Who are you?” |
| 403 Forbidden | Logged in but not allowed | “I know who you are, and you cannot do this” |
| 404 Not Found | No such resource | |
| 409 Conflict | Conflict | Duplicate signup, concurrent edit |
| 422 | Semantically wrong | Well-formed but invalid for the business rules |
| 429 | Too many requests | Rate limiting |
| 500 | Server failed | An uncaught error |
| 502 / 503 / 504 | Bad gateway / unavailable / timeout | Upstream is down, in maintenance, or too slow |
401 vs 403 is the pair they ask about most: 401 means not authenticated, 403 means authenticated but not authorised.
One detail from practice: to avoid leaking whether a resource exists, some endpoints return 404 for “not allowed” as well.
Follow-up: “Should a business error be a 4xx or a 200 with an error code?” — REST says 4xx, so the HTTP semantics carry the error, but watch out: some older gateways swallow the body of a 4xx. Errors during GraphQL execution come back with 200 and sit in the errors field, because one request can be partially successful and no single status code says that; a request that fails to parse or validate gets a 400 from Apollo Server 4. Drawing that contrast earns you points — in the Federation course, extensions.code is exactly this.