#http

An audit of the seven header rules in our next.config.mjs against what pub-trivia.app actually sends, including a one-year immutable cache on a path that does not exist and an HSTS preload token that was redundant before we bought the domain.

My endpoint tied for first on score and ranked last. The tiebreak was my HTTP version. A...

How Content-Disposition filenames reach the filesystem, why a missing disposition is also a bug, and the controls that hold.

How shared caches leak authenticated pages, the two failure shapes, and the headers that stop it.

Every few weeks someone asks me whether putting a short link in a tweet, a PDF, or a QR code "kills...

You see a product photo, right-click, "Save image as", and get image.webp. Your upload form rejects...

Short answer: use a recurring cron trigger for the HTTP cleanup, and make the nightly payment...

How an AAuth agent proves who it is on every HTTP request: RFC 9421 signatures, the Signature-Key header, self-issued agent tokens, key discovery, and what a receiver can and can't decide from them.

In an HTTP request, the payload (often called the request body) is the actual data you are sending to...

Google's crawlers support conditional requests. Set ETag correctly, answer 304 when nothing changed, and check it with curl and your access logs.

A few days ago I wrote about getting your public IP from the command line. In the Python section I...

HTTP status codes are more than numbers. They communicate what happened during an HTTP...