What is Status code?

A three-digit number on every response. 200s mean it worked, 400s mean the request was wrong or not allowed, 500s mean the server broke.

Where Status code goes wrong in real apps

Each of these is a short scenario built from a real failure in an app made with AI. Read the answer here, or walk through it yourself in about four minutes.

The life of a click · 4 minutes · Free
The save that saved nothing
A user clicks Save on their profile. A green 'Saved!' appears. When they reload, their changes are gone.
Why does my app say saved when the save failed?
fetch only throws on network failures, not on HTTP errors. A 500 response still resolves, so code that shows a success message right after await fetch() reports success even when the server failed. Check response.ok, and show the error when it is false.
Walk it, free
Who may see what · 4 minutes · Pro
The admin button
Only admins see the Refund button. A regular user has just refunded their own last three orders.
Is hiding the admin button enough?
No. Hiding a button only changes what is shown. Anyone can send the same request without the button. Every sensitive endpoint must check the caller's role on the server, reading that role from your database or a verified session, never from the request body.
Read the fix
Accounts and privacy · 3 minutes · Pro
No account with that email
Your 'forgot password' page helpfully says 'No account with that email'. A competitor uses it to check which of their clients are using your app.
Is 'no account with that email' a risk?
It can be. Different answers for existing and non-existing accounts let anyone test a list of emails and learn who uses your app, which is sensitive for health, dating or legal apps. Reply the same way either way, for example 'If an account exists, we've sent a link', and put the real information in the email.
Read the fix
Getting paid · 4 minutes · Pro
The webhook that failed every time
Payments work. Upgrades don't. Stripe's dashboard shows every webhook to your app failing with a 400.
Why does Stripe webhook verification fail?
The signature covers the exact raw bytes Stripe sent. It fails when your code parses the body as JSON before verifying, or when it uses the wrong signing secret. In Next.js App Router, read the body with request.text() and pass it unchanged to constructEvent. Each endpoint, including the Stripe CLI, has its own whsec_ secret.
Read the fix

Request: A message your browser (or any program) sends to a server asking for something: 'give me invoice 105' or 'save this profile'.
Endpoint: One specific address on your server that does one job, like /api/invoices. Each one needs its own safety checks.
Response: The server's reply to a request: the data, plus a status code saying whether it worked.
Server: A computer that runs your app's code out of sight. Users can't change what happens there, which is why checks belong there.
Browser: Chrome, Safari and friends. Everything that runs here is visible to, and changeable by, the person using it.
Database: Where your app keeps its data, organised in tables, like a set of spreadsheets.

All 62 terms in the glossary

Where Status code goes wrong in real apps

Each of these is a short scenario built from a real failure in an app made with AI. Read the answer here, or walk through it yourself in about four minutes.

The life of a click · 4 minutes · Free

The save that saved nothing

A user clicks Save on their profile. A green 'Saved!' appears. When they reload, their changes are gone.

Why does my app say saved when the save failed?

fetch only throws on network failures, not on HTTP errors. A 500 response still resolves, so code that shows a success message right after await fetch() reports success even when the server failed. Check response.ok, and show the error when it is false.

Walk it, free

Who may see what · 4 minutes · Pro

The admin button

Only admins see the Refund button. A regular user has just refunded their own last three orders.

Is hiding the admin button enough?

No. Hiding a button only changes what is shown. Anyone can send the same request without the button. Every sensitive endpoint must check the caller's role on the server, reading that role from your database or a verified session, never from the request body.

Read the fix

Accounts and privacy · 3 minutes · Pro

No account with that email

Your 'forgot password' page helpfully says 'No account with that email'. A competitor uses it to check which of their clients are using your app.

Is 'no account with that email' a risk?

It can be. Different answers for existing and non-existing accounts let anyone test a list of emails and learn who uses your app, which is sensitive for health, dating or legal apps. Reply the same way either way, for example 'If an account exists, we've sent a link', and put the real information in the email.

Read the fix

Getting paid · 4 minutes · Pro

The webhook that failed every time

Payments work. Upgrades don't. Stripe's dashboard shows every webhook to your app failing with a 400.

Why does Stripe webhook verification fail?

The signature covers the exact raw bytes Stripe sent. It fails when your code parses the body as JSON before verifying, or when it uses the wrong signing secret. In Next.js App Router, read the body with request.text() and pass it unchanged to constructEvent. Each endpoint, including the Stripe CLI, has its own whsec_ secret.

Read the fix

Related terms

Request

A message your browser (or any program) sends to a server asking for something: 'give me invoice 105' or 'save this profile'.

Endpoint

One specific address on your server that does one job, like /api/invoices. Each one needs its own safety checks.

Response

The server's reply to a request: the data, plus a status code saying whether it worked.

Server

A computer that runs your app's code out of sight. Users can't change what happens there, which is why checks belong there.

Browser

Chrome, Safari and friends. Everything that runs here is visible to, and changeable by, the person using it.

Database

Where your app keeps its data, organised in tables, like a set of spreadsheets.