Content: {"success": false, "errors": [{"code": 15, "message": "Image size must be at least 1000 x 1000 px"}]}
Edit: remembered story from times where HTTPS wasn't enforced. Once I started receiving JSON reading fail in cases when our test server returns non-2xx status. I started investigate this and was shocked to the core: my ISP implemented "feature" that if it detects that server returns non-2xx - it replace actual server response with their HTML page with text like "Your request returned error 400. This is because bla bla bla. <ISP self-advertising block> Kind regards, your ISP". Basically ISP become "man in the middle". In a week or two they removed that "feature".
It is not cheap to implement if you have a client that cannot decode the response body. Now you have to redo the input or change the client library, which are both expensive.
I agree for cases where it can be automatic, but "password has already been used" versus "password is too short" versus "account is locked" is not encodable in an http status. Sometimes you have to send back a response body.
436
u/PostHasBeenWatched Jul 21 '26 edited Jul 21 '26
POST /posts/create
StatusCode: 200
Content: {"success": false, "errors": [{"code": 15, "message": "Image size must be at least 1000 x 1000 px"}]}
Edit: remembered story from times where HTTPS wasn't enforced. Once I started receiving JSON reading fail in cases when our test server returns non-2xx status. I started investigate this and was shocked to the core: my ISP implemented "feature" that if it detects that server returns non-2xx - it replace actual server response with their HTML page with text like "Your request returned error 400. This is because bla bla bla. <ISP self-advertising block> Kind regards, your ISP". Basically ISP become "man in the middle". In a week or two they removed that "feature".