Common HTTP Status Code Mistakes That Undermine API Reliability

·2 views

Misusing HTTP status codes is a widespread problem in API development, with errors like returning 500 for login failures or 403 for missing credentials causing confusion for client developers. The 401 and 403 codes are among the most misused: 401 signals an unauthenticated request, while 403 means the server recognises the user but denies access. Similarly, 404 and 410 serve distinct purposes — 404 indicates a resource is not found, whereas 410 signals deliberate removal, which search engines treat as a stronger deindexing cue. Redirect codes also carry important distinctions, as 301 transfers SEO ranking to a new URL while 302 does not, and 307/308 preserve the HTTP method during redirects. Lesser-used codes like 202 and 204 improve API honesty by accurately conveying asynchronous processing and empty successful responses respectively.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

CVSS, EPSS and KEV: A Practical Framework for Prioritizing Security Vulnerabilities

Dependency scanners routinely surface hundreds of vulnerabilities, but fewer than 5% of published CVEs are ever exploited in the wild, making raw CVSS scores an unreliable basis for prioritization. CVSS rates theoretical severity on a 0–10 scale but ignores real-world exploitation likelihood, meaning a high score can reflect a risk that attackers never actually pursue. EPSS, a machine-learning model maintained by FIRST, addresses this gap by producing daily probability scores for exploitation within 30 days, with the top 1% of CVEs by EPSS accounting for roughly 75% of observed attacks. CISA's Known Exploited Vulnerabilities catalog goes further, listing CVEs confirmed as actively exploited in real attacks — these entries represent the highest-priority fixes regardless of their CVSS score. Used together, the three systems allow security teams to dramatically shrink fix lists while concentrating effort on vulnerabilities that pose genuine, immediate risk.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Merge PDF Files Locally in a Browser Without Uploading Them

Merging PDF files is a routine task, but most free online tools require uploading documents to a server, which poses a privacy risk for sensitive files such as contracts, medical records, or financial documents. Browser-based PDF merger tools process files entirely on the user's device, meaning no data is transmitted, stored, or exposed to third parties. Users can drag and drop files, arrange them in the desired order, and download the combined result without needing an internet connection after the page loads. However, there are practical considerations: password-protected files must be unlocked beforehand, form fields with identical names may conflict, and mixed page sizes will be preserved as-is in the output. The final merged file size is roughly the sum of all inputs, so compression may be advisable for large documents.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

30-Day Roadmap Teaches System Design as Decision Process, Not Memorization

A structured 30-day High-Level Design (HLD) practice roadmap has been outlined to help engineers build repeatable decision-making skills for system design interviews. The curriculum is divided into four progressive stages: foundational primitives in week one, distributed component integration in week two, and full real-world case studies in the second half. Learners are guided to approach any 45-minute design problem by first clarifying requirements, estimating scale dimensions, selecting a data model, and then identifying bottlenecks that justify each added component. The roadmap emphasizes that a strong design answer lies in the reasoning between components — such as why a write is asynchronous or where consistency is truly needed — rather than in the volume of infrastructure shown. The complete curriculum is available at learn.significanthobbies.com.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Mia's AI Lab publishes open-source local LLM recipes for NVIDIA GPUs on GitHub

Mia's AI Lab, a project maintained by a solo developer named Mia, offers free open-source setup recipes designed to help users run large language models locally on NVIDIA RTX GPUs and DGX Spark hardware. The platform addresses common barriers such as choosing the right quantization level, estimating VRAM requirements, and selecting inference engines like vLLM or SGLang. As of September 26, 2026, the project hosts 16 model recipes plus a tool called sparkDash, collectively accumulating over 5,000 GitHub stars. Each recipe bundles scripts that automatically detect available VRAM, select an appropriate quantization level, download model weights, and launch an OpenAI-compatible API endpoint on both Windows and Linux. The site also publishes benchmark data including decode speed, peak throughput, and context window size, giving prospective local-AI builders a practical reference for hardware planning.

0 comments Read more at DEV Community