A5 · Status Codes: 2xx / 3xx / 4xx / 5xx: Status codes are the server's **traffic light**, but not three colors — four districts: **2xx** = green (I did it), **3xx** = a sign (go
Status codes are the server's **traffic light**, but not three colors — four districts: **2xx** = green (I did it), **3xx** = a sign (go another way — redirect), **4xx** = "your fault" (bad request: missing field, wrong path, unauthorized), **5xx** = "my fault" (the server crashed). But why hundreds of codes — aren't two values, "succeeded/failed", enough? Because a tester's next move **depends on the code**: see 4xx and you fix your test data/request (your job), see 5xx and you escalate to the developer (their bug) — misread the code and you blame the wrong person. In Java the equivalent is the exception type: `IllegalArgumentException` (4xx, the caller passed bad input) vs `NullPointerException`/`SQLException` (5xx, the code blew up inside); the caller fixes one, the author fixes the other. In QA the costliest confusion is 401 (you have no identity) vs 403 (you have identity but no permission): mistaking one for the other makes you close a security hole as a "login bug".
Four Districts and the Tester's Reaction
5xx — Server Error (escalate)
4xx — Client Error (fix the request)
2xx = pass. 4xx = request/data/auth wrong on your side. 5xx = server bug, escalate to the developer.
🎬 401 or 403? Mistaking a Security Hole for a "Login Bug"
The tester, with a valid token, tries to delete another user's bug: DELETE /api/v1/bugs/42.
Scenario A — With NO token the server returns 401: "I don't know you". This is an authentication problem.
Scenario B — Token EXISTS but you lack permission to delete this record: the server returns 403. Your identity is recognized, but permission is denied (authorization).
The danger — a tester mistaking 403 for 401 says "login is broken" and closes it. But 403 may mean you can reach someone else's data: an IDOR security hole!
The lesson — 401 = "you have no identity", 403 = "you have identity, no permission". Distinguishing them is the key to correctly classifying a security hole.
4xx or 5xx? Whose Bug Is It?
4xx = the request is wrong on your side: missing field (400), no identity (401), no permission (403), no path (404). Fix your request/data first.
5xx = the server blew up inside (500) or is unreachable (503). Your request was fine; this is the developer's bug, escalate.