Http

Cross-Origin Resource Sharing lets a server opt into exposing a response to scripts from another origin. An origin consists of scheme, host, and port; two services on different ports can therefore be cross-origin even on the same machine. The browser evaluates the CORS response headers for the requesting page. This mechanism does not authenticate that page’s user or turn the endpoint into a private network service. Same-site cookie rules use a different boundary from same-origin response access, so similar-looking hostnames are insufficient to reason about both. ...

HTTP idempotency concerns the intended effect of repeating an identical request, not whether every response looks the same. This distinction matters when a connection closes after the server applies a change but before the client receives the answer. Repetition can be appropriate, but only within the operation’s actual semantics and the client’s retry policy. ...

A rate limit is a budget for admitted work, defined by its unit, identity, scope, and time rule. “Five requests” is incomplete without saying whose requests, across which endpoints and workers, during which interval, and what happens after exhaustion. A shared counter helps only when every relevant admission uses the same authoritative decision. ...

A health endpoint is an input to an operational decision, not a universal certificate that a service works. A small endpoint returning 200 can be useful when its consumer needs exactly that limited evidence. Problems begin when operators interpret “this handler answered” as “every customer request will succeed.” ...

A cache is only as coherent as the pair of conditions your headers make explicit.

Walk a live origin from method to body to cache, and leave with checks you can reuse.

A redirect is a response that asks a client to make a new request at a different target. Its Location field and status code describe both destination and method behavior. Browsers often follow redirects automatically, but a library can stop, inspect, or reject them. Treat every hop as observable protocol data: the final page alone cannot tell you whether a POST became a GET, whether credentials crossed an origin boundary, or whether a loop consumed the retry budget. ...

HTTP compression selects a coded representation, not a new media type. Gzipped text remains text after decompression. A useful check therefore asks three questions: was the coding acceptable, did the transfer become smaller, and did decoding recover the intended bytes? A compression checkbox or a successful status code cannot answer all three. ...