REST Anti-Patterns (2008)
 > Ignoring status codes<p>My favorite is when everything returns a 200, but the response is something like:<p><pre><code>   {
     status: "fail",
     error: "forbidden"
   }
</code></pre>
Sometimes they even include the 403 in the response, almost like the developer is giving you a giant middle finger.