Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

999 Request Denied

http.dev

Post reply on HN
Print view View original

61–70 of 74 posts

Re: 999 Request Denied

#61

Post by doublerabbit »

Tepix wrote: post #19

The page explaining all the codes should make it clear that using status code 999 is a bad idea. One reason why it's bad is because it violates RFC 2616 (§6.1.1): The first digit of the Status-Code defines the class of response. The last two digits do not have any categorization role. There are 5 values for the first digit: - 1xx: Informational - Request received, continuing process - 2xx: Success - The action was su…

So what if it violates an RFC, what harm does it do if you implement your own status codes?

Controversial and unpopular opinion, but RFC specs went out the window as soon as SPA apps came about.

If I can't use my back button without my page being hijacked to the home page of the site then to me RFCs are now just a defunct recommendation.

Re: 999 Request Denied

#62

Post by vntok »

dragonwriter wrote: post #49
wongarsu wrote: post #45

Earlier quoted context omitted.

Error 400 is "this is your fault, try better". But you don't want them to try better, you just want them to go away.

So, 500 “its not you, its me”.

But that's not it either. It's your damn fault you're blocked, but there's nothing to fix and I don't want you to try again with better arguments.

Re: 999 Request Denied

#63

Post by 0xffff2 »

afavour wrote: post #38
_cenw wrote: post #33

Earlier quoted context omitted.

The correct status code for that is 400, the generic "something you did is wrong" or 403, the generic "go away".

Sure but I imagine you’d want to track real 400 errors (e.g. your POST request contains the wrong parameters) in analytics to ensure you haven’t introduced a bug in your code. Categorising bot repellant responses along with that would likely be very noisy. Again I’m not really defending the practise, I think it’s bad, I can just clearly see how they ended up where they ended up.

Isn't that what 40x errors are for? E.g. I think there's 408 Bad Request for your POST example.

Re: 999 Request Denied

#64

Post by tubthumper8 »

xg15 wrote: post #50
afavour wrote: post #29

Earlier quoted context omitted.

I’m assuming the logic is that LinkedIn uses 999 in combatting crawler bots so they don’t want to give reasons why the request is denied. That would help the bot overcome the restriction. e.g. it might be because you’ve sent too many requests but it also might be that your user agent is blocklisted. Obviously it’s bad practise to do this but I don’t think it’s a mystery why they’d want their denial to be opaque. I’m…

The canonical response code for "you did something wrong but I can't/don't want to say what exactly" is 400. I think if you don't want to supply even that, a better way would be to just close the connection and don't send anything back at all. The only practical reason for a 999 error code I see is if you want to confuse the client about whether or not the response indicates an error at all. Maybe they were hoping so…

> I think if you don't want to supply even that, a better way would be to just close the connection and don't send anything back at all.

I think this is the correct answer if a bad-mannered crawler has been identified. To take it a step further, one could do a HTTP version of a SSH Tarpit[1] although that's likely taking things too far.

[1] https://nullprogram.com/blog/2019/03/22/

Re: 999 Request Denied

#65

Post by Sohcahtoa82 »

Rygian wrote: post #44
kvdveer wrote: post #35

Earlier quoted context omitted.

> This is super unprofessional. 999 means nothing, therefore it cannot be acted upon Given that this seems to be bot-protection, that might actually be the point. It's basically saying; "I don't want you here, don't try to resolve this". Or in other words "F*ck off"

So, error 400.

400 means "There's an error in your request, fix the error and try again"

IMO, it should be a simple 403 Forbidden.

Re: 999 Request Denied

#66

Post by dragonwriter »

vntok wrote: post #62
dragonwriter wrote: post #49

Earlier quoted context omitted.

So, 500 “its not you, its me”.

But that's not it either. It's your damn fault you're blocked, but there's nothing to fix and I don't want you to try again with better arguments.

500 "Its not you, its me" was a joking reference to the cliche breakup line used to deflect discussion of what the recipient of the breakup could have done (or could still do) to avoid it.

Other options for this case:

403 Forbidden is probably the best fit. "The 403 (Forbidden) status code indicates that the server understood the request but refuses to fulfill it."

But it may not sufficiently communicate the "go away forever" aspect. Alternatives might include:

410 (maybe its not actually, strictly gone, but I'm never going to give it to you, so stop asking) Has the benefit of also being a 4xx error so focuses on it being a client error.

301 Moved Permanently Location: file:///dev/null

Re: 999 Request Denied

#67

Post by kjs3 »

irdc wrote: post #9
mxuribe wrote: post #7

I've never realized that http status 999 was a thing. I've often used 401 to tell user something similar to "denied"...which i get is different in that "unauthorized" (for 401) is the browser telling the user, while i suppose 999 would be the server telling the client to tell the user a generic "denied"...so there's a difference there, but a little nuanced i suppose. I guess TIL.

> I've never realized that http status 999 was a thing. It’s not. That code does not conform to any standard.

Which isn't remotely the same thing as whether it's a 'thing'.

Re: 999 Request Denied

#68

Post by chupapimunyenyo »

doublerabbit wrote: post #61
Tepix wrote: post #19

The page explaining all the codes should make it clear that using status code 999 is a bad idea. One reason why it's bad is because it violates RFC 2616 (§6.1.1): The first digit of the Status-Code defines the class of response. The last two digits do not have any categorization role. There are 5 values for the first digit: - 1xx: Informational - Request received, continuing process - 2xx: Success - The action was su…

So what if it violates an RFC, what harm does it do if you implement your own status codes? Controversial and unpopular opinion, but RFC specs went out the window as soon as SPA apps came about. If I can't use my back button without my page being hijacked to the home page of the site then to me RFCs are now just a defunct recommendation.

True, it's a bad idea because a spec says so? And when did I agree to comply to it?

Re: 999 Request Denied

#69

Post by chupapimunyenyo »

chrismorgan wrote: post #11

This is just wrong and bad . The uses described should very clearly be 403 Forbidden where it’s refusing to respond based on user-agent, and 429 Too Many Requests where it’s rate limiting. The spec says https://www.rfc-editor.org/rfc/rfc9110#section-15-6 >: > Values outside the range 100..599 are invalid. Implementations often use three-digit integer values outside of that range (i.e., 600..999) for internal communic…

Ok it doesn't comply with the spec so? What harm does it cause?

Re: 999 Request Denied

#70

Post by irdc »

kjs3 wrote: post #67
irdc wrote: post #9

Earlier quoted context omitted.

> I've never realized that http status 999 was a thing. It’s not. That code does not conform to any standard.

Which isn't remotely the same thing as whether it's a 'thing'.

Technically correct. But one could argue that it shouldn't be a thing.
Post reply on HN