The same eligible 200 cache key moves from MISS through a fresh HIT with configured 2s validity to EXPIRED. Separately, six held cold-fill clients share one origin request under the cache lock.

A microcache serves fresh entries briefly and coalesces misses explicitly

A microcache keeps reusable responses for a short freshness lifetime, often a few seconds. Requests for the same selected representation can reuse a fresh entry during that window. The response might lag a new origin update, but it is not HTTP-stale merely because it came from a cache. Expiration, permission to serve stale content, and concurrent cache filling are separate policies. ...

March 12, 2028 · 6 min · XB Field Notes
Source-described nginx 1.28.0 fixture: AAAA changes to BBBB with the same modification time and four-byte length. The ETag remains the same; the old tag receives 304.

nginx validators are only as sound as their representation identity

A validator lets a recipient ask whether its stored representation still matches the selected one. A successful conditional GET can return 304 without retransmitting the body. Freshness is a separate decision: it determines when a stored response can be reused without that request. An ETag does not itself specify a cache lifetime, and a 304 is not a replacement body. ...

February 17, 2028 · 5 min · XB Field Notes
A client branches independently toward h3 over QUIC and UDP or h2 over TCP; the branches do not require an initial h2 connection.

HTTP3 rides UDP while HTTP2 stays safe over TCP

HTTP/3 runs over QUIC and UDP, commonly on port 443. HTTP/2 streams on a TCP connection share an ordered byte stream, so a missing segment can stall delivery for unrelated requests. QUIC provides ordered delivery per stream: losing data on one stream need not block delivery on another. Connection-wide congestion control and HTTP dependencies can still affect several streams; this is not independent congestion control for every stream. ...

February 12, 2028 · 7 min · XB Field Notes
In a full certificate-based HTTPS handshake without early data, ClientHello SNI selects TLS configuration and certificate; later HTTP Host participates in request routing.

SNI lets one IP host many TLS sites

Server Name Indication (SNI) sends the requested hostname in the TLS handshake, letting one IP address serve different certificates and sites. Without SNI, separate addresses were one solution, but a shared certificate covering several subject alternative names (SANs) or an appropriate wildcard could also serve multiple sites. The problem is ordering: in a full certificate-based HTTPS handshake without early data, certificate selection precedes the encrypted HTTP request that identifies the application. ...

February 7, 2028 · 5 min · XB Field Notes
Two parallel HTTP/1.1 and HTTP/2 lanes both lead to gzip, separating transport choice from response-body coding.

gzip, HTTP/2, and Brotli need separate verification

HTTP/2 changes HTTP transport framing and multiplexing; gzip and Brotli encode representation data. Enabling HTTP/2 does not automatically compress response bodies, and enabling gzip does not prove that a client negotiated HTTP/2. HTTP/2 header compression is another mechanism again. A reliable check records the negotiated protocol, response Content-Encoding, transferred body size, and the bytes obtained after decoding. ...

January 28, 2028 · 6 min · XB Field Notes
A client sends POST /old, receives 308 plus Location, and explicitly sends a second POST to /destination in the source fixture.

Choose whether nginx redirects the client or rewrites internally

An nginx redirect and an internal rewrite change different parts of the request flow. A redirect returns a status and Location for the client to consider, potentially causing a new request. An internal rewrite changes nginx’s current URI while processing the existing request. Choosing between them determines whether the client sees a new address, whether location selection runs again, and how the final handler receives path and query data. ...

January 21, 2028 · 6 min · XB Field Notes
Exact /api finishes selection. The longest ordinary prefix can be replaced by a matching regex; a selected ^~ prefix bypasses regex. With no regex match, the remembered prefix wins.

An nginx prefix is a candidate until matching finishes

An nginx location selects configuration for a request within the chosen server. For the flat prefix and regex locations tested here, an exact match finishes the search; otherwise nginx remembers the longest matching prefix and can then choose the first matching regex. If no applicable regex wins, the remembered prefix supplies the configuration. This is a selection process, not simply the first block encountered in the file. ...

January 17, 2028 · 5 min · XB Field Notes
Two six-request strips use native go arrows, pause marks and rejection crosses for three admitted and three rejected cells; delayed mode marks two admitted cells as waiting, while nodelay lets all admitted cells proceed.

nginx burst capacity decides which requests wait and which are rejected

nginx request limiting uses a leaky-bucket method to account for excess requests against a configured rate. The burst allowance determines how much excess can be accepted, while nodelay and delay affect when accepted excess proceeds. These are admission and scheduling decisions. They do not make every request above the nominal rate fail, nor do they measure concurrent application work. ...

January 5, 2028 · 6 min · XB Field Notes