4xx vs 5xx HTTP Errors — What's the Difference?

4xx status codes mean the client made a mistake (bad request, not logged in, not found); 5xx codes mean the server failed to handle a valid request. 4xx you fix in the request, 5xx you fix on the server.

The concept

Common 4xx: 400 Bad Request, 401 Unauthorized, 403 Forbidden, 404 Not Found, 429 Too Many Requests.

Common 5xx: 500 Internal Server Error, 502 Bad Gateway, 503 Service Unavailable, 504 Gateway Timeout. Retrying a 5xx can help; retrying a 4xx usually will not.

Who is at fault?

Practical examples

Respond correctly

if (!valid) return res.status(422).json({ errors })
if (!user) return res.sendStatus(401)
try { await job() } catch (e) { res.sendStatus(500) }

Retry policy

if (res.status >= 500 || res.status === 429) await retry()

Check from the shell

curl -s -o /dev/null -w '%{http_code}\n' https://example.com/x

Common mistakes

• Returning 500 for validation errors.
• Retrying 4xx errors endlessly.
• Returning 200 with an error message in the body.

Key takeaways

• 4xx = client, 5xx = server.
• Retry 5xx and 429, not other 4xx.
• Pick precise codes.

FAQ

401 vs 403?

401 means not authenticated; 403 means authenticated but not allowed.

What is 429?

Rate limit exceeded; wait for the Retry-After time.