408 Request Timeout - HTTP Status Code

Meaning & Description

The 408 Request Timeout status code indicates that the server did not receive a complete request message within the time that it was prepared to wait. This usually happens when the client has a slow network connection or when an open connection is idling without sending data.

Common Causes

Extremely slow client network speeds
Large file uploads hitting server timeout limits
Slowloris attacks intentionally keeping connections open
Misconfigured server timeout settings (e.g., set too aggressively)

How to fix a 408 error

Check if the client network is experiencing high latency or packet loss.
If uploading large files, increase the read/write timeout settings on your web server (e.g., Nginx `client_body_timeout`).
Look at server access logs to see if a specific IP is intentionally stalling connections (potential DDoS).
Ensure the client application is actually sending data and not just holding an idle connection open.

Browser & SEO Behaviour

Browser Behavior

Browsers usually automatically retry the request quietly if they receive a 408 on an idle keep-alive connection. If it persists, they show a network error.

SEO Impact

If crawlers consistently receive 408s, it indicates severe server performance or configuration issues, leading to deindexing.

CDN Behavior

CDNs heavily enforce read timeouts to protect their edge nodes. They will return 408 to the client if the client is too slow.

Code Examples

Node.js (http)

const http = require('http');

const server = http.createServer((req, res) => {
  res.end('Hello');
});

// Set a tight timeout of 5 seconds for receiving the request
server.requestTimeout = 5000; 

server.listen(8080);

Python (Gunicorn)

# In Gunicorn (WSGI server for Python), you configure this via CLI or config file,
# not directly in FastAPI/Flask code.
# The --timeout parameter is for worker processing (504/500), but 
# --keep-alive or reverse proxy settings handle client-side 408s.

# Command line example:
# gunicorn main:app --keep-alive 2

Go (net/http)

package main
import (
    "net/http"
    "time"
)

func main() {
    server := &http.Server{
        Addr: ":8080",
        // Closes connection if headers take longer than 5 seconds
        ReadHeaderTimeout: 5 * time.Second, 
        // Closes connection if full request takes longer than 10 seconds
        ReadTimeout: 10 * time.Second, 
    }
    server.ListenAndServe()
}

C# (Kestrel)

// In ASP.NET Core Program.cs
builder.WebHost.ConfigureKestrel(options =>
{
    // Drop the connection if the request body is sent too slowly
    options.Limits.MinRequestBodyDataRate = 
        new MinDataRate(bytesPerSecond: 100, gracePeriod: TimeSpan.FromSeconds(10));
});

curl

# Simulating a slow client by limiting upload speed
curl -i -X POST http://api.example.com/upload \
  --limit-rate 1K \
  -d "a_very_large_payload..."

Raw HTTP Response Example

HTTP Response

HTTP/1.1 408 Request Timeout
Connection: close
Content-Type: application/json
Content-Length: 59

{
  "error": "Server timed out waiting for the request"
}

Real-world Examples

Nginx: Returns 408 if `client_body_timeout` or `client_header_timeout` is exceeded.

AWS Application Load Balancer: Returns 408 if a client does not send a full request within the configured idle timeout.

Cloudflare: Returns 408 to clients that open a connection but fail to send headers fast enough.

Frequently Asked Questions

What is the difference between 408 and 504?

408 Request Timeout means the *client* was too slow to send the request to the server. 504 Gateway Timeout means the *server* (or a proxy) was too slow to get a response from an upstream backend server.

Why does my file upload result in a 408?

Your server likely has a strict timeout configured. If your internet connection is slow, the server closes the connection before the upload finishes.

Can the browser automatically fix a 408?

Sometimes. If a browser has kept a connection open (Keep-Alive) and the server times it out with a 408, modern browsers will transparently open a new connection and try again.

How do I prevent 408 errors?

Ensure client applications send data promptly after opening a connection. On the server side, ensure timeout thresholds are generous enough for users on slow networks.

Is a 408 error my fault or the server's fault?

It is technically a client error (4xx category) because the client failed to transmit data fast enough, but it can be caused by the server having unrealistically strict timeout settings.

Did You Know?

The 408 status code is often associated with the "Slowloris" attack, a famous technique where an attacker sends HTTP headers extremely slowly to tie up all the server's concurrent connections.

A 408 response should always include a `Connection: close` header to explicitly terminate the stalled connection.

Developer Tips

Always configure `ReadTimeout` and `ReadHeaderTimeout` in your HTTP servers to protect against resource exhaustion attacks.
If you expect clients to upload large files over slow networks, consider implementing chunked uploads or direct-to-S3 uploads to bypass strict web server timeouts.
Do not confuse 408 with application-level timeouts (like a database query taking too long), which should result in a 504 Gateway Timeout or 503 Service Unavailable.

Interview Questions

These are questions you might face in a backend or API design interview that touch on HTTP 408.

Explain the difference between 408 Request Timeout and 504 Gateway Timeout.

408 is a client error: the client took too long to send its request to the server. 504 is a server error: a proxy or gateway took too long waiting for an upstream backend service to respond.

How does returning a 408 status code help protect against DDoS attacks?

By enforcing strict timeouts and returning 408, servers can drop idle or intentionally slow connections (like Slowloris attacks), freeing up worker threads to handle legitimate traffic.

If a client is uploading a 5GB video and the connection drops after 10 minutes, what code should the server log?

It should log a 408 Request Timeout, as the server was waiting for the remainder of the request body but the client failed to provide it within the allotted time.

Common Interview Mistakes

Confusing 408 (Client slow) with 504 (Server/Upstream slow).
Assuming the server crashed.
Forgetting that 408 is an effective countermeasure for Slowloris attacks.