HTTP/3 carries HTTP over QUIC instead of TCP. QUIC offers independently ordered streams, so a missing range in one stream need not prevent delivery of already received data on another. This removes a particular transport ordering dependency. It does not give each request a separate congestion controller, loss detector, or guaranteed completion time. ...
Character encoding connects bytes to characters. In text/plain; charset=utf-8, the charset parameter names that connection; changing the parameter does not change the payload. Reliable text delivery requires agreement between the producer’s actual encoding and the consumer’s decoding rules, not simply the appearance of the word UTF-8 in a configuration file. ...
HTTP Basic authentication places an encoded username and password in an Authorization header. The encoding is reversible, so possession of that header can be equivalent to possession of the credential. Basic defines a challenge-response exchange, but it does not cryptographically bind a response to a fresh server nonce. A captured accepted value can be replayed while the server continues to accept that account and credential. ...
A stale response can preserve access to a public manual during an origin outage. It can also preserve an obsolete price, revoked permission, or misleading status. Availability is not automatically more important than correctness. Choose the information that may remain usable, the conditions that permit reuse, and the maximum tolerable age before enabling this behavior. ...
CORS preflight asks whether a browser may send a particular cross-origin request shape. It is an OPTIONS request containing the proposed method and relevant request-header names. The browser checks the server’s response before sending the actual request. This mechanism is distinct from checking whether application JavaScript may read an actual response that has already arrived. Both stages can fail, but their effects on server-side execution differ. ...
An idempotency key names an intended action, not a transmission attempt. When a service supports it, the client sends the same key when retrying that action after an uncertain result. Generating a new key for every retry tells the server something different: this is another action, which may legitimately produce another business effect. ...
One resource can have an HTML view for people and a JSON representation for programs. Sharing a URL is useful only when the origin and its intermediaries preserve that distinction. The endpoint must select an available format, serialize it honestly, describe its cache variation, and validate the selected representation rather than some other version of the same resource. ...
HTTP/2 removes HTTP response-order constraints by multiplexing streams, but those streams still share a TCP connection and its failure modes. One useful boundary is cancellation: terminating a request need not destroy its sibling requests or the reusable connection. That is a scoped capability, not a guarantee that streams never affect each other. ...