HTTP | XB Field Notes

A simple POST reaches the API; its HTTP 200 response lacks an allow-origin header and stops at the browser response-exposure boundary.

CORS controls whether a script can read a response

Cross-Origin Resource Sharing lets a server opt into exposing a response to scripts from another origin. An origin consists of scheme, host, and port; two services on different ports can therefore be cross-origin even on the same machine. The browser evaluates the CORS response headers for the requesting page. This mechanism does not authenticate that page’s user or turn the endpoint into a private network service. Same-site cookie rules use a different boundary from same-origin response access, so similar-looking hostnames are insufficient to reason about both. ...

A conditional PUT changes blue to green and loses its reply. Replaying its old If-Match yields 412 in the fixture, while the stored value remains green.

HTTP idempotency makes retries safe

HTTP idempotency concerns the intended effect of repeating an identical request, not whether every response looks the same. This distinction matters when a connection closes after the server applies a change but before the client receives the answer. Repetition can be appropriate, but only within the operation’s actual semantics and the client’s retry policy. ...

Sixteen independent callers each invoke a separate atomic Lua admission script on the same shared budget key. The script compares the limit, then creates the counter with expiry or increments it when admission is allowed. Five admitted and eleven denied are aggregate outcomes across the sixteen calls for a budget of five. This is the article fixture, not a newly executed Redis result.

Rate limiting is a shared budget

A rate limit is a budget for admitted work, defined by its unit, identity, scope, and time rule. “Five requests” is incomplete without saying whose requests, across which endpoints and workers, during which interval, and what happens after exhaustion. A shared counter helps only when every relevant admission uses the same authoritative decision. ...

The basic report remains available when its required input works and its optional annotation is absent. The declared policy keeps readiness and the basic report at 200.

Health endpoints answer a question

A health endpoint is an input to an operational decision, not a universal certificate that a service works. A small endpoint returning 200 can be useful when its consumer needs exactly that limited evidence. Problems begin when operators interpret “this handler answered” as “every customer request will succeed.” ...

For max-age=60, age 59 seconds is fresh and reuses the response. Ages 60 and 61 seconds are stale and lead to validator comparison, which can yield 304 or 200.

Freshness and validation in the two-clock cache model

A cache is only as coherent as the pair of conditions your headers make explicit.

Method, selected bytes and cache form a client evidence journey; the same representation selection connects comparisons.

Read a live edge the way a client does

Walk a live origin from method to body to cache, and leave with checks you can reuse.

In the Go fixture, POST through 301, 302, or 303 becomes GET with no body; through 307 or 308 it remains POST with the original replayable body.

Redirects are promises about where

A redirect is a response that asks a client to make a new request at a different target. Its Location field and status code describe both destination and method behavior. Browsers often follow redirects automatically, but a library can stop, inspect, or reject them. Treat every hop as observable protocol data: the final page alone cannot tell you whether a POST became a GET, whether credentials crossed an origin boundary, or whether a loop consumed the retry budget. ...

The article repeated-text fixture has 11,000 bytes, gzip content has 122 bytes, and decoding recovers the same 11,000 bytes. Counts are content bytes only, not a benchmark.

Compression negotiation is content negotiation

HTTP compression selects a coded representation, not a new media type. Gzipped text remains text after decompression. A useful check therefore asks three questions: was the coding acceptable, did the transfer become smaller, and did decoding recover the intended bytes? A compression checkbox or a successful status code cannot answer all three. ...