500 Internal Server Error
The server hit an unexpected condition and cannot say anything more specific. It is the catch-all for unhandled exceptions.
At a glance
- Status code
- 500 Internal Server Error
- Class
- 5xx, server error, the request looked fine and the server failed
- Defined in
- RFC 9110
- Cacheable by default
- by explicit headers only
- Response body
- A generic error page. Must not leak internals.
In detail
500 admits the fault is on the server side and that the server does not know what to tell you. Every other 5xx code is a more specific version of this.
Never return 500 for something you can name. If the request was invalid it is a 4xx, if a dependency is down it is 502 or 503.
Correlate by request identifier. A 500 body should carry an id that appears in the server log, because the useful detail must not be in the response itself.
Examples
HTTP/1.1 500 Internal Server Error
Content-Type: application/json
{"error":"internal","request_id":"01J8Q2"}Things that catch people out
- Stack traces in a 500 body are an information disclosure vulnerability. They name framework versions, file paths and sometimes credentials.
- A 500 rate that tracks deploys exactly is a code fault. A 500 rate that tracks traffic is usually resource exhaustion, which is closer to 503.
Try it: HTTP Request Builder
Build a request with any method, headers and body, send it, and read the status line the server returns.
HTTP Request Builder
LOCAL · Browser-OnlyBuild and test HTTP requests with custom headers and body
Authentication
Headers
Generate Code
curl -X GET 'https://api.example.com/endpoint' \
-H 'Content-Type: application/json'Showing a sample URL. Enter your endpoint above to update the snippet.
Related HTTP status codes
All http status codes →502 Bad Gateway
A proxy or load balancer got an invalid response from the upstream server it was relaying to. The failure is behind the thing that answered you.
503 Service Unavailable
The server is temporarily unable to handle the request, because it is overloaded or deliberately down for maintenance. The condition is expected to clear.
400 Bad Request
The server refused the request because it was malformed. The client must change something before retrying, because repeating the same bytes will fail.
501 Not Implemented
The server does not support the functionality required to fulfil the request, typically an unrecognised request method.
504 Gateway Timeout
A proxy gave up waiting for the upstream server to answer. The upstream may still be working on the request.
505 HTTP Version Not Supported
The server refuses the major HTTP version used in the request line.
Tools for this
- HTTP Request Builder Free online HTTP request builder - build and test HTTP requests with custom headers and body
- HTTP Headers Checker Free online HTTP headers checker - view HTTP response headers for any URL