Headers

Cache freshness is judged against a clock

A cache does not receive a new freshness allowance every time another cache forwards a response. It must account for age already accumulated along the delivery path, then add its own residence time. Otherwise a chain of individually plausible sixty-second caches can keep old content reusable much longer than the origin intended. ...

A current resource branches to a next page and an alternate resource. The arrows describe relations; they do not redirect or authorize a fetch.

The Link header relates adjacent resources

The Link response field describes relationships between the current resource and other resources. An API returning JSON can advertise its next page without making clients scrape HTML or invent a query parameter. The field supplies a target and a relation; whether to follow it remains a client decision. It is useful metadata, not a command that every browser or crawler must execute. ...

Both synthetic responses expose their Server-Timing header. Only the timing-authorized response exposes the named browser timing entries in the source’s historical observation.

Server-Timing exposes named measurements to the browser

The Server-Timing response header lets a server attach named measurements to a response. Browser developer tools and performance APIs can then associate those measurements with the resource request. It is useful when the network waterfall shows a long wait but cannot explain whether backend work involved a database call, rendering, or another measured operation. The header supplies server-selected observations, not an independent browser measurement of those operations. ...

Two application/json labels lead to different bodies: valid JSON has a check mark; not JSON has a cross. A correct declaration does not validate the bytes.

Content-Type tells the reader what it is

Content-Type describes the representation a sender intends to provide. It does not inspect the body, convert its bytes, or guarantee that every recipient will process it identically. A reliable endpoint keeps its serializer, declared media type, and consumer expectations in agreement, including when an error takes a different path through the server. ...

Authenticated HTTPS plus HSTS changes an unremembered host into a remembered policy; authenticated max-age=0 reverses that dynamic entry. The learned branch upgrades http URLs to https internally.

HSTS makes the browser remember HTTPS

HTTP Strict Transport Security tells a supporting client to use HTTPS for a remembered hostname. It can eliminate the insecure HTTP request before a redirect, but only when the client already knows the policy, through an earlier authenticated response or a supported preload mechanism. Merely adding a header cannot retroactively protect an unknown client’s first HTTP visit. ...

One shared classic-script payload feeds three MIME-policy columns: correct JavaScript with nosniff executes, text/plain with nosniff is blocked, and loose text/plain executed in the earlier tested Chrome only.

Security headers need observable browser behavior

Security response headers ask a supporting browser to enforce specific rules. Their value comes from the behavior those rules change, not from the length of a header checklist. A static site still has document loading, scripts or styles, embedding, navigation, and transport boundaries to consider. Select policies that match the actual page and delivery path, then verify both intended restrictions and legitimate functionality. ...

A script with a matching nonce passes the first policy gate, then meets a closed second gate labeled script-src none. Every enforcing policy must permit the action.

CSP makes browser execution rules explicit

Content Security Policy tells a supporting browser which actions a document permits. Fetch directives govern categories such as scripts, styles, and images; other directives cover different boundaries. The policy is supplied with the document, commonly through a response header. It adds constraints to browser behavior, but does not repair an injection bug, authenticate application users, or promise that every possible form of script execution has been eliminated. ...