HTTP | XB Field Notes

Source-described nginx 1.28.0 fixture: AAAA changes to BBBB with the same modification time and four-byte length. The ETag remains the same; the old tag receives 304.

nginx validators are only as sound as their representation identity

A validator lets a recipient ask whether its stored representation still matches the selected one. A successful conditional GET can return 304 without retransmitting the body. Freshness is a separate decision: it determines when a stored response can be reused without that request. An ETag does not itself specify a cache lifetime, and a 304 is not a replacement body. ...

Two parallel HTTP/1.1 and HTTP/2 lanes both lead to gzip, separating transport choice from response-body coding.

gzip, HTTP/2, and Brotli need separate verification

HTTP/2 changes HTTP transport framing and multiplexing; gzip and Brotli encode representation data. Enabling HTTP/2 does not automatically compress response bodies, and enabling gzip does not prove that a client negotiated HTTP/2. HTTP/2 header compression is another mechanism again. A reliable check records the negotiated protocol, response Content-Encoding, transferred body size, and the bytes obtained after decoding. ...

A client sends POST /old, receives 308 plus Location, and explicitly sends a second POST to /destination in the source fixture.

Choose whether nginx redirects the client or rewrites internally

An nginx redirect and an internal rewrite change different parts of the request flow. A redirect returns a status and Location for the client to consider, potentially causing a new request. An internal rewrite changes nginx’s current URI while processing the existing request. Choosing between them determines whether the client sees a new address, whether location selection runs again, and how the final handler receives path and query data. ...

Fetch no-store obtains version two while the stored version one remains; reload obtains and stores version three. Response Cache-Control policy and Fetch cache mode are distinct.

Cache-Control is a contract between cache and origin

A cache policy needs a behavioral test, not just a header-presence check. Two responses can both contain max-age yet behave differently because one also requires validation or prohibits storage. The request matters too: a browser can bypass an otherwise reusable copy without changing the origin’s response policy or deleting an older cached entry. ...

The proxy remains between client and origin forwarding bytes in two directions. CONNECT success and origin TLS verification are separate checks.

The CONNECT method opens a raw tunnel

CONNECT asks a proxy to establish a tunnel; it does not make the proxy disappear from the data path. After admission, the proxy still forwards bytes in both directions and owns sockets, buffers, and failure handling. CONNECT itself provides no encryption: HTTPS adds a separately verified TLS session through that tunnel. ...

Cache freshness is judged against a clock

A cache does not receive a new freshness allowance every time another cache forwards a response. It must account for age already accumulated along the delivery path, then add its own residence time. Otherwise a chain of individually plausible sixty-second caches can keep old content reusable much longer than the origin intended. ...

A bucket of capacity three begins full. Three unit-cost admissions at time zero empty it immediately; a fourth is denied. At half a second, refill at two tokens per second provides one token. Three states show burst spending followed by elapsed-time refill, without promising paced departures.

A token bucket bounds admission and allows bursts

A token bucket bounds admitted work while allowing accumulated credit to be spent in a burst. It does not automatically space requests evenly, guarantee completed throughput, or cap the number of operations still running. Those are separate scheduling and capacity questions. The bucket’s two parameters describe a budget, not a promise that the service can perform it. ...

Accept text/html;q=0, */*;q=1 excludes HTML while JSON retains quality 1. A wider wildcard does not override the specific exclusion.

Accept headers let the server negotiate a reply

Negotiation selects among representations the server can actually produce. Request preferences are inputs to that decision, not evidence that the response will satisfy them. A client still needs to inspect the selected representation. Vary records the request dimensions relevant to reuse; it does not identify the chosen format, language, or compression method. ...