Http

A reverse proxy accepts client requests and makes a separate upstream exchange with an application. It can centralize routing, transport, headers, and admission policy when those behaviors are configured. It does not automatically hide every backend interface, authenticate every caller, or terminate TLS. The useful boundary is the actual traffic path and policy applied there, not simply the proxy’s position in a diagram. ...

A reusable access token grants whoever possesses it some defined access. Putting it in a URL exposes that capability to systems that routinely copy URLs: access logs, monitoring records, browser navigation history, bookmarks, and shared links. The exact exposure depends on the request and policy, but a secret-looking query parameter is not automatically protected by its name. Treat transport placement as part of the credential’s disclosure boundary. ...

A rate-limit key defines which requests share a budget. An account, API credential, address, tenant, and authenticated session are different identities, not interchangeable spellings of “client.” Choosing the wrong grouping can punish unrelated users or let one workload obtain fresh allowance simply by changing a field. ...

The useful distinction between transport and HTTP balancing is where a routing decision can be made. A TCP relay can select a backend for a connection and forward its byte stream without interpreting HTTP requests. An HTTP proxy parses requests and can choose an upstream using their paths or headers. Several requests on one client connection can therefore have different routing outcomes. ...

A URL identifies a target resource; the request method describes the operation the client asks the origin to apply. Together they form a contract read by the server, caches, proxies, crawlers, and retrying clients. A method is not a decoration on a path. It is a promise about the intended effect, and infrastructure can only make safe decisions when that promise is honest. ...

HTTP persistence allows multiple exchanges to share a connection, so repeated requests may avoid TCP setup and TLS negotiation. It is a protocol capability, not a promise that a particular socket stays open. Whether another request actually reuses it also depends on complete message framing, client pool policy, server behavior, and the connection’s current condition. ...

Storage scope is not an identity system. Cache-Control: private tells a conforming shared cache not to store a response; it does not teach a browser which application account owns the bytes. This distinction matters when a person logs out, another account logs in, and the same browser requests the same URL again. ...

A range request asks for part of the selected representation so a client can resume a transfer or read a specific byte window. A satisfied single range normally returns 206 with Content-Range. A server may ignore the range and return the complete representation with 200. A range that cannot be satisfied can instead produce 416; these responses require different client actions. ...