HTTP | XB Field Notes

The invented HMAC format joins event_id, a dot, timestamp, a dot and unchanged raw body bytes in that order.

Webhooks push events instead of polling

A webhook lets a provider notify a registered receiver when something changes. It reverses who initiates the HTTP request, but that alone does not guarantee delivery, immediacy, ordering, or exactly-once processing. The operational contract comes from the provider and the receiver’s handling of acknowledgment and state. ...

A weight-two peer holds two active-connection circles and a weight-one peer holds one; equal card sizes avoid implying hardware or CPU capacity.

Least connections measures occupied connections, not every kind of load

Least-connections balancing chooses a peer using active connection counts, with the implementation’s weighting and tie rules. In nginx, least_conn accounts for server weights and uses weighted round robin among equally suitable peers. This can help when requests occupy connections for different durations. It is still a connection-based measurement, not direct knowledge of CPU, memory pressure, queued jobs, or database contention. ...

A single body contains tag first, tag second, and a binary file, separated by boundary lines. A double final line precedes an epilogue. Framing is separate from validation.

A multipart boundary splits the body into parts

Multipart/form-data is one HTTP representation containing several independently described parts. A client chooses a boundary parameter, places that value in the Content-Type header, and writes matching delimiter lines into the body. The arrangement lets one request carry text fields and binary files without pretending that all bytes share one JSON or text grammar. The boundary is framing metadata, not a security decision or a file-type detector. ...

A one-way response carries complete event blocks. A separate request can send a retained cursor; replay still depends on authorized retained history.

Server-Sent Events stream one way

Server-Sent Events carry server-to-client updates in a streaming HTTP response. They do not turn HTTP into a bidirectional socket, and automatic reconnection does not make delivery durable. Treat event framing, connection lifetime, retained history, and application acknowledgment as separate contracts. A response contains framed text events An SSE response uses text/event-stream and UTF-8. Fields are line-based, and a blank line ends a block. Multiple data lines within one event are joined with newline characters. A colon-prefixed comment is ignored as event data, so it can carry a heartbeat without triggering an application message. ...

Two identical body strips have different red end markers: the CL marker follows the full body, while the TE marker follows the zero-chunk segment and leaves a synthetic next request.

Request smuggling desyncs the proxy chain

Request smuggling occurs when components disagree about HTTP message boundaries and an attacker exploits the disagreement. In a proxy chain, bytes treated as one request’s body by the front end may become another request at the back end. The important evidence is inconsistent parsing and forwarding, not simply finding two HTTP status lines in a response capture. ...

The origin now serves B at /manual.txt. Cache zero’s exact entry is removed, so its next request fetches B. Cache one is independent and still holds fresh A, which it reuses. One targeted removal does not synchronize both caches.

Cache invalidation is a push, not a prayer

Changing an origin does not notify every cache that already holds its response. Invalidation is about controlling which stored copies remain eligible for reuse, not merely updating a file. A reliable release distinguishes expiration, validation, targeted removal, and choosing a new URL. These mechanisms have different scopes, and none remotely erases every copy a reader has downloaded. ...

Two POST paths: a denied JSON preflight stops before POST, while a qualifying text/plain POST is sent even though its response may remain unreadable.

CORS preflight checks a browser request before it is sent

A CORS preflight asks whether a browser may send a particular cross-origin request. It describes the requesting origin, intended method, and relevant header names. The browser evaluates the reply before sending that request, unless a valid preflight cache entry already grants permission. CORS also governs whether JavaScript can read the actual response. These are related checks, but neither replaces application authentication or authorization. ...

A single response panel pairs a large 404 status with a Page not found body and a Home link. An identical body with 200 is still a defect.

A 404 page answers honestly

A 404 response has two audiences. Software needs an accurate status; a person needs a useful next step. A beautifully designed error page cannot compensate for a false 200, and a correct status does not excuse an inaccessible page. Keep both parts of the response truthful without turning a missing address into a business outage. ...