Is 418 "I'm a teapot" really an HTTP response code?

Question

Is 418 "I'm a teapot" really an HTTP response code?

There are various references to this on the internet, including in lists of response codes, but I can't figure out whether it's a weird joke.

Limitative

See en.wikipedia.org/wiki/List_of_HTTP_status_codes#418. – Skunk

Obligatory: google.com/teapot – Damondamour

418 is the first thing I implement for testing my project each time I start a new one. – Redness

So in summary: 1. It's a weird joke (but also one that makes me laugh; 2. Yes, it's real (at least concerning RFC 2324). – Uveitis

It is included in Spring Boot HttpStatus class the same way as all legitimate status codes. Spring Boot is a very popular Java webserver backend framework, so better consider it real an don't use it for anything else. docs.spring.io/spring-framework/docs/current/javadoc-api/org/… – Hangnail

While 418 "I'm a teapot" is not supposed to be serious. nevertheless the IANA has reserved 418 for "future use", so that no other entity might use it. The advantage is having a 4XX code which is completely safe to use for whatever project that needs it with the assurance that it will never conflict with codes existing in the future. – Yellowish

Check out the full list of IETF April Fools Day proposals, they've been creating a new one consistently every year: en.wikipedia.org/wiki/April_Fools%27_Day_Request_for_Comments – Templia

Answer 1

I use this code. I have nginx reverse-proxying requests to two separate HTTP servers. One handles requests for unauthenticated users, and the second handles requests for authenticated users. The problem in this particular case, is the first server is the one that determines if the user is authenticated. Please don't ask why.

So, if the first server determines the user is authenticated, it responds 418 I'm a teapot. NGINX then reroutes the traffic internally to the second server. As far as the browser is concerned, it was a single request.

This is in the spirit of HTCPCP code 418, because if you attempt to BREW with a teapot, the appropriate response is "I'm not the kind of thing that can handle that request, but there may be others." .. In other words, "I'm a teapot. Find a coffee maker." (the second server being the coffee maker).

Ultimately, while 418 is not explicitly defined in RFC 7231, it is still covered by the umbrella of 4xx (Client Error).

6. Response Status Codes

• 4xx (Client Error): The request contains bad syntax or cannot be fulfilled

6.5. Client Error 4xx

• The 4xx (Client Error) class of status code indicates that the client seems to have erred. Except when responding to a HEAD request, the server SHOULD send a representation containing an explanation of the error situation, and whether it is a temporary or permanent condition. These status codes are applicable to any request method. User agents SHOULD display any included representation to the user.

Rejection

I have a 3rd party provider (a really bad one) who would answer with 418 if you were missing the Accept header. I always thought it was because they were just bad, but this actually explains what was happening. Still doesn't forgive them for leaking that status code out of their servers though – Lenticular

@Lenticular It may have been appropriate for them to respond with 400 Bad Request, or 415 Unsupported Media Type, any 4xx code represents a client error, so could be interpreted that way. – Rejection

This status code is added to the standard library module http in Python 3.9. – Aniela

It is defined in RFC 2324 at section 2.3.2, that whole RFC is an April Fools' joke back from 1998 – Additive

With the onset of IoT, this protocol may actually be a viable protocol at some point. If I ever made an IoT teapot, you can rest assured this protocol would be used. – Sparhawk

@Lenticular thx, adding a header fixed it: HttpClient client = new HttpClient(); client.DefaultRequestHeaders.Accept.Clear(); client.DefaultRequestHeaders.Add("User-Agent", "test"); Remarkable that the U.S. National library would return a 418! url: id.loc.gov/authorities/names/no2017084878 – Hypoderma

@Hypoderma yeah, so it is not that they are returning it, it is more like they are not properly error-handling nginx auth reverse-proxy when sending an answer they just forward the error they get from nginx out to you nobody tests their error handling properly... – Lenticular

@Lenticular I see. Thanks for clearing that up. I've handled it on my side (and tested it) – Hypoderma

Answer 2

HTTP response code 418 was originally defined in RFC 2324 ("Hyper Text Coffee Pot Control Protocol (HTCPCP/1.0)") and RFC 7168 ("The Hyper Text Coffee Pot Control Protocol for Tea Efflux Appliances (HTCPCP-TEA)") protocols.

