A cookie is a browser storage and transport mechanism. A server-side session is one application design that uses a cookie value to locate stored state. Keeping those responsibilities separate makes login, expiry, and logout testable. This article follows an opaque session identifier, rather than repeating the host, path, or SameSite matching rules. ...
The HTTP/1.1 upgrade shown in the cover is the opening flow discussed here; other HTTP versions use different bootstrapping. HTTP describes requests and responses; it does not require a new TCP connection for every request. WebSocket adds a message-oriented, bidirectional session. Choosing it over polling means accepting responsibility for that session’s identity, queues, liveness and recovery, in exchange for timely updates initiated by either endpoint. ...
A health endpoint is a contract with a consumer that will take action. Returning 200 because a handler ran does not prove that an instance can serve useful traffic. Before writing the endpoint, identify the decision it supports: allow initialization, admit requests, or restart a process that cannot recover. Different questions need different evidence. ...
A command-line HTTP request gives a small, inspectable view of a service. It can show the response status, headers, body, and timing without a browser’s rendering layer. Start with a concrete question: whether the original URL redirects correctly, whether the final representation is available, or whether a particular method is accepted. Those questions require different probes. One successful curl invocation does not establish that every part of a website works. ...
The Link response field describes relationships between the current resource and other resources. An API returning JSON can advertise its next page without making clients scrape HTML or invent a query parameter. The field supplies a target and a relation; whether to follow it remains a client decision. It is useful metadata, not a command that every browser or crawler must execute. ...
A caller needs more than a three-digit number to decide what happened. Did an HTTP response arrive, did its body arrive completely, and does the application result satisfy the requested operation? These are separate questions. A 200 response can carry a documented application-level failure, or its transfer can break after the headers. A connection failure before any response supplies no HTTP status at all. Preserve those distinctions in diagnostics and metrics. ...
A fingerprinted asset puts a digest of its bytes into its URL. Changing a stylesheet produces a different address, so a page can request the new representation without depending on every existing cache expiring simultaneously. The useful guarantee comes from the publishing process: once an address is released, its contents must remain consistent with that digest. ...
Age is an estimate of elapsed seconds since an origin generated or successfully validated a response. It includes time in caches and in transit. It is not the object’s creation timestamp, a count of requests, or simply the time spent on the last proxy’s disk. Reading it correctly requires the response’s freshness policy and the request context. ...