Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

999 Request Denied

http.dev

Post reply on HN
Print view View original

51–60 of 74 posts

Re: 999 Request Denied

#51

Post by chrismorgan »

mxuribe wrote: post #7

I've never realized that http status 999 was a thing. I've often used 401 to tell user something similar to "denied"...which i get is different in that "unauthorized" (for 401) is the browser telling the user, while i suppose 999 would be the server telling the client to tell the user a generic "denied"...so there's a difference there, but a little nuanced i suppose. I guess TIL.

You’re misusing 401: it’s only suitable when you’re using HTTP authentication. Refer to https://www.rfc-editor.org/rfc/rfc9110#name-401-unauthorized for explanation. You want 403 instead.

Re: 999 Request Denied

#52

Post by PaulAJ »

Has anyone pointed out that in the UK 999 is the emergency number (like 911 in the US). So "999 Request Denied" sounds like a public safety issue to someone who doesn't speak tech. Make it 998 if you must.

Re: 999 Request Denied

#55

Post by MR4D »

soxocx wrote: post #8

> When sending an HTTP GET or HEAD request to LinkedIn for a specific profile [...] > It will also be returned if there are too many HTTP requests in a single day. This is similar to the HTTP 429 Too Many Requests error message. Similar? That is excatly what 429 was made for, or not? This is weird or just lazy.

I think the solution is to try again. Bad behavior of not following protocols should be rewarded with bad behavior of not following protocols.

Re: 999 Request Denied

#56

Post by ttymck »

arp242 wrote: post #39
afavour wrote: post #29

Earlier quoted context omitted.

I’m assuming the logic is that LinkedIn uses 999 in combatting crawler bots so they don’t want to give reasons why the request is denied. That would help the bot overcome the restriction. e.g. it might be because you’ve sent too many requests but it also might be that your user agent is blocklisted. Obviously it’s bad practise to do this but I don’t think it’s a mystery why they’d want their denial to be opaque. I’m…

I suspect they intentionally break the HTTP spec for a similar reason: it will break some standard crawlers/bots, stop automatic retries, and things like that. This is trivial to account for of course, but it'll stop some script kiddies.

They might also have desired it for "zero-cost" observability: everything already monitors HTTP status codes, so they can monitor bot traffic without custom instrumentation.

Re: 999 Request Denied

#57

Post by jmholla »

dragonwriter wrote: post #48
Tepix wrote: post #19

The page explaining all the codes should make it clear that using status code 999 is a bad idea. One reason why it's bad is because it violates RFC 2616 (§6.1.1): The first digit of the Status-Code defines the class of response. The last two digits do not have any categorization role. There are 5 values for the first digit: - 1xx: Informational - Request received, continuing process - 2xx: Success - The action was su…

> One reason why it's bad is because it violates RFC 2616 RFC 2616 is obsolete, as are the RFCs which obsoleted it; the reference here should be to §15 of RFC 9110.

It should be noted that nearly the same verbiage presented by the GP is used in RFC 9110. RFC 9110 also goes further to explicitly say that 999 is an invalid error code, but does indicate they should be treated as a 5xx.

> Values outside the range 100..599 are invalid. Implementations often use three-digit integer values outside of that range (i.e., 600..999) for internal communication of non-HTTP status (e.g., library errors). A client that receives a response with an invalid status code SHOULD process the response as if it had a 5xx (Server Error) status code.

Re: 999 Request Denied

#58

Post by dragonwriter »

jmholla wrote: post #57
dragonwriter wrote: post #48

Earlier quoted context omitted.

> One reason why it's bad is because it violates RFC 2616 RFC 2616 is obsolete, as are the RFCs which obsoleted it; the reference here should be to §15 of RFC 9110.

It should be noted that nearly the same verbiage presented by the GP is used in RFC 9110. RFC 9110 also goes further to explicitly say that 999 is an invalid error code, but does indicate they should be treated as a 5xx. > Values outside the range 100..599 are invalid. Implementations often use three-digit integer values outside of that range (i.e., 600..999) for internal communication of non-HTTP status (e.g., libra…

> It should be noted that nearly the same verbiage presented by the GP is used in RFC 9110.

Yes, in case it wasn't clear, my intent was to correct the reference only, not the substance communicated by the reference.

Re: 999 Request Denied

#59

Post by seized »

PaulAJ wrote: post #52

Has anyone pointed out that in the UK 999 is the emergency number (like 911 in the US). So "999 Request Denied" sounds like a public safety issue to someone who doesn't speak tech. Make it 998 if you must.

I think if someone is looking at HTTP codes and extrapolating THAT from the response then there are other issues. At that point we might as well worry about people in Atlanta, GA not being able to call their mechanic if there's a 404 page.

Re: 999 Request Denied

#60

Post by _lvbh »

afavour wrote: post #29
soxocx wrote: post #8

> When sending an HTTP GET or HEAD request to LinkedIn for a specific profile [...] > It will also be returned if there are too many HTTP requests in a single day. This is similar to the HTTP 429 Too Many Requests error message. Similar? That is excatly what 429 was made for, or not? This is weird or just lazy.

I’m assuming the logic is that LinkedIn uses 999 in combatting crawler bots so they don’t want to give reasons why the request is denied. That would help the bot overcome the restriction. e.g. it might be because you’ve sent too many requests but it also might be that your user agent is blocklisted. Obviously it’s bad practise to do this but I don’t think it’s a mystery why they’d want their denial to be opaque. I’m…

Fun fact: ChatGPT (web version) returns 418 when you are able to get pass cloudflare but still get caught on their end. Very rare though
Post reply on HN