Per Wikipedia: List of HTTP status codes: #418

This code was defined in 1998 as one of the traditional IETF April Fools' jokes, in RFC 2324, Hyper Text Coffee Pot Control Protocol, and is not expected to be implemented by actual HTTP servers. The RFC specifies this code should be returned by teapots requested to brew coffee. This HTTP status is used as an Easter egg in some websites, including Google.com.

Nigger

It's worth making really clear it's not a real status code. The official list is here: iana.org/assignments/http-status-codes/… – Hardball

@Hardball what affects whether something in a RFC becomes "official"? Could you make your comment into an answer so I can accept it? – Limitative

@Limitative I don't feel good about trying to write the IETF and standardization process into a small comment because I'll probably get bits wrong. Ultimately I believe this lies with the relevant IETF working groups. – Hardball

I use it as a placeholder or a 'todo' when I'm building web apps. Somewhat similar idea to the fictional phone numbers ofcom.org.uk/phones-telecoms-and-internet/… I can be sure it will never be used seriously. – Carroty

@ChrisHuang-Leaver for a placeholder you have find a 501 not implemented more appropriate. – Unyielding

@Hardball it seems real to me - unlike unassigned, 418 is unused. This seems to make to real – Emanuelemanuela

@Emanuelemanuela sure, for varying definitions of 'real'. It exists so it's 'real' in that way. It's just not official or standard or has a real purpose. It's a joke. – Hardball

@Hardball technically the IETF does acknowledge the use of 418: "[RFC2324] was an April 1 RFC that lampooned the various ways HTTP was abused; one such abuse was the definition of an application-specific 418 status code. In the intervening years, this status code has been widely implemented as an "Easter Egg", and therefore is effectively consumed by this use." - datatracker.ietf.org/doc/draft-ietf-httpbis-semantics Though It does note that it could be resigned in the future. – Gritty

Answer 3

Yes, I can confirm, that I've seen HTTP 418 coming back from a real production server. It does exist.

Aminoplast

The WebException class will display whatever response code and status text is returned in the request. If the first line of the response header was "432 One Zero", the message would be "The remote server returned an error: (432) One Zero". It might be more helpful to know what server you were calling when this error occurred, and what software it was running. – Rejection

Well.. Some libraries actually has this thing in its enum. Ref: docs.spring.io/spring-framework/docs/current/javadoc-api/org/… – Seduce

teapotme.com – Cupro

Answer 4

Yes it's a "real" code in the sense that it was published as part of an official RFC by the Internet Engineering Task Force, RFC-2324. However, since that RFC was published on April 1 and meant as an April fools joke (along with the rest of Hyper Text Coffee Pot Control Protocol), not for legitimate implementation, it's not a "serious" code in the typical sense*. That's why most sites use it as an Easter egg, but otherwise avoid it. As noted by wizulus in this comment, there are often more appropriate statuses like 400 (Bad Request). Despite its satirical nature, it's now a reserved code (presumably as a result of becoming a popular engineering meme for the briefest moment), so don't expect it to be going anywhere anytime soon.

*according to the RFC's author, Larry M Masinter, the HTTP extension in question actually does serve a serious-but-satirical purpose: "it identifies many of the ways in which HTTP has been extended inappropriately."

Tonnage

Answer 5

You really should not ask a HTTCP (Hyper-Text Teapot Control Protocol) to brew coffee. That's a job for a HTCPCP (Hyper-Text Coffee Pot Control Protocol).

Phenosafranine

Both of which are approved RFCs and Shall Be Implemented Soon on upcoming IoT-enabled coffee pots & teapots. – Yellowish

Answer 6

I think it is safer to treat 418 as a reserved code that once had a half - official meaning but now officially "unassigned".

I assume, historically something has been differently thought about these codes than it is now. This sounds meaningless and funny today; probably was not?

