REST Anti-Patterns (2008)
 > Ignoring status codesMy favorite is when everything returns a 200, but the response is something like:   {
     status: "fail",
     error: "forbidden"
   }

Sometimes they even include the 403 in the response, almost like the developer is giving you a giant middle finger.