> I think the premise here is that a 4xx is an “expected” server issue
That premise is incorrect, as 4xx is client errors, as in the client formatted the request wrong or anything else, and therefore it couldn't be responded to. Rate-limiting is the client hitting the server too much, and it's up the client to handle this.
5xx is for server issues.
2xx should be success in any shape or form, so clearly 2xx shouldn't be used in this case either.
I agree that 429 should just be used for it's intended purpose here, handling rate-limiting requests/responses. You can still add a body if you want, with the current quotas.
> From my reading, this "hand out a 2xx and an error message" advice is for badly behaved clients who are retrying when they get 4xx.
But trying to handle clients who mishandle things like that is a fools errand. What client, in their right mind, would try to retry a request that is failing because of what the client is sending? In no case does that make sense, ever.
Similarly, should everything just be 200 then just in case clients mishandle redirect requests?
A lot of developers are idiots. There is tons of code out there doing exactly this kind of thing.
People will copy random snippets from SO and smack them with a hammer until they seem to work then move on to the next thing. I've seen some incredibly stupid code out there, code I can only assume the author either didn't understand or truly didn't give a fuck about. Probably both.
> A lot of developers are idiots. There is tons of code out there doing exactly this kind of thing.
Sure, I agree a lot with this, but that doesn't mean you and me should also do idiotic things. Lets just return correct status codes and the ones who misuse it, will misuse it :)
To be fair in some cases rate-limiting could be triggered by a server-side issue, technically there's a 529 error for that, but I can't recall seeing it used.
But 4xx errors should exist as an indication to clients that there's no point immediately retrying the same request. If they're not honouring that, delaying before responding seems the most reasonable course of action.
That premise is incorrect, as 4xx is client errors, as in the client formatted the request wrong or anything else, and therefore it couldn't be responded to. Rate-limiting is the client hitting the server too much, and it's up the client to handle this.
5xx is for server issues.
2xx should be success in any shape or form, so clearly 2xx shouldn't be used in this case either.
I agree that 429 should just be used for it's intended purpose here, handling rate-limiting requests/responses. You can still add a body if you want, with the current quotas.