One URL can return JSON to an API client and plain text to another reader. Content-Type identifies the selected representation; Vary identifies request fields relevant to selecting it. A correct body label cannot prevent a cache from choosing the wrong stored response when the request-matching information is missing. ...
An idempotency key identifies one logical action only within a service’s defined scope and retention window. Reusing the same text is not a universal exactly-once guarantee. The service must associate that identity with the right principal and operation, coordinate competing attempts, and retain enough authoritative information to recognize the action later. ...
Content-Type describes the representation a sender intends to provide. It does not inspect the body, convert its bytes, or guarantee that every recipient will process it identically. A reliable endpoint keeps its serializer, declared media type, and consumer expectations in agreement, including when an error takes a different path through the server. ...
An HTTP method describes the action requested on a target resource. Clients and intermediaries use those semantics when deciding whether to fetch, cache, or retry. Choosing a familiar verb is only the beginning: the application must implement the behavior that the verb promises. Calling a destructive operation GET does not make it safe. A useful API documents its resource model, representation, authorization, and error conditions alongside the method. ...
A followed redirect makes the client resolve a Location value and issue another request before it reaches the desired representation. Several individually reasonable rules can form a chain: normalize a hostname, add HTTPS, fix a trailing slash, and move an old article. Review the complete path seen by a visitor, because each intermediary becomes another dependency. ...
Security response headers ask a supporting browser to enforce specific rules. Their value comes from the behavior those rules change, not from the length of a header checklist. A static site still has document loading, scripts or styles, embedding, navigation, and transport boundaries to consider. Select policies that match the actual page and delivery path, then verify both intended restrictions and legitimate functionality. ...
A 304 is useful only when the old representation really remains an acceptable substitute. ETag supplies the origin’s version claim; it does not independently verify that claim. An incorrect tag can make conditional requests efficiently preserve wrong content. Test both unchanged data and meaningful changes before counting reduced transfers as a performance improvement. ...
Here, removing head-of-line blocking means removing HTTP response-order constraints on a shared connection. HTTP/2 does not remove TCP head-of-line blocking. A later response can finish while an earlier handler waits, but shared transport capacity, connection-level flow control, and application bottlenecks can still couple the streams. ...