HTTP 408 Request Timeout – Free, Online, Private

What HTTP 408 means

408 says the server was willing to wait and the client did not send the complete request in time. It is a server-side timer on an idle or very slow upload, not a timer on your application logic after the request was received. A slow database after a complete request is not 408. That is 504 or 500, depending on who gave up.

408 Request Timeout belongs to the 4xx client error class. Clients that only look at the class will group it with its neighbors. Clients that care about the exact code should use the narrower rule on this page, because the class is only the first digit.

When you see HTTP 408

When you see HTTP 408 Request Timeout, stop on that exact status line. 408 Request Timeout means the server timed out waiting for the client to finish the request. The trace that usually produces it: A client opened a connection and never sent the body. The 4xx client error class only tells you the first digit. A neighbor in that class is a different fault, and the fix on this page does not transfer to it.

Return 408 when you close an incomplete request because the client went quiet. Include Connection: close if you are dropping the connection. Do not use 408 for a client you gave up on after the body arrived. Do not use it for a gateway timeout. That is 504.

How to fix HTTP 408

To fix HTTP 408, change the condition that made the server choose Request Timeout. Retry the full request on a new connection if the operation is safe or idempotent. For a POST, retry only with an idempotency key. Increase the client's send speed or the timeout if the body is legitimately large. A retry can succeed because the failure was the transmission, not the content. Do not retry forever. Back off. If the log line is a different code, leave this page. The mix-up people make with 408 is this one: 504 means a gateway timed out waiting for the upstream. 408 means this server timed out waiting for the client. 503 means the server is refusing work.

• A mobile client stalled midway through an upload.
• A proxy's idle timeout fired and it synthesized 408.
• A server used 408 for a slow query and clients retried a request the server was still executing.

An access log that only stores 408 is not enough to tell these apart. Keep the method, the path, and a request id. Do not keep the Authorization header or a request body that might be a token. The status explains the outcome. It is not a place to echo secrets back to the client either.

Example response

HTTP 408 Request TimeoutHTTP/1.1 408 Request Timeout
Connection: close

Connection: close tells the client the socket is done. The client should open a new connection before retrying. There is often no body. If the upload was partial, the server has discarded it.

What the client should do

Retry the full request on a new connection if the operation is safe or idempotent. For a POST, retry only with an idempotency key. Increase the client's send speed or the timeout if the body is legitimately large.

Do not cache 408. It describes a dead connection, not the resource.

A retry can succeed because the failure was the transmission, not the content. Do not retry forever. Back off.

Codes people confuse with HTTP 408

504 means a gateway timed out waiting for the upstream. 408 means this server timed out waiting for the client. 503 means the server is refusing work.