404 versus custom error page?

[sinister]

I have some CGI programs that spit out error pages when the user enters
illegal form input. These custom error pages, while informing the user of
errors, are otherwise just standard web pages.

Is there a disadvantage to not spitting out a 404 error? I assume 404 isn't
just another webpage, but carries with it the information that an error
occured---in so simple a manner that it could be used for e.g. link
checking.

TIA,

S

[Anne van Kesteren]

Re: 404 versus custom error page?

sinister wrote:
[color=blue]
> [snip][/color]

404 is a HTTP header, which should be sent when a file can't be found. I
think your error page has a different meaning.


--
Anne van Kesteren
<http://www.annevankest eren.nl/>

[Harlan Messinger]

Re: 404 versus custom error page?


"sinister" <sinister@nospa m.invalid> wrote in message
news:eAqzb.662$ uE6.596@nwrddc0 2.gnilink.net.. .[color=blue]
> I have some CGI programs that spit out error pages when the user enters
> illegal form input. These custom error pages, while informing the user of
> errors, are otherwise just standard web pages.
>
> Is there a disadvantage to not spitting out a 404 error? I assume 404[/color]
isn't[color=blue]
> just another webpage, but carries with it the information that an error
> occured---in so simple a manner that it could be used for e.g. link
> checking.[/color]

HTTP status codes are just that--HTTP status codes. They tell the browser
the outcome of its HTTP request for a resource (page, image file, whatever),
such as:

whether the resource is being returned as asked (200)

whether the browser needs to look elsewhere for the
resource it requested (a client-side redirect, 302)

whether the browser needs to be authenticated
before the page will be provided (401)

whether authentication has failed (403)

whether the URL refers to a non-existent resource (404)

In your situation, you are asking about an *application* error. There was no
*HTTP* error: the server correctly found the resource you requested, which
is, after all, the resource (web page) that determined that the form input
was bad. The correct HTTP status code to be return in this situation is 200.

[David Dorward]

Re: 404 versus custom error page?

sinister wrote:
[color=blue]
> I have some CGI programs that spit out error pages when the user enters
> illegal form input. These custom error pages, while informing the user of
> errors, are otherwise just standard web pages.
>
> Is there a disadvantage to not spitting out a 404 error? I assume 404
> isn't just another webpage, but carries with it the information that an
> error occured---in so simple a manner that it could be used for e.g. link
> checking.[/color]

404 says a _specific_ error has occurred, i.e. that the requested resource
could not be found.

You would be better of picking the appropriate error message for the
generated error.

http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html

--
David Dorward <http://dorward.me.uk/>

[sinister]

Re: 404 versus custom error page?


"sinister" <sinister@nospa m.invalid> wrote in message
news:eAqzb.662$ uE6.596@nwrddc0 2.gnilink.net.. .[color=blue]
> I have some CGI programs that spit out error pages when the user enters
> illegal form input. These custom error pages, while informing the user of
> errors, are otherwise just standard web pages.
>
> Is there a disadvantage to not spitting out a 404 error? I assume 404[/color]
isn't[color=blue]
> just another webpage, but carries with it the information that an error
> occured---in so simple a manner that it could be used for e.g. link
> checking.
>
> TIA,
>
> S[/color]

Thanks to AVK, DD, HM for prompt, useful replies. (Seems to be a productive
group.)

[sinister]

Re: 404 versus custom error page?


"Harlan Messinger" <h.messinger@co mcast.net> wrote in message
news:bqle04$24g t97$1@ID-114100.news.uni-berlin.de...[color=blue]
>
> "sinister" <sinister@nospa m.invalid> wrote in message
> news:eAqzb.662$ uE6.596@nwrddc0 2.gnilink.net.. .[color=green]
> > I have some CGI programs that spit out error pages when the user enters
> > illegal form input. These custom error pages, while informing the user[/color][/color]
of[color=blue][color=green]
> > errors, are otherwise just standard web pages.
> >
> > Is there a disadvantage to not spitting out a 404 error? I assume 404[/color]
> isn't[color=green]
> > just another webpage, but carries with it the information that an error
> > occured---in so simple a manner that it could be used for e.g. link
> > checking.[/color]
>
> HTTP status codes are just that--HTTP status codes. They tell the browser
> the outcome of its HTTP request for a resource (page, image file,[/color]
whatever),[color=blue]
> such as:
>
> whether the resource is being returned as asked (200)
>
> whether the browser needs to look elsewhere for the
> resource it requested (a client-side redirect, 302)
>
> whether the browser needs to be authenticated
> before the page will be provided (401)
>
> whether authentication has failed (403)
>
> whether the URL refers to a non-existent resource (404)
>
> In your situation, you are asking about an *application* error. There was[/color]
no[color=blue]
> *HTTP* error: the server correctly found the resource you requested, which
> is, after all, the resource (web page) that determined that the form input
> was bad. The correct HTTP status code to be return in this situation is[/color]
200.

