Http

Because the call comes from outside, delivery becomes at-least-once, so a receiver must tolerate retries and prove the origin rather than assume it is safe. One event, one callback A webhook turns the usual direction of an API call around: instead of a client polling for fresh data, the provider sends an HTTP request to a URL you registered whenever an event happens. The payload is a small, self-contained description of what changed, delivered straight to an endpoint that is often on an entirely different server. Because the publisher initiates the call, the subscriber stops reopening connections and simply waits for something to arrive, which is how delivery can feel nearly instant without continuous polling. ...

Least-connections balancing chooses a peer using active connection counts, with the implementation’s weighting and tie rules. In nginx, least_conn accounts for server weights and uses weighted round robin among equally suitable peers. This can help when requests occupy connections for different durations. It is still a connection-based measurement, not direct knowledge of CPU, memory pressure, queued jobs, or database contention. ...

Multipart/form-data is one HTTP representation containing several independently described parts. A client chooses a boundary parameter, places that value in the Content-Type header, and writes matching delimiter lines into the body. The arrangement lets one request carry text fields and binary files without pretending that all bytes share one JSON or text grammar. The boundary is framing metadata, not a security decision or a file-type detector. ...

Server-Sent Events carry server-to-client updates in a streaming HTTP response. They do not turn HTTP into a bidirectional socket, and automatic reconnection does not make delivery durable. Treat event framing, connection lifetime, retained history, and application acknowledgment as separate contracts. A response contains framed text events An SSE response uses text/event-stream and UTF-8. Fields are line-based, and a blank line ends a block. Multiple data lines within one event are joined with newline characters. A colon-prefixed comment is ignored as event data, so it can carry a heartbeat without triggering an application message. ...

An HTTP/1.1 request does not describe where it ends. Its boundary is computed — from Content-Length or the chunked coding — and every hop computes it independently. Request smuggling is what happens when two hops compute different answers from the same bytes. ...

Changing an origin does not notify every cache that already holds its response. Invalidation is about controlling which stored copies remain eligible for reuse, not merely updating a file. A reliable release distinguishes expiration, validation, targeted removal, and choosing a new URL. These mechanisms have different scopes, and none remotely erases every copy a reader has downloaded. ...

A CORS preflight asks whether a browser may send a particular cross-origin request. It describes the requesting origin, intended method, and relevant header names. The browser evaluates the reply before sending that request, unless a valid preflight cache entry already grants permission. CORS also governs whether JavaScript can read the actual response. These are related checks, but neither replaces application authentication or authorization. ...

A 404 response has two audiences. Software needs an accurate status; a person needs a useful next step. A beautifully designed error page cannot compensate for a false 200, and a correct status does not excuse an inaccessible page. Keep both parts of the response truthful without turning a missing address into a business outage. ...