Http

Several URLs can deliver the same document: a tracking parameter, alternate host, or trailing-slash variant may leave the meaningful content unchanged. A canonical link identifies the preferred representation among suitable duplicates. It helps consumers interpret that relationship, but it does not redirect an HTTP request or force a search engine to select the declared URL. The declaration is useful only when its target and surrounding signals describe the actual content relationship. ...

Secure and SameSite are not checks the server performs. They are instructions the user agent follows when it decides whether to attach a cookie to an outgoing request, and the server only sees the result: a Cookie header, or nothing. That asymmetry is the point, and the trap. ...

HTTP persistence lets several request and response exchanges use one connection. That can avoid repeated TCP setup and, for HTTPS, repeated TLS negotiation. The benefit depends on latency, request size, and whether another usable connection already exists. Persistence does not make application work disappear, nor does it promise that a socket will remain open indefinitely. ...

Retry-After tells a client how long it ought to wait before a follow-up request. It is a scheduling signal, not proof that the next attempt will succeed or that replaying the original operation is safe. A client still needs a deadline, an attempt policy, and a decision about which operations it can retry. ...

An idle timeout closes a connection after a defined period without qualifying activity. It is a resource policy, not proof that the client disappeared. Quiet connections can belong to healthy clients; the useful question is which activity resets which timer, and what the protocol allows after closure. ...

A request-body limit bounds accepted input, not merely the number written in Content-Length. Enforce it while consuming the body, before committing application effects. Compressed input needs separate limits for encoded and decoded bytes. A 413 response is useful only if the expensive allocation or irreversible write has not already happened. ...

A default port lets a client omit a number when a protocol or configuration already supplies it. HTTP commonly uses TCP 80, HTTPS TCP 443, and SSH TCP 22. These assignments reduce configuration, but they do not inspect a listener’s bytes or establish its identity. An endpoint includes an address and transport as well as a port, and its application protocol still has to match the caller. ...

The HTTP Referer request header can tell a destination which page initiated a request. Its historical spelling differs from Referrer-Policy, the policy that controls how much source information the browser supplies. Depending on that policy and the destination, the value may include the source path and query, contain only the source origin, or be omitted. Sending the full URL to every external destination is not the modern default. ...