HTTP | XB Field Notes

Omitting Domain keeps a cookie at its setting host. Domain=example.test broadens eligible destinations to that domain and eligible subdomains such as app and api. Path selects requests and is not authorization.

Cookie scope should be narrower than the application boundary

A cookie sent to more hosts or paths than necessary enlarges the impact of every mistake at those boundaries.

202 means accepted while work is still pending; 304 means reuse a stored representation with no new response body. Interpret method, status, headers and body together.

HTTP status codes describe the response contract

The status line is the first contract a client reads.

A style request for /assets/site.css branches into schematic responses: 200 with CSS bytes declared text/css, or 404 with HTML bytes declared text/html. Nosniff is scoped to script and style destinations.

Content-Type should describe the bytes you actually send

A filename is only a hint; the response header is the browser-facing contract for the representation.