0

We have authorization server which is in charge of checking token validity, expiration etc. Which HTTP status code should be returned if the authorization server is down?

Should it be 401 with "Authorization server down" message, error 500, or something else?

2
  • 400 to 499 range is for client side error and 500 to 599 range is for server side error code Commented Aug 26, 2016 at 9:57
  • 4
    for server down 503 Service Unavailable will be used Commented Aug 26, 2016 at 10:03

1 Answer 1

2

503 Service Unavailable

https://www.rfc-editor.org/rfc/rfc7231#section-6.6.4

The 503 (Service Unavailable) status code indicates that the server is currently unable to handle the request due to a temporary overload or scheduled maintenance, which will likely be alleviated after some delay. The server MAY send a Retry-After header field (Section 7.1.3) to suggest an appropriate amount of time for the client to wait before retrying the request.

503 is preferable to 4xx because it correctly communicates that the request itself was fine, that the problem resides on the server, and retrying the request at a later time should work.

503 is preferable to 500 because it does a better job expressing the fact that the condition is expected to be temporary (especially in the case where the origin server is able to provide Retry-After).

Prior art:

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.