That sounds reasonable---it's not an HTTP error, so just return the
customized page as I've been doing.

Thanks.
[color=blue]
>[/color]

[Tim]

Re: 404 versus custom error page?

On Wed, 3 Dec 2003 14:36:34 -0500,
"Harlan Messinger" <h.messinger@co mcast.net> wrote:
[color=blue]
> In your situation, you are asking about an *application* error. There was no
> *HTTP* error: the server correctly found the resource you requested, which
> is, after all, the resource (web page) that determined that the form input
> was bad. The correct HTTP status code to be return in this situation is 200.[/color]

Or perhaps a different response, one indicating a user error, rather
than an all was fine response, when it wasn't.

Perhaps some of the other 400 series errors mentioned at:
<http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html>?

e.g. 10.4.1 400 Bad Request

The request could not be understood by the server due
to malformed syntax. The client SHOULD NOT repeat the
request without modifications.

I suppose it'd depend on whether you considered a client's mistake to be
a creation of an "error" at the server, even if not an HTTP error.

--
My "from" address is totally fake. (Hint: If I wanted e-mails from
complete strangers, I'd have put a real one, there.) Reply to usenet
postings in the same place as you read the message you're replying to.

[Tim]

Re: 404 versus custom error page?

On Wed, 03 Dec 2003 19:12:10 GMT,
"sinister" <sinister@nospa m.invalid> wrote:
[color=blue]
> I have some CGI programs that spit out error pages when the user enters
> illegal form input. These custom error pages, while informing the user of
> errors, are otherwise just standard web pages.[/color]

Depending on the nature of the error, that'd be correct.
[color=blue]
> Is there a disadvantage to not spitting out a 404 error? I assume 404 isn't
> just another webpage, but carries with it the information that an error
> occurred---in so simple a manner that it could be used for e.g. link
> checking.[/color]

A 404 response is a HTTP error message, which can also include a HTML
page (such as an explanation, or some help to work around the problem).

The 404 HTTP response is for the browser to know that an error has
occurred, and perhaps warn the surfer about it (it's also for the
benefit of any other non-web browser user-agent). The written HTML,
that may come with it, is for the surfer's benefit.

--
My "from" address is totally fake. (Hint: If I wanted e-mails from
complete strangers, I'd have put a real one, there.) Reply to usenet
postings in the same place as you read the message you're replying to.

[Harlan Messinger]

Re: 404 versus custom error page?


"Tim" <admin@sheerhel l.lan> wrote in message
news:da40tvk6ek pc77pten6l18sss e2dvu6faq@4ax.c om...[color=blue]
> On Wed, 3 Dec 2003 14:36:34 -0500,
> "Harlan Messinger" <h.messinger@co mcast.net> wrote:
>[color=green]
> > In your situation, you are asking about an *application* error. There[/color][/color]
was no[color=blue][color=green]
> > *HTTP* error: the server correctly found the resource you requested,[/color][/color]
which[color=blue][color=green]
> > is, after all, the resource (web page) that determined that the form[/color][/color]
input[color=blue][color=green]
> > was bad. The correct HTTP status code to be return in this situation is[/color][/color]
200.[color=blue]
>
> Or perhaps a different response, one indicating a user error, rather
> than an all was fine response, when it wasn't.
>
> Perhaps some of the other 400 series errors mentioned at:
> <http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html>?
>
> e.g. 10.4.1 400 Bad Request
>
> The request could not be understood by the server due
> to malformed syntax. The client SHOULD NOT repeat the
> request without modifications.[/color]

An HTTP 400 status code means that the server can't respond to the request.
In the case at hand, the HTTP request is fine and the server is responding
to it just fine, passing back to the client whatever stream the web resource
requested produces. The server understands the request just fine, and it
finds the page that is being requested.

