HTTP Status 418 – I'm a teapot | Hacker News Reader

HTTP Status 418 – I'm a teapot

developer.mozilla.org

193 pointsevo_9107 comments

For those who may not know, this comes from RFC 2324: ""Hyper Text Coffee Pot Control Protocol (HTCPCP/1.0), The RFC was published 1 April 1998 (April Fool's Day). There's a long history of humorous RFCs published on 1 April. For example, RFC 1149 "IP over Avian Carriers" https://en.wikipedia.org/wiki/IP_over_Avian_Carriers

List of Additional April Fool's RFCs https://en.wikipedia.org/wiki/April_Fools%27_Day_Request_for...

I still love that people actually went through the effort to "implement" it.

Any links to APIs that implement a 418 HTTP response code?

.Net seems to have it: https://docs.microsoft.com/en-us/dotnet/api/microsoft.aspnet...

http.StatusTeapot in Go: https://pkg.go.dev/net/http#pkg-constants

4k+ results on Github: https://github.com/search?utf8=&q=http.StatusTeapot&type=Cod...; ~600 excluding _test.go files: https://github.com/search?q=http.StatusTeapot+-filename%3A*_...

If I have anything to do with it, there is a 418 response hidden somewhere.

I recall a few internal projects at a previous employer would return 418 if the user managed to royally mess something up as a "wtf, how are you here?!" kind of response.

I feel like I am not alone in implementing 'weird' HTTP codes when I get bored / as an easter egg. Pretty sure I also used HTTP 420 at least once.

“Uhh ummm no” -code reviewer

Yeah, code reviews definitely killed some of the fun in coding, they are rarely performed with humor.

I generally make it a goal to have a test case with silly enough data to get a comment from a reviewer.

I remember reviewing a really long document (> 50 pages) that had in one bullet list the phrase 'Marks and Spencer tandoori chicken sandwich'. The doc was otherwise camera ready and the phrase was obviously there to see if I was in fact reading it

Ah, the good ol' 420 - EnhanceYourCalm

Unlike 418 I'm a Teapot, 420 Enhance Your Calm is actually a nonstandard HTTP status code. The correct response is 429 Too Many Requests. [1]

[1]: https://datatracker.ietf.org/doc/html/rfc6585#section-4

Binance API (i.e https://api.binance.com/api/v3/ticker/price) does it when there are too many requests from one IP (I assume that's the reason). They could have used something else like 429 but for some obscur reasons they're using 418 (if anyone knows the actual reason...).

It will happen often if you try to make a call to their API through Google sheet scripts.

https://www.google.com/teapot

No link but our internal API for mobile apps returns a 418 if the installed version is too old.

If you have an IoT teapot, when do you return it?

From the docs:

> ... indicates that the server refuses to brew coffee because it is, permanently, a teapot.

So I guess, when it is asked to perform coffee brewing? But pay close attention, to your general purpose brewer:

> A combined coffee/tea pot that is temporarily out of coffee should instead return 503.

I added the 418 response code to my gopher server [1]. There was one web bot that constantly hit it and was clueless that it wasn't a web server. It finally got a clue.

[1] https://github.com/spc476/port70

I sometimes return a 418 when request heuristics detect bad behavior that looks intentional. I don’t document it, though.

Http.cat implements it: https://http.cat/418

To toot my own horn, I did an April Fool’s status code RFC: 397 Tolerating, for when a client sends a flawed request, but you’re going to tolerate it because you know what they really meant:

https://pastebin.com/TPj9RwuZ

This is a good idea for APIs that allow you to update an object by sending a partial JSON object with the keys you want to update, when technically you’re supposed to send the entire updated object representation unless JSON Patch is being used.

Alternatively there actually is a HTTP PATCH verb that you can use for this - I think that tolerating is more appropriate for common misspellinks - i.e. accepting a request like an HTTP POST {"days": 12, "horus": 13 "minutes": 27}

But what happens when the API is updated to support Egyptian gods as keys?

You submit a scarab report.

April Fools RFCs are part of the "Independent Stream", which mean the top left would say "Independent Submission", not IETF. Also, Informational, not Standards Track. Just FYI :)

Is this basically "I'm doing the robustness principle but also communicating that I'm judging you"?

lol Pretty much! It cites the Robustness Principle.

That’s what I get for responding while eating dinner and not reading thoroughly lol

I love the concept.

