Field notes

3 / 4
Accept-Encoding selects identity or encoded representations. The two byte-distinct variants carry different schematic strong ETags, A and B. Vary: Accept-Encoding tells shared caches to match the negotiated request field.

Compression changes the selected HTTP representation

Test compressed and uncompressed requests separately so caches and validators describe the bytes actually served.

June 29, 2026 · 2 min · XB Field Notes
A matrix distinguishes no-cache, which permits storage but requires validation before reuse, from no-store, which asks caches not to store the response.

Cache headers are a contract with two clocks

Separate browser freshness from origin validation, then verify the response headers that implement both.

June 25, 2026 · 3 min · XB Field Notes
Verify HTTPS, begin with a short HSTS lifetime, then observe before extending it. Subdomain scope and preload need separate decisions; recovery requires working HTTPS.

HSTS should be rolled out with a recovery plan

HSTS is cached browser policy, so a configuration mistake can outlive the server change that created it.

June 23, 2026 · 3 min · XB Field Notes
GET and HEAD use matched URL, request headers, and release. Both response cards show type, validator, coding, and length categories. Only GET has content and checksum evidence. HEAD length can be omitted; if provided it describes GET.

HEAD should describe the same representation as GET

HEAD is a metadata view of GET; status and representation headers should tell the same story.

June 22, 2026 · 2 min · XB Field Notes
The old endpoint keeps serving across the DNS switch while the new endpoint is already ready. The overlap continues into observation; changing TTL cannot rewrite cached answers.

DNS changes need a cache-aware rollback window

Prepare the TTL ahead of time, observe authoritative and recursive answers, and keep both endpoints valid through the cache window.

June 18, 2026 · 3 min · XB Field Notes
An illustrative effective CAA policy, issue letsencrypt.org, branches into CAA permits for an authorized CA and CAA blocks for an unauthorized CA. Existing certificates are unchanged.

CAA records should authorize the issuer you actually use

CAA narrows certificate issuance policy, but a mistaken record can block renewal as effectively as an expired certificate.

June 17, 2026 · 2 min · XB Field Notes
Omitting Domain keeps a cookie at its setting host. Domain=example.test broadens eligible destinations to that domain and eligible subdomains such as app and api. Path selects requests and is not authorization.

Cookie scope should be narrower than the application boundary

A cookie sent to more hosts or paths than necessary enlarges the impact of every mistake at those boundaries.

June 15, 2026 · 3 min · XB Field Notes
A style request for /assets/site.css branches into schematic responses: 200 with CSS bytes declared text/css, or 404 with HTML bytes declared text/html. Nosniff is scoped to script and style destinations.

Content-Type should describe the bytes you actually send

A filename is only a hint; the response header is the browser-facing contract for the representation.

June 11, 2026 · 3 min · XB Field Notes