What is Response?

The server's reply to a request: the data, plus a status code saying whether it worked.

Where Response goes wrong in real apps

Each of these is a short scenario built from a real failure in an app made with AI. Read the answer here, or walk through it yourself in about four minutes.

The life of a click · 4 minutes · Free
The save that saved nothing
A user clicks Save on their profile. A green 'Saved!' appears. When they reload, their changes are gone.
Why does my app say saved when the save failed?
fetch only throws on network failures, not on HTTP errors. A 500 response still resolves, so code that shows a success message right after await fetch() reports success even when the server failed. Check response.ok, and show the error when it is false.
Walk it, free
AI inside your app · 3 minutes · Pro
The answer that stopped mid-sentence
Short answers in your study app are fine. Long ones end mid-sentence, like this: 'The third cause of the war was the'
Why does my AI response get cut off?
The model reached the maximum output tokens set in your request and was stopped. The response says so: finish_reason is 'length' at OpenAI, stop_reason is 'max_tokens' at Anthropic. Set a limit that fits the answers you want, check the stop reason on every reply, and continue or warn the user when it was cut off.
Read the fix
The life of a click · 4 minutes · Pro
Blocked by CORS
Your API works in Postman. In the browser: 'blocked by CORS policy'. Your AI has 'fixed' the frontend three times.
How do I fix 'blocked by CORS policy'?
Fix it on the server that answers the request, not in your frontend. Browsers send a preflight OPTIONS request first; the API must reply with headers allowing your site's origin and the headers you use. Allow only your own origins rather than everyone, and remember CORS is not authentication.
Read the fix
Launch day · 4 minutes · Pro
The old price
You raised your price an hour ago. Your admin page shows the new price. Customers are still checking out at the old one.
Why do customers still see my old price?
The page is cached: a saved copy is served to visitors until it expires or is refreshed. Your admin page reads the database, so it looks right. Refresh the cache whenever prices change, and always calculate the amount you charge on the server, never from the price the page sends.
Read the fix
Don't trust the browser · 4 minutes · Pro
The curious link preview
Your app shows a preview card when someone pastes a link. A user pasted an odd address, and the preview showed your server's cloud credentials.
What is SSRF in a link preview feature?
Server-side request forgery happens when your server fetches a URL a visitor provides, and the visitor points it at internal addresses such as localhost, private networks or the cloud metadata address 169.254.169.254. Allow only http and https, resolve the address and refuse internal ranges, limit redirects, time and size, and return only the title and image.
Read the fix
Launch day · 4 minutes · Pro
The 504 at second 60
Generating a long AI report works on your laptop. In production, where the route's time limit is set to 60 seconds, big reports fail with '504 Gateway Timeout'.
Why do I get a 504 timeout only in production?
Hosted serverless functions stop at a set time limit, while your laptop has none. Long AI calls, imports or file processing exceed it and return 504 Gateway Timeout. Streaming improves the wait but still counts toward the limit; move long tasks to a background job that reports progress.
Read the fix

Request: A message your browser (or any program) sends to a server asking for something: 'give me invoice 105' or 'save this profile'.
Server: A computer that runs your app's code out of sight. Users can't change what happens there, which is why checks belong there.
API: The part of an app that other programs talk to. Your app's pages ask its API for data, like a waiter taking orders to a kitchen.
Endpoint: One specific address on your server that does one job, like /api/invoices. Each one needs its own safety checks.
Authentication: Checking who someone is, usually by signing in.
Status code: A three-digit number on every response. 200s mean it worked, 400s mean the request was wrong or not allowed, 500s mean the server broke.

All 62 terms in the glossary

Where Response goes wrong in real apps

Each of these is a short scenario built from a real failure in an app made with AI. Read the answer here, or walk through it yourself in about four minutes.

The life of a click · 4 minutes · Free

The save that saved nothing

A user clicks Save on their profile. A green 'Saved!' appears. When they reload, their changes are gone.

Why does my app say saved when the save failed?

fetch only throws on network failures, not on HTTP errors. A 500 response still resolves, so code that shows a success message right after await fetch() reports success even when the server failed. Check response.ok, and show the error when it is false.

Walk it, free

AI inside your app · 3 minutes · Pro

The answer that stopped mid-sentence

Short answers in your study app are fine. Long ones end mid-sentence, like this: 'The third cause of the war was the'

Why does my AI response get cut off?

The model reached the maximum output tokens set in your request and was stopped. The response says so: finish_reason is 'length' at OpenAI, stop_reason is 'max_tokens' at Anthropic. Set a limit that fits the answers you want, check the stop reason on every reply, and continue or warn the user when it was cut off.

Read the fix

The life of a click · 4 minutes · Pro

Blocked by CORS

Your API works in Postman. In the browser: 'blocked by CORS policy'. Your AI has 'fixed' the frontend three times.

How do I fix 'blocked by CORS policy'?

Fix it on the server that answers the request, not in your frontend. Browsers send a preflight OPTIONS request first; the API must reply with headers allowing your site's origin and the headers you use. Allow only your own origins rather than everyone, and remember CORS is not authentication.

Read the fix

Launch day · 4 minutes · Pro

The old price

You raised your price an hour ago. Your admin page shows the new price. Customers are still checking out at the old one.

Why do customers still see my old price?

The page is cached: a saved copy is served to visitors until it expires or is refreshed. Your admin page reads the database, so it looks right. Refresh the cache whenever prices change, and always calculate the amount you charge on the server, never from the price the page sends.

Read the fix

Don't trust the browser · 4 minutes · Pro

The curious link preview

Your app shows a preview card when someone pastes a link. A user pasted an odd address, and the preview showed your server's cloud credentials.

What is SSRF in a link preview feature?

Server-side request forgery happens when your server fetches a URL a visitor provides, and the visitor points it at internal addresses such as localhost, private networks or the cloud metadata address 169.254.169.254. Allow only http and https, resolve the address and refuse internal ranges, limit redirects, time and size, and return only the title and image.

Read the fix

Launch day · 4 minutes · Pro

The 504 at second 60

Generating a long AI report works on your laptop. In production, where the route's time limit is set to 60 seconds, big reports fail with '504 Gateway Timeout'.

Why do I get a 504 timeout only in production?

Hosted serverless functions stop at a set time limit, while your laptop has none. Long AI calls, imports or file processing exceed it and return 504 Gateway Timeout. Streaming improves the wait but still counts toward the limit; move long tasks to a background job that reports progress.

Read the fix

Related terms

Request

A message your browser (or any program) sends to a server asking for something: 'give me invoice 105' or 'save this profile'.

Server

A computer that runs your app's code out of sight. Users can't change what happens there, which is why checks belong there.

API

The part of an app that other programs talk to. Your app's pages ask its API for data, like a waiter taking orders to a kitchen.

Endpoint

One specific address on your server that does one job, like /api/invoices. Each one needs its own safety checks.

Authentication

Checking who someone is, usually by signing in.

Status code

A three-digit number on every response. 200s mean it worked, 400s mean the request was wrong or not allowed, 500s mean the server broke.