Why would you *want* your user to see a generic 400 error instead of a
message produced by your application telling him what his error is and
giving him a chance to correct it?
[color=blue]
>
> I suppose it'd depend on whether you considered a client's mistake to be
> a creation of an "error" at the server, even if not an HTTP error.[/color]

It isn't open to personal discretion. An error in data input to the
application is not an HTTP communication error. Of course, you can do what
you want. No one is going to put you in jail. I'm speaking in terms of the
correct use of the status codes.

[Alan J. Flavell]

Re: 404 versus custom error page?

On Fri, 5 Dec 2003, Harlan Messinger wrote:
[color=blue]
> It isn't open to personal discretion.[/color]

Hmmm...
[color=blue]
> An error in data input to the
> application is not an HTTP communication error.[/color]

In the WWW *model* that we're discussing here, there _is_ no
"applicatio n" as such: there is a client, and it communicates with a
server black box by presenting an opaque token (the URL). The error
as communicated by HTTP is the final result of presenting that opaque
token to the black box.

Your "applicatio n" is no more than an internal detail of the server
implementation, as far as this WWW model is concerned.

I stand by my conclusion that if the server decides that a well-formed
request has been presented, but no productive content has been found
for fulfilling that request, then 404 is an approprate status return.
With, of course, appropriate body content to explain the situation.

The onus is on any WWW-conforming web client[1] to present that body
content to the client user.

cheers

[1] I guess we all know what that includes. And excludes.

[Harlan Messinger]

Re: 404 versus custom error page?


"Alan J. Flavell" <flavell@ph.gla .ac.uk> wrote in message
news:Pine.LNX.4 .53.03120515431 10.25622@ppepc5 6.ph.gla.ac.uk. ..[color=blue]
> On Fri, 5 Dec 2003, Harlan Messinger wrote:
>[color=green]
> > It isn't open to personal discretion.[/color]
>
> Hmmm...
>[color=green]
> > An error in data input to the
> > application is not an HTTP communication error.[/color]
>
> In the WWW *model* that we're discussing here, there _is_ no
> "applicatio n" as such: there is a client, and it communicates with a
> server black box by presenting an opaque token (the URL). The error
> as communicated by HTTP is the final result of presenting that opaque
> token to the black box.
>
> Your "applicatio n" is no more than an internal detail of the server
> implementation, as far as this WWW model is concerned.
>
> I stand by my conclusion that if the server decides that a well-formed
> request has been presented, but no productive content has been found
> for fulfilling that request, then 404 is an approprate status return.[/color]

I think it's hard to argue that "not found" includes the case of "found, but
the resource that was found wishes it hadn't been" or "found, and wants to
send a response to the user, but wants to pretend that that response had
been pulled out of the server's hind quarters rather than having been
generated by the resource".

I'm not talking about *all* cases where an error was found by a process
sitting on top of the web server rather than by the web server itself. For
example, if you've got a content management system sitting on top of Apache
or IIS, and ask the CMS for a non-existent page:

http://www.cms.com/cms-process?page=108452

then the process *ought* to send 404.
[color=blue]
> With, of course, appropriate body content to explain the situation.
>
> The onus is on any WWW-conforming web client[1] to present that body
> content to the client user.
>[/color]

Actually, here's another approach to the question: what practical difference
would you expect in the result if a 404 was returned instead of a 200 in
response to invalid form data entry, if you are sending a body back with the
response either way? There ought to be a *point* to sending a 404. What
would you expect the browser to do differently? Why?

[Alan J. Flavell]

Re: 404 versus custom error page?

