Web

A caller needs more than a three-digit number to decide what happened. Did an HTTP response arrive, did its body arrive completely, and does the application result satisfy the requested operation? These are separate questions. A 200 response can carry a documented application-level failure, or its transfer can break after the headers. A connection failure before any response supplies no HTTP status at all. Preserve those distinctions in diagnostics and metrics. ...

UTF-8 encodes Unicode scalar values using one to four bytes. ASCII characters retain their familiar one-byte representation, while many other characters need longer sequences. This makes UTF-8 a useful interchange format, but it does not make arbitrary bytes valid text or every byte offset a character boundary. Correct handling requires an agreed encoding, strict validity rules where appropriate, and a clear distinction between bytes and decoded text. ...

Server Name Indication gives a TLS server a hostname while it is choosing handshake parameters and a certificate. In the certificate-based, no-early-data path discussed here, this happens before ordinary HTTP bytes, not before any bytes cross the network. SNI is a selection hint; the client must still verify the selected identity. ...

The Server-Timing response header lets a server attach named measurements to a response. Browser developer tools and performance APIs can then associate those measurements with the resource request. It is useful when the network waterfall shows a long wait but cannot explain whether backend work involved a database call, rendering, or another measured operation. The header supplies server-selected observations, not an independent browser measurement of those operations. ...

Age is an estimate of elapsed seconds since an origin generated or successfully validated a response. It includes time in caches and in transit. It is not the object’s creation timestamp, a count of requests, or simply the time spent on the last proxy’s disk. Reading it correctly requires the response’s freshness policy and the request context. ...

A cookie’s host and path scope controls which destinations are eligible to receive its name and value. It is useful to minimize that set, but scope is not authorization, and cookies do not follow the browser’s full origin boundary. This article concentrates on Domain and Path; transport and request context add separate restrictions. ...

Lazy loading postpones work until it becomes useful. For an HTML image, loading="lazy" lets the browser defer its request until the image is near the viewport according to the browser’s policy. This can reduce initial transfers on long articles, but the attribute is a scheduling input, not a guarantee that every unseen image remains undownloaded. ...

Content-Type describes the representation a sender intends to provide. It does not inspect the body, convert its bytes, or guarantee that every recipient will process it identically. A reliable endpoint keeps its serializer, declared media type, and consumer expectations in agreement, including when an error takes a different path through the server. ...