In other words, I would avoid using this code.

Ballerina

"Probably was not" no, actually it's pretty much just an April fools joke. People not paying attention to what day of April it was when the RFC went out might have thought it was a serious thing though! – Tonnage

This is clearly the code to be used when someone want to mess with your server. The official RFC 2324 standard could be used any time of the year, even outside 1th of April. – Tetrapod

This was a perfectly good opportunity to make a joke about half-and-half. – Oaten

You could say that 418 is a reserved code, but currently unassigned. This means that requests for returning 418 will be rejected by the IETF and IANA, since 418 is already "reserved". On the flip side of the coin, it's the equivalent of so-called "private IP addresses", which everybody knows that they cannot be used to route "real" IP traffic, and thus can be used for whatever purpose we want. Similarly, you can do with 418 whatever you want, with the assurance that nobody will ever be able to give it a different meaning! – Yellowish

I think you are fight. 418 may be something good to use locally under testing and development because it is unlikely to clash with anything else running. – Alicyclic

Answer 7

I actually use it. In my project we have a backend and a frontend and if I'm developing a new API I use 418 to denote "Bad Requests that should not be possible to make in the frontend". They now trigger an event in our error reporting tool with severity level "warning", where standard 400 only trigger at level "info".

I would not like to use a 500 because it is an error on the caller and I don't think it is a regular 400, because we have many cases where the backend is handling the validation and 400's is not a bug. We could have used a 501, but it is in the 4xx because it is a request error.

Herring

"I actually use it" - yeah, and you can use any other status code as you like. But that does not make it an official response code. Please have a look at the other answers that provide links to the official documents containing the code – Sherrylsherurd

I like how people go out of their way to make the case that you shouldn't return this status code. Like you, I use it for bad requests, but specifically requests that should never be made from the front-end or from apps using my API. From experience, I know these are all coming from hackers probing my API with SQL injection attempts. I used to return 200 and an empty body, but this seems more appropriate (status 418 with a short and stout body). Play stupid games, win stupid prizes. – Prytaneum

Answer 8

There was some debate about removing it. And sounds like if status code 418 is here for a while.

But, aside of the initial first April joke, it is used by some applications. For instance, in my WebServer library, if an IP is banned because it was identified to try some fuzzing or DoS attacks, it returns "418 I'am a teapot" during a few seconds and close the connection just after the socket accept(), and before TLS handshake takes place. I find this usage fair enough.

IANA now mentions it officially as "unused" but reserved:

15.5.19. 418 (Unused)

[RFC2324] was an April 1 RFC that lampooned the various ways HTTP was abused; one such abuse was the definition of an application-specific 418 status code, which has been deployed as a joke often enough for the code to be unusable for any future use. Therefore, the 418 status code is reserved in the IANA HTTP Status Code Registry. This indicates that the status code cannot be assigned to other applications currently. If future circumstances require its use (e.g., exhaustion of 4NN status codes), it can be re-assigned to another use.

source: https://www.rfc-editor.org/rfc/rfc9110.html#name-418-unused

The Save 418 Movement was a success, and has now its paragraph in the 418 Wikipedia page.

Tetrapod

Answer 9

Some times server set some rules to deny bad requests, In my case I fixed with code

setRequestProperty("User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0");

below :

public static void processRequest(HttpServletRequest req, HttpServletResponse resp) throws Exception {
   ...Some Other codes ...
   HttpsURLConnection connection = (HttpsURLConnection) new URL("https://www.example.org/" + uri + "?" + querySting).openConnection();
        connection.setDoOutput(true);
        connection.setDoInput(true);
        connection.setRequestProperty("Content-type", "text/xml");
        System.out.println("uri:" + uri);
        System.out.println("querySting:" + querySting);
        resp.addHeader("Access-Control-Allow-Origin", "*");

        resp.setHeader("Access-Control-Allow-Headers", "*");
        connection.setRequestProperty("User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0");

Westerly

Please add some explanation to your answer such that others can learn from it. How does it even relate to the given question? – Sherrylsherurd