Skip to tool
ecech.
Finance English Developer Text & SEO Network Time E-commerce Math Design Health YouTube Image Converters Home
💻 Developer & Code

HTTP Status Codes, Including Why a 302 Can Silently Turn Your POST Into a GET

301 and 302 may rewrite POST to GET and drop the body. 307 and 308 do not. Look up a code, or answer two questions and get the right one.

Or answer two questions

Advertisement

How the calculation works

Same redirect, different code, different request arrives 302 or 301 POST /old {"name":"Ada"} → redirect → GET /new (body gone) no error, just missing data 307 or 308 POST /old {"name":"Ada"} → redirect → POST /new {"name":"Ada"} method and body intact If a redirect might ever receive a POST, 307 and 308 are the only safe choices.

How to Use This Tool

Search for a code, or use the picker to work backwards from what you are trying to say. Each entry notes whether it is cached and whether it preserves the request method, since those are the properties that cause trouble.

The four redirects

CodeDurationMethodCached
301permanentmay become GETyes, often forever
302temporarymay become GETno
307temporarypreservedno
308permanentpreservedyes

301 and 302 predate the rule about method preservation, and browsers historically converted a redirected POST into a GET with no body. That behaviour is now specified, so it is not a bug you can report — it is what those codes mean. If a redirect might ever receive a POST, use 307 or 308.

Why a wrong 301 is so painful

Browsers cache a 301 aggressively, frequently for the lifetime of the profile, and often without honouring cache headers. So a 301 issued by mistake keeps redirecting returning visitors long after the server has stopped sending it, and there is no way to reach into their browser and undo it.

The practical rule: use 302 or 307 while you are still deciding, and switch to 301 or 308 once the move is genuinely permanent. Going from temporary to permanent is easy; going the other way is not.

401 and 403 are not degrees of the same thing 401 Unauthorized "who are you?" — credentials missing or invalid retrying with credentials may work 403 Forbidden "I know who you are, and no" — retrying will not help The name of 401 is a historical mistake: it means unauthenticated, not unauthorised.
Sending 403 for a missing login is the most common misuse of the pair.

The codes people reach for wrongly

  • 200 with an error inside. Returning {"error": "not found"} with a 200 means every proxy, cache and monitoring tool believes the request succeeded. The status line is the machine-readable part; use it.
  • 400 versus 422. 400 is for a request the server cannot parse. 422 is for one that parsed fine and failed validation. Both are widely used for both, so pick one and be consistent within your API.
  • 404 versus 410. 404 means "not here". 410 means "was here, deliberately gone" and tells search engines to drop it faster. Almost nobody uses 410, and it is the more honest answer after deleting something on purpose.
  • 429. Rate limiting. Send Retry-After with it, or clients have to guess, and the ones that guess badly make your problem worse.
  • 503 versus 500. 503 means "temporarily down, try later" and can carry Retry-After. 500 means "something broke and we do not know what". Maintenance should be 503, and monitoring treats them very differently.

A note on 418

418 I'm a teapot is from an April Fools' joke specification in 1998 and is not a real status code. Several frameworks implement it anyway. It is harmless in a toy and out of place in anything else.

Advertisement

Frequently Asked Questions

What is the difference between 301 and 308?
Both are permanent redirects. 301 may cause a POST to be rewritten as a GET with the body dropped, because it predates the rule about method preservation. 308 preserves the method and body. If the redirect might ever receive a POST, use 308.
What is the difference between 302 and 307?
Both are temporary redirects, and 307 guarantees the method and body are preserved while 302 does not. Historically browsers turned a redirected POST into a GET, and that behaviour is now specified for 302 — so it is not a bug, it is what the code means.
Why is a wrong 301 so hard to fix?
Because browsers cache it aggressively, often for the lifetime of the profile and sometimes ignoring cache headers. Once a visitor has it, they keep following it long after your server stops sending it. Use 302 or 307 while a move is still provisional and only promote it to 301 or 308 when you are certain.
What is the difference between 401 and 403?
401 means the request was not authenticated — credentials are missing or invalid, and retrying with valid ones may work. 403 means the server knows who you are and is refusing anyway, so retrying will not help. The name of 401, Unauthorized, is a historical misnomer for unauthenticated.
Should I use 400 or 422 for validation errors?
400 is properly for a request the server could not parse and 422 for one that parsed but failed validation. In practice both are used for both, so the more useful rule is to pick one and be consistent across your API — a caller can handle either, but not an unpredictable mix.
When should I use 410 instead of 404?
When something existed and was deliberately removed. 410 tells search engines to drop the URL faster than a 404 does, and it tells a caller the absence is intentional rather than possibly a mistake. It is rarely used and is often the more honest answer.
Is 418 I'm a teapot real?
Not as a usable status code — it comes from an April Fools' specification in 1998. Several frameworks implement it as a joke. Harmless in a toy project and out of place anywhere real work depends on the response.

Related tools in Developer & Code

💻CSV to MarkdownCreate the separator row automatically and escape pipe characters in cells. 💻CSV to SQLGenerate deterministic INSERT statements with quoted-field parsing and visible row counts. 💻cURL to fetchConverts the command properly — quoted bodies, escapes, line continuations — and flags the headers a browser will silently drop on the way out. 💻DB Pool CapacityReserve connections and apply target utilization before translating latency into throughput.
#developer #http #api
Browse all Developer & Code tools
The person who builds ecech., at the desk where the tools are written.

Made by one person

ecech. is not a content farm. Every tool here is written and checked by hand, one at a time, by someone who wanted the tool to exist and could not find a version that showed its working.

No accounts and no sign-in, and nothing you type reaches a server — every calculation on this page runs inside your browser. The ads are served by Google and do set their own cookies, which is set out in full on the privacy page. More about the site.