When should I return HTTP Status Code 500 (Internal Server Error) from REST application to client?

Question

I have seen people using the HTTP code 500 as a generic error code for all kind of error cases (server errors, http errors, code exceptions, expected record not found in DB, time-out exceptions etc). However I have also read and heard that this code 500 should only be used in case of errors originating from the application server (JBoss in my case), and NOT application itself ie not for code-exceptions or invalid passwords or DB-record-not-found cases. So, when should we return HTTP Status Code 500 from a REST service method?

Answer 1

As described in the HTTP spec:

The 5xx (Server Error) class of status code indicates that the server is aware that it has erred or is incapable of performing the requested method. Except when responding to a HEAD request, the server SHOULD send a representation containing an explanation of the error situation, and whether it is a temporary or permanent condition. A user agent SHOULD display any included representation to the user. These response codes are applicable to any request method.

^{Original: https://greenbytes.de/tech/webdav/rfc7231.html#rfc.section.6.6}

Note that from the protocol point of view, it doesn't matter whether it's the application server or something running inside the application server.