I have REST method to update a user profile. Which status code should the system return if the some of the parameters are not valid? Or, for example, to change password, if old password and password in DB are not equals. 400 Bad request?
-
1It's not a Bad Request, it's a Valid Business Error which means a 200 with some Error Message– JoseKCommented Jun 24, 2013 at 11:33
-
2Completely disagree with the 200, this should definitely be something in the 400 range. See stackoverflow.com/questions/4781187/…– JonCommented Jun 24, 2013 at 11:36
-
do you need any more help on this?– benjimanCommented Jul 28, 2013 at 12:58
1 Answer
What you describe can and should be handled using two different response codes as described in the Book RESTful webservices from Richardson and Ruby:
400 Bad Request
This is commonly used when the client submits a representation along with a PUT or POST request, and the representation is in the right format, but it doesn’t make any sense. So it's totally okay to use it for missing or invalid parameters.
However 400 is the generic client side error code and you should definitely provide some further infos to the client in the response body.
409 Conflict
Any request that can't be performed by the server because it would leave one or more resources in an inconsistent state. So I would use this response code when a user tries to change his password and the comparison with the old password fails as you described it.
You can also take a look at this discussion REST HTTP status codes for failed validation or invalid duplicate.
-
With passwords and other security tokens, one must be careful not to leak information in the response. Hopefully the actor attempting to change the password is the logged in user, but in case someone is hijacking a session or doing something evil, the specific error response may allow them to gain information and make a more successful attack. In those cases you might just return a 400 and let your UI give them a vague message "Failed to change password. Maybe you typed it incorrectly?" Commented May 6, 2022 at 18:33