On Fri, 5 Dec 2003, Harlan Messinger wrote:
[color=blue][color=green]
> > In the WWW *model* that we're discussing here, there _is_ no
> > "applicatio n" as such: there is a client, and it communicates with a
> > server black box by presenting an opaque token (the URL). The error
> > as communicated by HTTP is the final result of presenting that opaque
> > token to the black box.[/color][/color]
[...][color=blue]
> I think it's hard to argue that "not found" includes the case of "found, but
> the resource that was found wishes it hadn't been"[/color]

You don't seem to have grasped the concept of the black box. The
requested resource was _not_ found. The fact that the CGI script was
invoked is a mere internal detail.

You might as well claim that a request for /foo/bar.html (assuming the
conventional static situation) was "found" if the corresponding foo
subdirectory was found, even though it didn't happen to contain the
file bar.html. It's still 404 not found.
[color=blue]
> Actually, here's another approach to the question: what practical
> difference would you expect in the result if a 404 was returned
> instead of a 200 in response to invalid form data entry, if you are
> sending a body back with the response either way? There ought to be
> a *point* to sending a 404. What would you expect the browser to do
> differently? Why?[/color]

Hint: not all HTTP clients are browsers.

[Harlan Messinger]

Re: 404 versus custom error page?


"Alan J. Flavell" <flavell@ph.gla .ac.uk> wrote in message
news:Pine.LNX.4 .53.03120517422 10.25622@ppepc5 6.ph.gla.ac.uk. ..[color=blue]
> On Fri, 5 Dec 2003, Harlan Messinger wrote:
>[color=green][color=darkred]
> > > In the WWW *model* that we're discussing here, there _is_ no
> > > "applicatio n" as such: there is a client, and it communicates with a
> > > server black box by presenting an opaque token (the URL). The error
> > > as communicated by HTTP is the final result of presenting that opaque
> > > token to the black box.[/color][/color]
> [...][color=green]
> > I think it's hard to argue that "not found" includes the case of "found,[/color][/color]
but[color=blue][color=green]
> > the resource that was found wishes it hadn't been"[/color]
>
> You don't seem to have grasped the concept of the black box. The
> requested resource was _not_ found.[/color]

Yes. It was.
[color=blue]
> The fact that the CGI script was
> invoked is a mere internal detail.[/color]

No, it's not, because the CGI script produced a meaningful result that is
correct for the request.
[color=blue]
>
> You might as well claim that a request for /foo/bar.html (assuming the
> conventional static situation) was "found" if the corresponding foo
> subdirectory was found, even though it didn't happen to contain the
> file bar.html. It's still 404 not found.[/color]

Not the same thing.
[color=blue]
>[color=green]
> > Actually, here's another approach to the question: what practical
> > difference would you expect in the result if a 404 was returned
> > instead of a 200 in response to invalid form data entry, if you are
> > sending a body back with the response either way? There ought to be
> > a *point* to sending a 404. What would you expect the browser to do
> > differently? Why?[/color]
>
> Hint: not all HTTP clients are browsers.[/color]

How helpful is picking at my overly generic use of the word "browser" in
answering my question?

[David Dorward]

Re: 404 versus custom error page?

Harlan Messinger wrote:
[color=blue]
> Why would you *want* your user to see a generic 400 error instead of a
> message produced by your application telling him what his error is and
> giving him a chance to correct it?[/color]

There is nothing preventing one from sending an HTTP error code _and_ a
custom HTML document as the body part of the response (of course if the
body (including linked files - like images) is less then about 5k, MSIE
will decide its not helpful enough and replace it with a 'friendly' error
page - so include a nice image to boost the file size :D)

--
David Dorward <http://dorward.me.uk/>

[Harlan Messinger]

Re: 404 versus custom error page?


"David Dorward" <dorward@yahoo. com> wrote in message
news:bqummo$mbj $2$8302bc10@new s.demon.co.uk.. .[color=blue]
> Harlan Messinger wrote:
>[color=green]
> > Why would you *want* your user to see a generic 400 error instead of a
> > message produced by your application telling him what his error is and
> > giving him a chance to correct it?[/color]
>
> There is nothing preventing one from sending an HTTP error code _and_ a
> custom HTML document as the body part of the response (of course if the
> body (including linked files - like images) is less then about 5k, MSIE
> will decide its not helpful enough and replace it with a 'friendly' error
> page - so include a nice image to boost the file size :D)[/color]

Is that how it works? So "friendly", those MS people.