At the firm I work at, one of my "10% time" projects was to build out a "warnings" field in the API response. There are often times that you want to say "this is not inherently wrong, but likely represents wrong assumptions upstream" or "you're asking for something that's obsolete and is now being silently ignored".

For example, if someone passes a currency field with the wrong number of decimal places. You might actually want to say your product costs $1.62346, but it's more likely you're not sanitizing your data and relying on non-guaranteed rounding behaviour to make it right.

The problem we have is that the most of the API fields are opt-in-- the people who could most use the warnings are unlikely to go in and activate them.

To be honest I think the robustness principle isn’t very well supported. We shouldn’t be this accommodating in what we accept. We’re very likely harming users by ignoring errors.

That said we should be much more accommodating in our user interfaces to help prevent this kind of crap data.

I'm shocked nobody's posted it yet, but iiNet (Australian ISP)'s coffee cam[0] is 13+ years running now:

https://coffeecam.iinet.net.au/coffee/

Some previous discussions on this status specifically: https://hn.algolia.com/?q=418

Some fun ones:

- Discussion on the status itself: https://news.ycombinator.com/item?id=24206899

- NPM proxy users receiving ERR 418 I'm a teapot: https://news.ycombinator.com/item?id=17175960

- Reserve the 418 status code: https://news.ycombinator.com/item?id=15004907

The NPM one is fun now, but man that was a frustrating one when it was happening. Explaining to people I couldn’t deploy the app because NPM decided it was a teapot. Error messages do not need to be silly.

I remember I was at some training course for New Relic and we zoned out when the alert came through. Having come across 418 before, I recognised it in our failed build pipeline and facepalmed. My coworker asked how do we fix it and U said I honestly don't know because it's never actually meant to be a real error code but here we are!

Thanks! I merged your list and mine to come up with:

Error 418 – I'm a Teapot - https://news.ycombinator.com/item?id=25282286 - Dec 2020 (14 comments)

I’m A Teapot – HTTP status code 418 - https://news.ycombinator.com/item?id=24206899 - Aug 2020 (118 comments)

HTTP 418: I'm a Teapot - https://news.ycombinator.com/item?id=22215285 - Feb 2020 (9 comments)

HTTP 418 I'm a Teapot - https://news.ycombinator.com/item?id=17652557 - July 2018 (39 comments)

Http status 418 at overstock.com - https://news.ycombinator.com/item?id=17529017 - July 2018 (2 comments)

NPM proxy users receiving ERR 418 I'm a teapot - https://news.ycombinator.com/item?id=17175960 - May 2018 (252 comments)

Reserve the 418 status code - https://news.ycombinator.com/item?id=15004907 - Aug 2017 (115 comments)

HTTP Error Code 418 I'm a Teapot is about to be removed from Node - https://news.ycombinator.com/item?id=14987460 - Aug 2017 (42 comments)

Google teapot error - https://news.ycombinator.com/item?id=14275583 - May 2017 (12 comments)

HTTP status code 418 (I'm a teapot) - https://news.ycombinator.com/item?id=13354835 - Jan 2017 (3 comments)

Ask HN: What's a good coffee pot for implementing the 418 protocol? - https://news.ycombinator.com/item?id=10659595 - Dec 2015 (2 comments)

Google's HTTP 418 Response - https://news.ycombinator.com/item?id=8269538 - Sept 2014 (2 comments)

Service for Generating Different HTTP codes. (418 I'm a teapot) - https://news.ycombinator.com/item?id=7383566 - March 2014 (3 comments)

HTTP Status Code 418 - https://news.ycombinator.com/item?id=7046027 - Jan 2014 (4 comments)

I'm a teapot - https://news.ycombinator.com/item?id=3511781 - Jan 2012 (29 comments)

HTTP Status 418 I'm a teapot - https://news.ycombinator.com/item?id=2221505 - Feb 2011 (33 comments)

HTTP Error 418: "I'm a teapot" - https://news.ycombinator.com/item?id=235856 - July 2008 (2 comments)

I'm personally of the opinion that 418 shouldn't be considered a joke response, but would actually useful as 418 "Unsupported Device".

What response should a printer give if you asked it to send a fax, but you have a base-model printer that doesn't support sending faxes. From the perspective of the printer, I know what you want (i.e. not a 404) and you've asked for it correctly (i.e. not 400 or 401 or 403), but I can't do it, and this does not indicate an error on my part (not a 500 or 503). Thus, 418: Unsupported Device.

