New HTTP Codes • Hacker News Board

Re: New HTTP Codes

#51

Post by deno » Thu, Oct 20, 2011, 3:07 PM UTC

Robin_Message wrote: post #27

modeless wrote: post #14

Earlier quoted context omitted.

It has nothing to do with security, but it's not pointless. It tells the client that this response did not come from the server it attempted to contact. This is especially useful for non-browser clients that will otherwise simply choke on the 302 redirect normally used for this purpose, but it could also be useful for browsers to present a better UI for signing on to the internet. My only concern is that 511 could be…

Ah, I get it. Thanks to you and bostonvaulter2. It'd be interesting to see whether adding authentication/sign on to a protocol like DHCP would fit better. The hijacking of HTTP, while it obviously works well in the default case, seems nasty and this error code fixes the wrong problem. Better to have a DHCP field that tells you to visit a specific website to log in; then the OS could display that website when you conn…

This seems rational, but it’s too much complexity for too little gain. If no one have solved this problem in the last 10 years, it won’t happen now.

Re: New HTTP Codes

#52

Post by stanleydrew » Thu, Oct 20, 2011, 3:22 PM UTC

sanxiyn wrote: post #42

Hoff wrote: post #40

Earlier quoted context omitted.

Rewriting a large and complex enterprise-class application is tough enough, and a task that can variously (and expensively) fail. Rewriting the whole of the World Wide Web? Your replacement had better have a solid compatibility and migration path with "legacy" HTTP, and provide a substantial improvement over what HTTP and the existing tools provides, and clients and a migration path for a majority of the platforms an…

Google is trying: http://www.chromium.org/spdy

SPDY isn't really intended to replace HTTP I don't think, it's just speeding it up quite a bit. All the messages exchanged between client and server are still HTTP when using SPDY.

Re: New HTTP Codes

#53

Post by vdm » Thu, Oct 20, 2011, 4:02 PM UTC

aninteger wrote: post #43

Isn't this something that the http server handles? I am not in web development except for basic php and cgi scripts. Are people actually writing web app code to dictate what http code comes back on each request?

A correct response code is the minimum to play nice, and a body, HTML or otherwise, is courteous. They are not mutually exclusive.

http://php.net/manual/en/function.header.php http://docstore.mik.ua/orelly/linux/cgi/ch03_03.htm#ch03-9-f...

Re: New HTTP Codes

#54

Post by afhof » Thu, Oct 20, 2011, 4:59 PM UTC

429 looks to me as if it might be addressing aggressive http pipelining, but I was under the impression that most browsers have pipelining turned off.

Re: New HTTP Codes

#55

Post by technomancy » Thu, Oct 20, 2011, 5:11 PM UTC

modeless wrote: post #14

Robin_Message wrote: post #6

511 seems a little pointless -- browsers can treat it differently, but if the intermediate gateway intends to be malicious, then it won't return 511 anyway. The only useful thing I can see is avoiding accidents/attacks on the gateway compromising its clients.

It has nothing to do with security, but it's not pointless. It tells the client that this response did not come from the server it attempted to contact. This is especially useful for non-browser clients that will otherwise simply choke on the 302 redirect normally used for this purpose, but it could also be useful for browsers to present a better UI for signing on to the internet. My only concern is that 511 could be…

I got bit by this using the Emacs package manager. It follows redirects, so it ended up trying to fetch a package and getting back a bunch of HTML with a 200 response code, which it tried to byte-compile with about as spectacular a failure as you would imagine.

Re: New HTTP Codes

#56

Post by gwillen » Thu, Oct 20, 2011, 5:22 PM UTC

afdssfda wrote: post #38

511: 'Unknown clients then have all traffic blocked, except for that on TCP port 80, which is sent to a HTTP server (the "login server") dedicated to "logging in" unknown clients, and of course traffic to the login server itself.' Ugh. Couldn't this be more generic?

That section is descriptive of current practice. The semantics of 511 are the previous section.

Re: New HTTP Codes

#57

Post by otherports » Thu, Oct 20, 2011, 5:33 PM UTC

afdssfda wrote: post #38

511: 'Unknown clients then have all traffic blocked, except for that on TCP port 80, which is sent to a HTTP server (the "login server") dedicated to "logging in" unknown clients, and of course traffic to the login server itself.' Ugh. Couldn't this be more generic?

Agreed. Is the login server not allowed to run on port 443? Is it not permissible to redirect HTTP traffic on other ports such as 8080 and 9006?

Re: New HTTP Codes

#58

Post by johns » Thu, Oct 20, 2011, 5:42 PM UTC

edoloughlin wrote: post #50

One quibble. Perhaps I don't quite get the philosophy behind these, but wouldn't it be more useful to have a uniform structure to the responses. E.g., how useful is it to the average user to get a human-readable response for 428 when it's likely to be consumed by an app (i.e., JS) which would have to parse the suggested tag?

You can return any content type you want and you should use content negotiation to return the type the client is expecting. The HTML descriptions are only suggestions.

Re: New HTTP Codes

#59

Post by IsaacSchlueter » Thu, Oct 20, 2011, 5:47 PM UTC

ra wrote: post #25

ck2 wrote: post #5

Summary: 428 Precondition Required 429 Too Many Requests 431 Request Header Fields Too Large 511 Network Authentication Required I've been using 414 Request-URI Too Long for 431 and 503 Service Temporarily Unavailable for 429

Apart from the obvious semantics, what's the difference between 428 and 412? (412 - precondition failed)

"Apart from the semantics", the difference is 16.

Re: New HTTP Codes

#60

Post by mikeryan » Thu, Oct 20, 2011, 5:54 PM UTC

aninteger wrote: post #43

Isn't this something that the http server handles? I am not in web development except for basic php and cgi scripts. Are people actually writing web app code to dictate what http code comes back on each request?

You see more explicit use of http status codes in web service (data) API's particularly ones using REST.