What causes "http status code %d" in AlistGo/alist?

Verify the URL with curl -I (or a browser) from the same network to see the exact status

http status code %d

Error message

http status code %d

What it means

The simple HTTP offline-download tool streams the URL with a GET and rejects any response with status >= 400. There is no retry, range resume, or header customization, so any server-side refusal surfaces as this bare status-code error. The body of the response (which usually explains the refusal) is discarded.

Source

Thrown at internal/offline_download/http/client.go:66

func (s SimpleHttp) Run(task *tool.DownloadTask) error {
	u := task.Url
	// parse url
	_u, err := url.Parse(u)
	if err != nil {
		return err
	}
	req, err := http.NewRequestWithContext(task.Ctx(), http.MethodGet, u, nil)
	if err != nil {
		return err
	}
	resp, err := s.client.Do(req)
	if err != nil {
		return err
	}
	defer resp.Body.Close()
	if resp.StatusCode >= 400 {
		return fmt.Errorf("http status code %d", resp.StatusCode)
	}
	// If Path is empty, use Hostname; otherwise, filePath euqals TempDir which causes os.Create to fail
	urlPath := _u.Path
	if urlPath == "" {
		urlPath = strings.ReplaceAll(_u.Host, ".", "_")
	}
	filename := path.Base(urlPath)
	if n, err := parseFilenameFromContentDisposition(resp.Header.Get("Content-Disposition")); err == nil {
		filename = n
	}
	// save to temp dir
	_ = os.MkdirAll(task.TempDir, os.ModePerm)
	filePath := filepath.Join(task.TempDir, filename)
	file, err := os.Create(filePath)
	if err != nil {
		return err
	}
	defer file.Close()

View on GitHub (pinned to 843d9dc814)

Solutions

Verify the URL with curl -I (or a browser) from the same network to see the exact status
If the server requires Referer/UA/cookies, use the aria2 tool with header options instead of the plain http tool
Re-copy a fresh signed link if the URL has an expiry signature
Fall back to downloading on a machine that is not blocked (geo/IP restrictions)

Example fix

// before: plain GET, no headers
req, _ := http.NewRequestWithContext(ctx, http.MethodGet, u, nil)

// after (when using aria2 instead): pass custom headers
{ "tool": "aria2", "url": "...", "headers": ["Referer: https://example.com", "User-Agent: Mozilla/5.0"] }

Defensive patterns

Strategy: validation

Validate before calling

req, _ := http.NewRequest(http.MethodHead, url, nil)
resp, err := http.DefaultClient.Do(req)
if err != nil || resp.StatusCode >= 400 {
    // reject before queuing the download
    return fmt.Errorf("url not downloadable (status %d)", resp.StatusCode)
}

Try / catch

resp, err := s.client.Do(req)
if err != nil {
    return err
}
defer resp.Body.Close()
if resp.StatusCode >= 400 {
    return fmt.Errorf("http status code %d", resp.StatusCode)
}

Prevention

Use aria2 with custom Referer/User-Agent headers for protected links instead of the plain http tool
Pre-check URLs with HEAD requests before queuing bulk downloads
Prefer fresh, unexpired signed URLs

When it happens

Trigger: Adding a URL that returns 403 (hotlink/Referer protection), 404 (dead link), 401 (auth required), or 5xx (server down) when the http tool issues its GET.

Common situations: CDN links that require a Referer or User-Agent the tool does not send; expired signed URLs; geo-blocked servers; mistyped URLs; servers that reject plain Go http-client fingerprints.

Related errors

AI-assisted analysis of AlistGo/alist@843d9dc814 (2026-08-15). Data as JSON: /api/errors/9ef4178096447be3. Report an issue: GitHub.