A matching validator avoids a body transfer, but unchanged file metadata can conceal changed bytes.

nginx validators are only as sound as their representation identity

A validator lets a recipient ask whether its stored representation still matches the selected one. A successful conditional GET can return 304 without retransmitting the body. Freshness is a separate decision: it determines when a stored response can be reused without that request. An ETag does not itself specify a cache lifetime, and a 304 is not a replacement body. ...

February 17, 2028 · 5 min · XB Field Notes
The transport version and response content coding are independent facts to inspect.

gzip, HTTP/2, and Brotli need separate verification

HTTP/2 changes HTTP transport framing and multiplexing; gzip and Brotli encode representation data. Enabling HTTP/2 does not automatically compress response bodies, and enabling gzip does not prove that a client negotiated HTTP/2. HTTP/2 header compression is another mechanism again. A reliable check records the negotiated protocol, response Content-Encoding, transferred body size, and the bytes obtained after decoding. ...

January 28, 2028 · 5 min · XB Field Notes
A client-visible redirect creates another request, while internal rewriting changes processing within the existing request.

Choose whether nginx redirects the client or rewrites internally

An nginx redirect and an internal rewrite change different parts of the request flow. A redirect returns a status and Location for the client to consider, potentially causing a new request. An internal rewrite changes nginx’s current URI while processing the existing request. Choosing between them determines whether the client sees a new address, whether location selection runs again, and how the final handler receives path and query data. ...

January 21, 2028 · 6 min · XB Field Notes
A header that governs whether, how long, and for whom a response may be reused.

Cache-Control is a contract between cache and origin

A cache policy needs a behavioral test, not just a header-presence check. Two responses can both contain max-age yet behave differently because one also requires validation or prohibits storage. The request matters too: a browser can bypass an otherwise reusable copy without changing the origin’s response policy or deleting an older cached entry. ...

December 20, 2027 · 5 min · XB Field Notes
Observe-decide-act boxes beside the message: Open the tunnel, verify the endpoint.

The CONNECT method opens a raw tunnel

CONNECT asks a proxy to establish a tunnel; it does not make the proxy disappear from the data path. After admission, the proxy still forwards bytes in both directions and owns sockets, buffers, and failure handling. CONNECT itself provides no encryption: HTTPS adds a separately verified TLS session through that tunnel. ...

December 13, 2027 · 6 min · XB Field Notes
HTTP headers that tell caches when a stored answer is still fresh.

Cache freshness is judged against a clock

A cache does not receive a new freshness allowance every time another cache forwards a response. It must account for age already accumulated along the delivery path, then add its own residence time. Otherwise a chain of individually plausible sixty-second caches can keep old content reusable much longer than the origin intended. ...

December 3, 2027 · 5 min · XB Field Notes
A bounded token reserve refills over elapsed time and admits only work whose cost fits.

A token bucket smooths the request rate

A token bucket bounds admitted work while allowing accumulated credit to be spent in a burst. It does not automatically space requests evenly, guarantee completed throughput, or cap the number of operations still running. Those are separate scheduling and capacity questions. The bucket’s two parameters describe a budget, not a promise that the service can perform it. ...

December 1, 2027 · 5 min · XB Field Notes
HTTP headers that describe which formats a client is willing to receive.

Accept headers let the server negotiate a reply

Negotiation selects among representations the server can actually produce. Request preferences are inputs to that decision, not evidence that the response will satisfy them. A client still needs to inspect the selected representation. Vary records the request dimensions relevant to reuse; it does not identify the chosen format, language, or compression method. ...

November 23, 2027 · 4 min · XB Field Notes