An API that returns 200 and does nothing is worse than one that returns an error
I cross-post my articles to dev.to. Looking at the numbers, the posts tagged agents were getting traffic and the one without it had a single view in twenty hours. Obvious fix: add agents to that post. I sent a PUT updating the tags. The response was 200. I opened the post. The tags were unchanged. Three requests, three 200s, three identical responses Assuming I'd malformed the request, I ran the…
In a recent incident, a developer encountered a situation where an API responded with a 200 status code, but the desired action did not occur. This behavior is considered worse than receiving an error response, as a 200 status code does not interrupt the process and often gives a false sense of success. The source recounts several instances where a 200 response led to incorrect conclusions or unnoticed issues.
One example is the dev.to platform, where the tags assigned to a post are supposed to be mutable. However, the API silently ignores any changes made to the tags field. The developer initially concluded that the platform caps tags at three, but this was incorrect. The 200 response masked the true nature of the API's behavior, leading to two false conclusions within two days. The developer writes that the real cost lies in the false facts written down as knowledge, rather than the failed request itself.
Another issue arose when attempting to access a non-existent URL that was being served with a 200 status code due to a Cloudflare Pages configuration. This resulted in a "soft 404" error, where the site incorrectly reported a successful response when in fact, the requested URL was not valid. To address this, the developer added a 404.html file to restore proper error handling.
A third incident involved the use of an _redirects file in the system, which uses whitespace-delimited syntax. The developer accidentally wrote lines with spaces, causing the rule to silently fail without any warning or parse error. This led to four URLs not redirecting as expected, and the developer only discovered the issue later when it impacted other URLs not covered in their test set.
The developer also encountered a similar issue with a robots.txt file, which they used to check if a site was blocking AI crawlers. However, the site's CDN-level crawler blocking mechanism returned a 403 response without consulting the robots.txt file. By only checking the robots.txt, the developer missed the actual blocking happening at the CDN level. This led them to incorrectly conclude that there were no blockages when, in fact, the site was indeed blocking access from certain user agents.
Additionally, the article highlights a subtler issue where the number of requests made to an article appeared accurate in CDN analytics, but the actual number of unique users was vastly different. The 633 requests showed in the analytics were from various sources, including infrastructure prefetches, monitoring bots, link-preview crawlers, and the developer's own verification scripts.
However, only about 76 requests could plausibly be attributed to human users. Relying solely on the raw request count would have led the developer to conclude that the submission caused a traffic spike, which was not the case.
In the article's postscript, the developer repeats the mistake of publishing the article without verifying the outcome. The social cards and other assets were deployed without any issues, but upon checking the live site, the developer found that the cards were missing. The cause was a simple error in the build script, where the `cp -R` command was creating a subdirectory instead of copying the contents to the destination directory.
The developer discovered this oversight while publishing the article, demonstrating the importance of verifying the results of automated processes.
Overall, the article emphasizes the dangers of relying solely on a 200 status code from an API or server. While a 200 indicates that the server received the request, it does not guarantee that the intended action was completed successfully. The developer learned this lesson through multiple instances of incorrect conclusions, unnoticed issues, and missing verification steps.
To prevent similar mistakes in the future, the developer committed to committing the refutation rather than just the conclusion. They left behind the incorrect belief, along with the complete context of why it was wrong and what the actual truth was. By sharing these lessons learned, the developer hopes to help others avoid falling into the same traps.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
