What's the appropriate HTTP response for invalid data submitted by the user?

Question

I'm experimenting with JSON and http response codes. I'm submitting a form via an AJAX request and I obviously need to validate the data on the server-side.

My idea is to respond with a "200 OK" response (with a confirmation message as the body) if the post is successful. I don't know what to respond with if the data that the user sends is invalid.

Answer 1

You could send a 400: Bad Request header. If that's not your cup of tea, maybe check through the W3C's Status Code Definitions?

Answer 2

Just implement a standard protocol like JSON-RPC. It has error handling, parameter passing, etc.

Request:

{"method": "postMessage", "params": ["Hello all!"], "id": 99}

Response:

{"result": 1, "error": null, "id": 99}

And on error:

{"result": null, "error": "Duplicate Message", "id": 99}

It's quite flexible, and is standard...

Answer 3

Send back a JSON object:

$message = array(
   'error' => true,
   'code' => 'some error number relevant to you',
   'message' => 'A nice human-readable+relevant error message'
);

echo json_encode($message);

I prefer signaling errors with a service in this way. Fiddling with HTTP status codes doesn't seem right, as EVERYTHING about the actual HTTP request itself worked fine - it's just that the request didn't conform to the service's expectations.

Answer 4

Here's the complete list of HTTP status codes. The first one that springs to mind for your situation is 400 Bad Request, but that's usually used to indicate an error in the HTTP syntax rather than an error in the body content. Still, without more information I'd go with that one.

In specific cases, depending on the exact nature of the data you're receiving, I could see any of 403, 404, 410, 413, or perhaps others being the appropriate response.

Answer 5

Depends on the purpose of API. If it's yours (private) then answer with HTTP status 400 as Nightfirecat suggested. If it's a public API send a meaningful error message to aid developers.