Authentication vs Authorization: 401 vs 403
One of the most frequent API anti-patterns is returning HTTP 403 Forbidden when a user is simply not logged in.
An HTTP 401 Unauthorized status indicates that the request lacked valid authentication credentials (e.g., an absent or expired Authorization header). In contrast, HTTP 403 Forbidden confirms that the client is authenticated, but their assigned role lacks permission to touch the requested endpoint.
Edge Proxy Errors: Diagnosing 502 Bad Gateway and 504 Gateway Timeout
When hosting on edge platforms like Cloudflare or AWS CloudFront, 502 and 504 status codes originate from the reverse proxy rather than your origin backend.
A 502 Bad Gateway means the edge server attempted to contact your origin IP, but the TCP handshake was refused. A 504 Gateway Timeout occurs when the connection was established, but the backend application failed to respond before timeout thresholds.
Step-by-Step Tutorial
Select HTTP Status Code
Pick any 1xx through 5xx status code in DocSwift HTTP Status Checker.
Review RFC Specifications & Headers
Inspect required headers, caching behavior, and idempotency implications.
Copy Recommended JSON Error Payload
Copy RFC 7807 Problem Details JSON format to standardize your API error responses.
Ready to Try It Yourself?
DocSwift processes everything directly on your device. Fast, safe, and completely free forever.
How helpful was this guide?
Rated 4.9 / 5 by 3,420+ users worldwide
Share with Colleagues & Friends
Help others protect their document privacy
Frequently Asked Questions
What is the RFC 7807 Problem Details standard?
RFC 7807 defines a standardized JSON schema for HTTP API error payloads, including type, title, status, detail, and instance fields.
Should GET requests ever return HTTP 201 Created?
No. RFC 9110 states that GET is a safe, idempotent method used exclusively for retrieval. Only state-mutating requests like POST or PUT should return 201.