Stack Overflow returning HTTP error code 418 (I'm a teapot)?

Question

First a little background:

I recently wrote a reverse proxy which I have found to work wonderfully so far, and being an avid Stack Overflow user, I thought I would try it out there.

I was just playing around and everything was working perfectly, until I hit one page that suddenly returned HTTP error code 418 (I'm a teapot) which was an april fools joke from Hyper Text Coffee Pot Control Protocol.

Why would Stack Exchange ever be set up to return this status code?

The pages I have found to return 418 with my reverse proxy are https://stackoverflow.com/users/login and https://stackoverflow.com/users/authenticate

I do not even know what to call this. I would at first have thought "Bug", but it is obviously not, because, well - how would you end up with an HTTP server returning 418 without doing it on purpose.

I will not dispute that this may be a result of my reverse proxy not doing something exactly the same as a browser, and because that is an OAuth authentication page and there may be some security or something, but perhaps it should be returning a more appropriate HTTP response?

And screenshot:

As requested, more information about the post request my client is sending. It is, for instance, sending a standard HttpWebRequest pointed at https://stackoverflow.com/users/authenticate with the client's cookies/useragent forwarded, method set to POST and post values of the following:

• fkey: "4dde960.........."
• oauth_version: ""
• openid_username: ""
• openid_identifier: "https://www.google.com/accounts/o8/id"

Answer 1

A while ago we finally switched the response to CSRF violations from a non-descript error page, as we had been doing for years, to something sensible that somewhat explains what's going on.

While implementing this change, I was considering what HTTP status code to return in such a case. Excerpt from our chatroom:

Me: There's really no good HTTP status code for an XSRF violation, but it feels like it should be a class 4 code. Any objection to returning a 418?

Marc: 403 seems more apt, but I can get with 418

Me: > Authorization will not help and the request SHOULD NOT be repeated.
that's 403, not really true
if you fix the xsrf token, repeating will help

412 Precondition Failed was also suggested, but that's not applicable either, since a "precondition" is a pretty specific thing in that context.

Long story short: There's not really a good status code for this case, so I figured we might as well return a 418. In addition, it's a little easter egg you just found :)

Note that these responses actually have a body that the browser displays; it's your proxy that hides this explanation.

Answer 2

The form you're submitting isn't valid, this is one possible result when your fkey isn't correct on the submission. Either it's missing, or it doesn't match what it should be.

Also, sometimes Stack Overflow is a teapot.