Perhaps this too much of an overlap with 404 (I don't have that resource) and 501 (I can't do that verb to that resource), which I assume is why there's not a huge need for it. But if we're going to have 418 exist and receive browser support anyway, it might as well have a useful meaning rather than just exist as a joke.

This interpretation is fully in keeping with the non-joke meaning of the original RFC, as a teapot is a device that does not support brewing coffee.

It's complete overlap with 404 IMO

If you throw a 404 to a completely valid GET for a file that doesn't exist for example, how is that a "complete overlap" to something like asking a database REST API to print a PDF? In the latter case, you have the ability to give a more detailed (better) error message, so why shouldn't you?

I'd probably use a 422 in that case. I think 422 errors are underused, and can good for communicating errors when a client requests something which doesn't make sense from a business context.

For those that haven't memorized every single HTTP error code, 422 is "Unprocessable Entity": 'the server understands the content type of the request entity, and the syntax of the request entity is correct, but it was unable to process the contained instructions.'

I return 418 in some cases where somehow someone ended up somewhere in the code that I otherwise thought impossible. It works pretty well as far as letting folks know that something particularly unusual has happened / this isn't your ordinary error.

A less humorous unusual status code is 451. Unfortunately, it probably should be used more.

https://en.wikipedia.org/wiki/HTTP_451

I think that would get attention, although I wouldn't want there to be panic ;)

I come from a country with rather _interesting_ views on what should be allowed online. 451 is used often enough that I've seen it in the wild more than once (and consider yourself lucky if you haven't encountered it...).

I get those every so often from US websites that doesn't want to deal with the GDPR.

That suggests that there are websites anywhere that do want to deal with GDPR, which seems rather unlikely.

Of course there's a lot of people who would prefer to ignore laws. That doesn't make GDPR an especially bad one.

Except a 4xx error should not be issued for internal errors.

I do hope this is a humorous comment

Why? The codes mean things, 418 specifically is a joke, but the entire 4xx range are client errors, i.e. a differently formed request would've succeeded.

A perhaps-reasonable suggestion could be to use a 5xx range code that isn't specified. E.g. 555, or 567.

(But I'm not sure how it would ever not simply be a 500 - server thought it couldn't happen, it could and did, that's just a plain and simple error isn't it?)

I think the idea behind 418, as much as there was an idea beyond a joke, was to indicate you sent your request to a teapot instead of a server. So yeah, client error for why it's not 518 instead.

But it works in this example for "client did something weird I don't understand", so still client error - something akin to a 404, "client tried to go somewhere I don't understand".

Yes, exactly, I wasn't excluding 418 in saying all 4xx are errors in the client's request.

But 'client did something weird I don't understand' is a 400, 405, something; not the same as 'this cannot happen' at all.

But it's the clients fault for trying to communicate with a teapot. There's nothing wrong inside the teapot. You just tried to communicate with a teapot. That's silly. Here's a 418 for you.

Again, yes, I am not saying 418 is wrong to be 4xx, I am including it in 'the entire 4xx range are client errors'.

I would be extremely disappointed if a 555 error didn't have something to do with bad timing.

400 series codes are for client errors. 500 series codes are for server errors.

It's quaint, it's a joke about IoT devices before they were everywhere. I'm currently disappointed that the office has "upgraded" coffee machines and the new one has a permanent internet connection and shows ads/branding (for coffee) when it is idle.

I read a while ago about some coffee machines unintentionally bridging an internal network and spreading ransomware. I think they had Windows XP on the inside. Couldn't help but find the situation funny in a way.

Good old XP.

Cleaned someone’s virus infected computer out. Plugged the network jack into the cable modem. Under 10 second and I had to start from scratch…

When work tells us they are blocking all external connections in data center, I can’t really argue even with how much work it is.

A couple of years ago the gas pumps at station nearest to my place were replaced by devices with screens that play ads with sound - so far just touting discounts with their supermarket loyalty cards. They start when someone picks up the nozzle, and were annoyingly loud initially; the sound has been turned down a bit lately.

(Well, there's another reason for me to be pleased with having traded one of the family cars for an electric that charges at home ...)

There are usually buttons next to pump screens and one will mute the sound. Just push them one by one.

the manufacturers caught on to that specific mitigation, and it doesn't work that often in the wild anymore.

