Modern HTTP Status Codes & Response Headers Guide

HTTP status codes are the standardized three-digit communication language between client applications and web servers. Knowing precisely which status code to return in your REST, GraphQL, or RPC APIs directly impacts client error handling, browser caching, and search engine crawling.

1. The 5 Major HTTP Status Families

• 1xx Informational: Request received, continuing process (e.g. 101 Switching Protocols for WebSockets).
• 2xx Success: The action was successfully received, understood, and accepted.
• 3xx Redirection: Further action must be taken to complete the request.
• 4xx Client Error: The request contains bad syntax or cannot be fulfilled due to client fault.
• 5xx Server Error: The server failed to fulfill an apparently valid request.

2. Essential 2xx Success Codes

3. Essential 3xx Redirection Codes

4. The Critical 4xx Client Errors

401 Unauthorized vs 403 Forbidden

This is the most common confusion in modern web engineering:

• 401 Unauthorized: The client lacks authentication. No valid token was provided. The response should include WWW-Authenticate challenge header.
• 403 Forbidden: The client is authenticated, but lacks authorization. The server knows who the user is, but their role/permissions do not grant access.

Other High-Frequency 4xx Errors

5. Modern Security Headers Checklist

Every production backend and Next.js application should emit these headers:

# Prevent browsers from MIME-sniffing away from declared Content-Type
X-Content-Type-Options: nosniff

# Restrict iframe embedding to stop clickjacking attacks
X-Frame-Options: DENY

# Enforce strict HTTPS connections for 1 year including subdomains
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

# Restrict referrer information sent to third-party domains
Referrer-Policy: strict-origin-when-cross-origin

# Whitelist approved sources of executable scripts, styles, and fonts
Content-Security-Policy: default-src 'self'; img-src 'self' data: https:;