HTTP | XB Field Notes

The exact /api/echo route crosses a proxy to /echo, while a separate same-network path bypasses the proxy.

A reverse proxy enforces an entry policy only on traffic that traverses it

A reverse proxy accepts client requests and makes a separate upstream exchange with an application. It can centralize routing, transport, headers, and admission policy when those behaviors are configured. It does not automatically hide every backend interface, authenticate every caller, or terminate TLS. The useful boundary is the actual traffic path and policy applied there, not simply the proxy’s position in a diagram. ...

A highlighted query-token segment fans out from a URL into logs, copied links and URL records; separate lower URL and header bands show field separation.

Keep reusable access tokens out of request URLs

A reusable bearer access token grants its holder defined access; sender-constrained tokens additionally require proof tied to the sender. Putting it in a URL exposes that capability to systems that routinely copy URLs: access logs, monitoring records, browser navigation history, bookmarks, and shared links. The exact exposure depends on the request and policy, but a secret-looking query parameter is not automatically protected by its name. Treat transport placement as part of the credential’s disclosure boundary. ...

Rate limiting needs a stable client identifier

A rate-limit key defines which requests share a budget. An account, API credential, address, tenant, and authenticated session are different identities, not interchangeable spellings of “client.” Choosing the wrong grouping can punish unrelated users or let one workload obtain fresh allowance simply by changing a field. ...

Each row represents one persistent client connection carrying /a and /b. The TCP row keeps both together at the illustrated peer A; the HTTP row branches /a to A and /b to B. Peer A is an illustration of one TCP choice, not a claim that all connections select A.

Transport balancing keeps a connection together; HTTP routing can split its requests

The useful distinction between transport and HTTP balancing is where a routing decision can be made. A TCP relay can select a backend for a connection and forward its byte stream without interpreting HTTP requests. An HTTP proxy parses requests and can choose an upstream using their paths or headers. Several requests on one client connection can therefore have different routing outcomes. ...

The Go fixture’s write counter stays at zero for GET and HEAD, rises to two for repeated PUT new, and remains two when a 65-byte PUT is rejected by the 64-byte limit.

HTTP methods describe the intent

A URL identifies a target resource; the request method describes the operation the client asks the origin to apply. Together they form a contract read by the server, caches, proxies, crawlers, and retrying clients. A method is not a decoration on a path. It is a promise about the intended effect, and infrastructure can only make safe decisions when that promise is honest. ...

HTTP/1.1 permits persistent connections by default

HTTP persistence allows multiple exchanges to share a connection, so repeated requests may avoid TCP setup and TLS negotiation. It is a protocol capability, not a promise that a particular socket stays open. Whether another request actually reuses it also depends on complete message framing, client pool policy, server behavior, and the connection’s current condition. ...

For the article’s fresh max-age=300 fixture, the private/shared table shows storage and direct-reuse pairs: private yes/yes and no/no; public yes/yes in both; no-cache yes/no in both; no-store no/no in both. A same-browser account switch can still match an old private entry.

Cache-Control private versus shared

Storage scope is not an identity system. Cache-Control: private tells a conforming shared cache not to store a response; it does not teach a browser which application account owns the bytes. This distinction matters when a person logs out, another account logs in, and the same browser requests the same URL again. ...

A stored ten-byte prefix plus a validated 54-byte suffix reconstructs 64 bytes. Appending a full 64-byte response instead produces the wrong 74-byte candidate.

Resume a download only after checking its range and representation

A range request asks for part of the selected representation so a client can resume a transfer or read a specific byte window. A satisfied single range normally returns 206 with Content-Range. A server may ignore the range and return the complete representation with 200. A range that cannot be satisfied can instead produce 416; these responses require different client actions. ...