Other 5xx codes
All HTTP status codes in ASP.NET Core
5xx Server error
500 Internal Server Error
The server hit an unexpected condition, typically an unhandled exception.
In ASP.NET Core: ASP.NET Core sends it for unhandled exceptions. Add a ProblemDetails body with UseExceptionHandler.
500 in .NET
The StatusCodes constant, HttpStatusCode enum name, reason phrase, class, and how EnsureSuccessStatusCode() and the standard resilience handler treat 500.
| Constant | StatusCodes.Status500InternalServerError |
|---|---|
| HttpStatusCode | HttpStatusCode.InternalServerError |
| Reason phrase | Kestrel sends Internal Server Error |
| Class | 5xx, server error |
| IsSuccessStatusCode | false |
| EnsureSuccessStatusCode() | throws HttpRequestException: Response status code does not indicate success: 500 (Internal Server Error). |
| Standard resilience handler | retries it (treated as transient) |
Returning 500
Minimal APIs
TypedResults.InternalServerError()
TypedResults.InternalServerError<TValue>(error)
TypedResults.Problem(detail, instance, statusCode, title, type, extensions)
TypedResults.Problem()
Results.StatusCode(StatusCodes.Status500InternalServerError)
Results.Problem(statusCode: StatusCodes.Status500InternalServerError, detail: "...")Controllers
Problem(detail, instance, statusCode, title, type)
Problem()
StatusCode(StatusCodes.Status500InternalServerError)
Problem(statusCode: StatusCodes.Status500InternalServerError, detail: "...")Checked on Kestrel: Results.Forbid() without authentication configured, ControllerBase.Forbid() without authentication configured return 500.
The ProblemDetails body
What Results.Problem(statusCode: 500) sends (with AddProblemDetails()), as application/problem+json:
{
"type": "https://tools.ietf.org/html/rfc9110#section-15.6.1",
"title": "An error occurred while processing your request.",
"status": 500,
"traceId": "0HNA1B2C3D4E5:00000001"
}A controller's Problem(statusCode: 500) sends the same body.
A bare StatusCode(500) in an [ApiController] also gets a ProblemDetails body automatically; Results.StatusCode(500) in a minimal API sends an empty body unless you add UseStatusCodePages().
When ASP.NET Core sends 500 by itself
Results.Forbid() without authentication configured
Setup
app.MapGet("/r", () => Results.Forbid());
// no AddAuthentication()Request
GET /r HTTP/1.1Response (recorded)
HTTP/1.1 500 Internal Server ErrorForbid() does not write 403 itself: it asks the authentication handler to. With no authentication scheme registered it throws, and the client gets 500. ControllerBase.Forbid() behaves the same.
Fix: Register authentication, or return Results.StatusCode(StatusCodes.Status403Forbidden) directly.
ControllerBase.Forbid() without authentication configured
Setup
public IActionResult F() => Forbid();
// no AddAuthentication()Request
GET /api/redirects/forbid HTTP/1.1Response (recorded)
HTTP/1.1 500 Internal Server ErrorSame as Results.Forbid(): with no authentication scheme it throws and the client gets 500.
[property: Required] on a positional record
Setup
public record Invalid([property: Required] string Name);
[HttpPost]
public IActionResult Create(Invalid r) => Ok(r);Request
POST /api/records HTTP/1.1
Content-Type: application/json
{}Response (recorded)
HTTP/1.1 500 Internal Server Error
InvalidOperationException: Record type 'RecordsController+Invalid' has validation metadata defined on property 'Name' that will be ignored. 'Name' is a parameter in the record primary constructor and validation metadata must be associated with the constructor parameter.MVC refuses validation attributes on the properties of a positional record and throws for every request, so the endpoint always answers 500 (the body shows the exception, caught for this test).
Fix: Put the attribute on the parameter: public record Invalid([Required] string Name); then invalid input gets a normal 400.
An unhandled exception
Setup
app.MapGet("/throw", string () => throw new InvalidOperationException("boom"));Request
GET /throw HTTP/1.1Response (recorded)
HTTP/1.1 500 Internal Server ErrorIn Production the client gets 500 with an empty body. (In Development the developer exception page shows the details.)
Fix: Add AddProblemDetails() and UseExceptionHandler() for a ProblemDetails body; see the next example.
An unhandled exception with UseExceptionHandler
Setup
builder.Services.AddProblemDetails();
app.UseExceptionHandler();Request
GET /throw HTTP/1.1Response (recorded)
HTTP/1.1 500 Internal Server Error
Content-Type: application/problem+json
{
"type": "https://tools.ietf.org/html/rfc9110#section-15.6.1",
"title": "An error occurred while processing your request.",
"status": 500,
"traceId": "0HNA1B2C3D4E5:00000001"
}The exception handler writes a ProblemDetails body without exception details, which is safe for Production.
Every response on this page was recorded from ASP.NET Core 10.0.12 on Kestrel in the Production environment; the HttpClient rows come from .NET 10.0.12 and Microsoft.Extensions.Http.Resilience 10.10.0.