HTTP | XB Field Notes

QUIC stream A has already delivered a but is missing b. Stream B has complete xy and can deliver it while A waits. Recovery still has shared boundaries.

HTTP/3 separates stream delivery, not all recovery

HTTP/3 carries HTTP over QUIC instead of TCP. QUIC offers independently ordered streams, so a missing range in one stream need not prevent delivery of already received data on another. This removes a particular transport ordering dependency. It does not give each request a separate congestion controller, loss detector, or guaranteed completion time. ...

The UTF-8 bytes for café € branch through two decoders: UTF-8 recovers the original text, while Windows-1252 produces different characters without a decoding exception.

A charset tells the reader how the bytes become characters

Character encoding connects bytes to characters. In text/plain; charset=utf-8, the charset parameter names that connection; changing the parameter does not change the payload. Reliable text delivery requires agreement between the producer’s actual encoding and the consumer’s decoding rules, not simply the appearance of the word UTF-8 in a configuration file. ...

Two arrows carry the same Authorization value from client to server, with 200 shown twice. Base64 is reversible, and acceptance depends on server policy.

Basic auth carries a reusable credential

HTTP Basic authentication places an encoded username and password in an Authorization header. The encoding is reversible, so possession of that header can be equivalent to possession of the credential. Basic defines a challenge-response exchange, but it does not cryptographically bind a response to a fresh server nonce. A captured accepted value can be replayed while the server continues to accept that account and credential. ...

A proportional 30-second freshness segment is followed by 60 seconds of stale-if-error allowance. In the historical offline model, age 35 requires validation before an eligible error keeps A; age 91 surfaces the error. Failure does not restart Age.

Stale cache needs a bounded policy

A stale response can preserve access to a public manual during an origin outage. It can also preserve an obsolete price, revoked permission, or misleading status. Availability is not automatically more important than correctness. Choose the information that may remain usable, the conditions that permit reuse, and the maximum tolerable age before enabling this behavior. ...

A simple GET with credentials: include reaches the server, but a 200 response with wildcard allow-origin cannot be read by the script.

CORS preflight depends on the request shape

CORS preflight asks whether a browser may send a particular cross-origin request shape. It is an OPTIONS request containing the proposed method and relevant request-header names. The browser checks the server’s response before sending the actual request. This mechanism is distinct from checking whether application JavaScript may read an actual response that has already arrived. Both stages can fail, but their effects on server-side execution differ. ...

Three attempts carrying the same key converge on one stored order; action identity remains stable across attempts.

Idempotency keys are client promises

An idempotency key names an intended action, not a transmission attempt. When a service supports it, the client sends the same key when retrying that action after an uncertain result. Generating a new key for every retry tells the server something different: this is another action, which may legitimately produce another business effect. ...

A table for GET /status compares selected HTML with schematic strong ETag H and JSON with schematic strong ETag J under If-None-Match J: HTML returns 200, while JSON returns 304. Different bytes have different strong tags.

Accept plus Vary let one URL answer in several formats

One resource can have an HTML view for people and a JSON representation for programs. Sharing a URL is useful only when the origin and its intermediaries preserve that distinction. The endpoint must select an available format, serialize it honestly, describe its cache variation, and validate the selected representation rather than some other version of the same resource. ...

One TCP connection contains three HTTP/2 stream lanes. A is canceled, sibling B completes its body, and a later C reuses the connection. Shared TCP constraints still bound progress.

HTTP/2 multiplexing fixes a queue

HTTP/2 removes HTTP response-order constraints by multiplexing streams, but those streams still share a TCP connection and its failure modes. One useful boundary is cancellation: terminating a request need not destroy its sibling requests or the reusable connection. That is a scoped capability, not a guarantee that streams never affect each other. ...