HTTP Guides

HTTP Status Codes Explained

What the five status-code classes (1xx-5xx) mean, how to read a status line, and the quick rules you use to debug with them.

Choosing the Right REST API Status Code

When to use 200/201/204, 400/401/403/404/409/422/429, and 500/503, plus consistency and idempotency-key design.

HTTP Caching Explained

Cache-Control, ETag/If-None-Match, Last-Modified/If-Modified-Since, 304, CDN vs browser caches, cache busting, and Vary.

CORS Explained

Same-origin policy, simple vs preflighted requests, the OPTIONS preflight, Access-Control-* headers, credentials, and the errors you'll actually hit.

HTTP Authentication

Basic vs Bearer, WWW-Authenticate, 401 vs 403, tokens/JWT vs sessions/cookies, and why HTTPS is non-negotiable.

HTTP Redirects, In Depth

301 vs 302 vs 303 vs 307 vs 308, method/body preservation, SEO and link equity, redirect chains and loops, and the Location header.

Safety and Idempotency: Designing for Retries

Safe vs idempotent methods, why they govern retries, idempotency keys, and how to design PATCH and DELETE safely.

HTTP/1.1 vs HTTP/2 vs HTTP/3

keep-alive, head-of-line blocking, multiplexing, and QUIC/UDP — what changed across HTTP versions and how it affects you in practice.

Cookies & Sessions

How Set-Cookie/Cookie keep state, the cookie attributes (HttpOnly/Secure/SameSite/Domain/Path/Max-Age), session vs token auth, CSRF, size limits, and third-party cookie deprecation.

Content Negotiation

How Accept / Accept-Language / Accept-Encoding and q-values pick a representation, server-driven vs agent-driven negotiation, the Vary header for caching, and the 406 response.

HTTP Compression: gzip, Brotli, zstd

gzip vs Brotli vs deflate vs zstd, the Accept-Encoding/Content-Encoding negotiation, what and when to compress, the BREACH/CRIME risks, and Content-Encoding vs Transfer-Encoding.

Rate Limiting

429 and Retry-After, the RateLimit-* headers, token-bucket / sliding-window / fixed-window algorithms, client backoff with jitter, and per-user vs per-IP limits.

Server-Sent Events & Streaming

text/event-stream and EventSource, the event/data/id/retry fields, automatic reconnection, SSE vs WebSocket vs long-polling, and chunked transfer.

Conditional Requests

Strong vs weak ETags, If-None-Match/If-Match, Last-Modified/If-Modified-Since, 304 and 412, and using optimistic concurrency to prevent the lost-update problem.

Range Requests

The Range/Content-Range/Accept-Ranges headers, 206 and 416, resumable downloads, If-Range, multipart/byteranges, and how video streaming uses them.

REST API Design Principles

Resource naming, versioning strategies, cursor vs offset pagination, filtering/sorting, the RFC 9457 problem+json error format, and HATEOAS basics.

Understanding TLS/HTTPS

What TLS guarantees, the handshake (ClientHello→certificate→key exchange), TLS 1.2 vs 1.3, certificates and CAs, SNI, ALPN, cipher suites, and mixed content.

HTTP/2 Internals

Binary framing, streams and multiplexing, HPACK header compression, the deprecated server push, prioritization and flow control, h2c, and the TCP head-of-line blocking limit.

HTTP/3 and QUIC

QUIC over UDP, 0-RTT/1-RTT handshakes, per-stream loss recovery (no TCP HoL), connection migration, QPACK, Alt-Svc discovery, and the deployment reality.

Understanding WebSockets

The HTTP Upgrade handshake (101), Sec-WebSocket-Key/Accept, frames, ws:// vs wss://, WebSocket vs SSE vs long-polling, subprotocols, and scaling.

HTTP Connection Management

The TCP connection lifecycle, keep-alive/persistent connections, connection pooling, the HTTP/1.1 pipelining trap, the Connection header, timeouts, and when connections get reused.

Resource Hints and Preloading

preconnect, dns-prefetch, preload, prefetch, modulepreload, prerender, the Link header vs <link>, priority, and 103 Early Hints.

HTTP Request Smuggling

The Content-Length vs Transfer-Encoding ambiguity, CL.TE/TE.CL/TE.TE variants, front-end/back-end desync, impact, and defenses (normalize, end-to-end HTTP/2, reject ambiguous).

Webhooks Explained

Server-to-server HTTP callbacks for event delivery: HMAC signing and verification, retries and idempotency, ordering, 2xx-to-ack, replay protection, and debugging.

API Versioning Strategies

URI path (/v1) vs header (Accept, custom) vs query param, when to bump, announcing deprecation with Deprecation/Sunset headers, backward compatibility, and media-type versioning.

Designing API Pagination

offset/limit vs cursor/keyset, page metadata, the Link header (rel=next/prev/first/last, RFC 8288), the cost of deep offsets, stable ordering, and total counts.

Well-Known URIs Explained (RFC 8615)

The /.well-known/ convention (RFC 8615) and the key paths: security.txt, change-password, openid-configuration, acme-challenge, apple-app-site-association, assetlinks.json, ai.txt/llms.txt.

URL/URI Anatomy, Dissected

The components scheme, authority (userinfo/host/port), path, query, and fragment; percent-encoding; reserved vs unreserved characters; IDN/punycode; relative vs absolute; and normalization.

GraphQL over HTTP

Single-endpoint POST, query/variables/operationName, using GET for queries, application/graphql-response+json, the '200 with errors' convention, caching challenges, and batching.

Content Security Policy in Practice

Building a policy, nonces vs hashes vs strict-dynamic, a report-only rollout, common breakages, reporting endpoints, the default-src fallback, frame-ancestors, and upgrade-insecure-requests.