IIS 7.0 documentation shows that IIS can return status codes (like 401.1) that do not conform to RFC7231 which says:

The status-code element is a three-digit integer code giving the result of the attempt to understand and satisfy the request

Why does IIS return non-compliant status codes which are going to break compliant client implementations?

CodePudding user response：

Your interpretation of the IIS documentation is wrong.

If you use a tool like Wireshark to carefully analyze the HTTP response messages generated by IIS/HTTP.sys, you will see they only contain a three-digit status code as the RFC requires.

However, it is inside IIS log files, as well as other traces/error pages that a substatus code is appended to better categorize the actual errors.

Keep in mind IIS has been out there for decades. So if anything is non-compliant, it is less likely to identify this late.