Ours have it prominently marked MUTE ->

There are a few gas stations around here with pumps that like to play ads at you while pumping gas. I tend to make a note of them and purposely get my gas elsewhere.

So, if the server were a real "smart" IoT teapot, such response become actually valid? :)

Well, this is an error code, so yes but- only if someone asks the teapot to brew a cup of coffee. Per the spec.

One day in the future, people will be amazed out how forward thinking our society was circa 1999 when they planned status codes for IoT devices that wouldn't be invented for another 20 years. "Oh if only society now could be as wise forward thinking as people were back then. Planting seeds in gardens they'd never get to see."

>and shows ads/branding (for coffee) when it is idle.

If there is ever an Office Space 2, I think this is a candidate for the new fax machine.

I think for the same reason that Fawlty Towers ended after one season, there should never be a sequel to Office Space.

It’s too perfect. It could only go downhill.

Fawlty Towers ran for two series, but your point remains.

Agreed on principle, although in the last 2 years there's enough material for a highly successful Idiocracy sequel. Probably a short series too.

No, there must be a sequel; Open Office Space.

Office Space is great but the cubicles date it firmly in the 90s.

Office Space 2 => Open Office Space => Silicon Valley

> Office Space is great but the cubicles date it firmly in the 90s.

I had a cubicle almost identical to the ones in Office Space all the way up to 2011. If I ever had to return to an office, I’d much prefer that over any office desk I’ve had since.

Do you mean ads in the sense of "please buy brand X coffee" or in the sense of "please try some of this machine's delicious coffee"?

just stuff that emphasizes the brand of coffee that's in the machine. It's ridiculous (obviously an ad to buy that brand at home too, which I safely won't since I like my specialty coffee).

We need coffee machines that shut up and serve coffee and don't do brand ads.

If only such a coffee machine still existed.

Yo dawg.... We heard U like coffee

Sounds like it needs to be playing Doom instead. Or hacked to show branding for tea.

I guess it's been about a generation since I implemented this as an easter-egg in a RESTful API service I built. It was quite the joke then, but now with IoT "smart" teapots and whatnot being so popular, it's not so funny now.

Came to mention this. It really was a fantastic joke. May it rest in peace. pours one out

Google's 418 error page: https://www.google.com/teapot

Fun fact: if you're on mobile the site will use your accelerometer to let you pour water out of the teapot!

Would it be valid for an actual IoT teapot to return this instead of a 200 for a valid request?

It's an error code. It should be returned by a tea pot as a response to a request for coffee.

My favorite part is that the response body can optionally include "short and stout".

Reminds me of the twitter "Enhance Your Calm" 420 status code in lieu of 429.

Support for this landed in Microsoft Edge v12, according to the table in the article. So it's supported across all major browsers, green across the board. But all that may be humorous lisense.

Hm, that's surprising. I added it as a known error response to the Internet Explorer dev tools in 2015 (inadvertently causing "I'm a teapot" to be localized into 108 languages...). I wonder what "support" means.

For full standards compliance, the teapot should be designed and implemented according to the ISO-3103:2019 specification.

https://en.wikipedia.org/wiki/ISO_3103

https://www.iso.org/standard/73224.html

There are a few thousand web servers that return this status code for their main page :) https://www.shodan.io/search/report?query=http.status%3A418&...

https://http.cat/418

I really hope this is used by https://cosori.com/products/smart-electric-gooseneck-kettle-...

It's all fun and games until some clever developer uses this error code in a production system and the client developer or SRE folks have no idea what it means. Have also seen error code 420 used this way.

I was counting on that when I added status 418 to my gopher server. It shut a particular web bot right up when I did that.

Nice to see more members of the community discovering a classic. Also... I am so old I've seen this on the homepage multiple times :-(

I’m in my late twenties and I’ve seen it dozens of time too

Haha yes it keeps going round and round

There is a "418 – I'm a teapot" book too (by Edgar Scott). I highly recommend it for dystopian hard sci-fi lovers.

A fun one I found out a while back is that Twitter used 420 Enhance Your Calm instead of 429 Too Many Requests to rate limit.

I've heard it's been used a lot by the MOVA developers

Is this the first 'IoT' spec ever? :)

I can't remember but didn't some company try to implement this for an actual connected tea pot?

Russel's Teapot?

i wonder how this is handled in vr browsers?

Reply on news.ycombinator.com