News for hackers. Stuff that matters.

A comment on Understanding the Worst .NET Vulnerability. Parent comment

Re:Understanding the Worst .NET Vulnerability by PantaloonFlames on Tuesday October 28, 2025 @06:47PM (#45740292)
If I transmit SOAP or JSONRPC over http, both of which use the response payload itself to contain whether the request was an error or not, what should the status be in case of error ?

I jsonrpc I think 200 OK is correct with an error payload that says “you are not authorized” or similar.

[ Parent | on HN ]
Re:Understanding the Worst .NET Vulnerability by jen20 on Wednesday October 29, 2025 @01:52AM (#45743118)
> over http

> what should the status be in case of error

400 to 500 range status code. You can't ignore the lower level protocol because you're implementing a higher level one.

[ Parent | on HN ]