wristmittens

I have some disagreements with how the HTTP specification for 501 Not Implemented is defined & used, and not sure where to think out loud about this.

> 6.6.2. 501 Not Implemented > The 501 (Not Implemented) status code indicates that the server does not support the functionality required to fulfill the request. This is the appropriate response when the server does not recognize the request method and is not capable of supporting it for any resource.

However, metrics & monitors have generally evolved to measure a basic website "uptime" as a percentage of requests: (non-5xx) / (non-5xx + 5xx). A surge in 5xx response codes is a "something is wrong, we need to act now" PagerDuty type event.

So given the above, it's easy for a crawler / bot / malicious user to just `curl myserver.example.com -X FLUBBER` and generate a flurry of 501 Not Implemented (for Akka in this case) and erroneously trigger uptime monitors. (This happened to us, hence this inquiry.)

Instead, I feel that an unknown HTTP request should return 405 Method Not Allowed for any unknown request types, since it's a bad request, not a server error.

Do you have any thoughts?

[edit] It looks like Google is returning 405:

% curl https://www.google.com/ --silent --include -X FLUBBER | grep HTTP

HTTP/2 405