41–50 of 74 posts
This is just wrong and bad . The uses described should very clearly be 403 Forbidden where it’s refusing to respond based on user-agent, and 429 Too Many Requests where it’s rate limiting. The spec says https://www.rfc-editor.org/rfc/rfc9110#section-15-6 >: > Values outside the range 100..599 are invalid. Implementations often use three-digit integer values outside of that range (i.e., 600..999) for internal communic…
I am wondering if it might have been chosen as a joke... 999 is a homonym for the German "nein, nein, nein" (no, no, no), which is rather fitting for a "go away" status code.
I highly doubt this is the origin. I think its just the last three digit number.
> When sending an HTTP GET or HEAD request to LinkedIn for a specific profile [...] > It will also be returned if there are too many HTTP requests in a single day. This is similar to the HTTP 429 Too Many Requests error message. Similar? That is excatly what 429 was made for, or not? This is weird or just lazy.
I’m assuming the logic is that LinkedIn uses 999 in combatting crawler bots so they don’t want to give reasons why the request is denied. That would help the bot overcome the restriction. e.g. it might be because you’ve sent too many requests but it also might be that your user agent is blocklisted. Obviously it’s bad practise to do this but I don’t think it’s a mystery why they’d want their denial to be opaque. I’m…
If I wanted to mess with clients I don't like, I'd just return a random valid code.
This is super unprofessional. 999 means nothing, therefore it cannot be acted upon, therefore it is totally useless. Best description which I can come up with is "I don't like you and I won't say why, because I don't like you". The expected client behavior is sending in return an empty http post request with wtf header and value "I feel this server is passive aggressive towards me."
> This is super unprofessional. 999 means nothing, therefore it cannot be acted upon Given that this seems to be bot-protection, that might actually be the point. It's basically saying; "I don't want you here, don't try to resolve this". Or in other words "F*ck off"
Earlier quoted context omitted.
> This is super unprofessional. 999 means nothing, therefore it cannot be acted upon Given that this seems to be bot-protection, that might actually be the point. It's basically saying; "I don't want you here, don't try to resolve this". Or in other words "F*ck off"
So, error 400.
I am wondering if it might have been chosen as a joke... 999 is a homonym for the German "nein, nein, nein" (no, no, no), which is rather fitting for a "go away" status code.
Or in the UK it's the telephone number for the emergency services, so suggesting "I'll call the police on you!" to unwelcome traffic. More likely they just used it because it's one end of the 3 digit range and a "proper" code would leak information to the unwelcome traffic about what they did to get blocked (making it easier to avoid). Apparently some services already use 000 for other purposes (TIL).
Edit: I should not that while you're using it in your Nginx config, you're not _actually_ returning it to the client. That's a fairly important distinction, and I think makes it more appropriate than the 999 thing.
The page explaining all the codes should make it clear that using status code 999 is a bad idea. One reason why it's bad is because it violates RFC 2616 (§6.1.1): The first digit of the Status-Code defines the class of response. The last two digits do not have any categorization role. There are 5 values for the first digit: - 1xx: Informational - Request received, continuing process - 2xx: Success - The action was su…
RFC 2616 is obsolete, as are the RFCs which obsoleted it; the reference here should be to §15 of RFC 9110.
> When sending an HTTP GET or HEAD request to LinkedIn for a specific profile [...] > It will also be returned if there are too many HTTP requests in a single day. This is similar to the HTTP 429 Too Many Requests error message. Similar? That is excatly what 429 was made for, or not? This is weird or just lazy.
I’m assuming the logic is that LinkedIn uses 999 in combatting crawler bots so they don’t want to give reasons why the request is denied. That would help the bot overcome the restriction. e.g. it might be because you’ve sent too many requests but it also might be that your user agent is blocklisted. Obviously it’s bad practise to do this but I don’t think it’s a mystery why they’d want their denial to be opaque. I’m…
I think if you don't want to supply even that, a better way would be to just close the connection and don't send anything back at all.
The only practical reason for a 999 error code I see is if you want to confuse the client about whether or not the response indicates an error at all. Maybe they were hoping some crawlers treat everything that's not 4xx or 5xx as "success" and so they can poison their index?
That thinking would be relatively naive though, as I think most http clients treat everything that's not 2xx as an error.
So most likely reason is probably some programmer that went through the REST fanboy phase and thought they were special.