常见的 HTTP 状态码
Give some HTTP response status codes
先说五个类别，再举例 —— 这样显得有体系：1xx 信息、2xx 成功、3xx 重定向、4xx 客户端错、5xx 服务端错。
| 码 | 含义 | 什么时候用 |
|---|---|---|
| 200 OK | 成功 | GET / PUT / PATCH 成功 |
| 201 Created | 已创建 | POST 成功，建议带 Location 头 |
| 204 No Content | 成功但没内容 | DELETE 成功 |
| 301 / 302 | 永久 / 临时重定向 | 301 会被浏览器缓存，改错了很难收回 |
| 304 Not Modified | 没变，用缓存 | 配 ETag / Last-Modified |
| 400 Bad Request | 请求有问题 | 参数缺失、格式错、校验失败 |
| 401 Unauthorized | 没登录 / token 无效 | 「你是谁？」 |
| 403 Forbidden | 登录了但没权限 | 「知道你是谁，但你不能干这个」 |
| 404 Not Found | 资源不存在 | |
| 409 Conflict | 冲突 | 重复注册、并发修改 |
| 422 | 语义错误 | 格式对但业务上不合法 |
| 429 | 请求太多 | 限流 |
| 500 | 服务端异常 | 未捕获的错误 |
| 502 / 503 / 504 | 网关错 / 不可用 / 超时 | 上游挂了、在维护、上游太慢 |
401 vs 403 是最常问的一对：401 是「没认证」，403 是「认证了但没授权」。
实践里有个细节：为了不泄露资源是否存在， 有些接口会把「没权限」也返回 404。
会追问：「业务错误该用 4xx 还是 200 带错误码？」——REST 风格用 4xx（让 HTTP 语义承载错误）， 但要注意有些老网关会吞掉 4xx 的响应体。GraphQL 则一律返 200， 错误放在 errors 字段里 —— 因为一个请求可能部分成功， 没法用单个状态码表达。这个对比答出来很加分， Federation 那门课里 extensions.code就是干这个的。
Name the five classes first, then give examples — it reads as organised: 1xx informational, 2xx success, 3xx redirect, 4xx client error, 5xx server error.
| Code | Means | When |
|---|---|---|
| 200 OK | Success | A successful GET / PUT / PATCH |
| 201 Created | Created | A successful POST — send a Location header |
| 204 No Content | Success, nothing to return | A successful DELETE |
| 301 / 302 | Permanent / temporary redirect | Browsers cache 301, so a wrong one is hard to take back |
| 304 Not Modified | Unchanged, use your cache | Paired with ETag or Last-Modified |
| 400 Bad Request | The request is wrong | Missing parameter, bad format, failed validation |
| 401 Unauthorized | Not logged in, or the token is invalid | “Who are you?” |
| 403 Forbidden | Logged in but not allowed | “I know who you are, and you cannot do this” |
| 404 Not Found | No such resource | |
| 409 Conflict | Conflict | Duplicate signup, concurrent edit |
| 422 | Semantically wrong | Well-formed but invalid for the business rules |
| 429 | Too many requests | Rate limiting |
| 500 | Server failed | An uncaught error |
| 502 / 503 / 504 | Bad gateway / unavailable / timeout | Upstream is down, in maintenance, or too slow |
401 vs 403 is the pair they ask about most: 401 means not authenticated, 403 means authenticated but not authorised.
One detail from practice: to avoid leaking whether a resource exists, some endpoints return 404 for “not allowed” as well.
Follow-up: “Should a business error be a 4xx or a 200 with an error code?” — REST says 4xx, so the HTTP semantics carry the error, but watch out: some older gateways swallow the body of a 4xx. GraphQL always returns 200 and puts errors in the errors field, because one request can be partially successful and no single status code says that. Drawing that contrast earns you points — in the Federation course, extensions.code is exactly this.