Posts tagged “Web”
11 posts Subscribe by RSS
11 posts
What Referrer-Policy puts in Referer: the full URL, the origin, or nothing
Referrer-Policy decides what goes in Referer when a page loads an image or follows a link. The eight values, what is always stripped, where the policy is set, redirects and the Origin header.
The Retry-After header: what it means on 429, 503, 413 and 3xx, and how clients should read it
Retry-After per RFC 9110 and RFC 6585: its two value formats, what it means with each status code, turning an HTTP-date or a seconds value into a wait, and handling invalid or huge values.
Why a JWT verifier shouldn't trust alg: none, RS256→HS256 confusion and algorithm pinning
A JWT's alg header is chosen by the token's sender. Why alg none and RS256→HS256 confusion work, what RFC 8725 requires (one algorithm per key), and the iss, aud, exp, typ checks that follow.
When does a CORS preflight happen? The conditions that send OPTIONS first
When fetch() sends OPTIONS first, per the WHATWG Fetch Standard: safelisted methods and headers, why application/json and Authorization trigger a preflight, and the 5-second Max-Age default.
Safe and idempotent HTTP methods: why retrying POST is risky and PUT isn't
What RFC 9110 means by safe and idempotent methods, which ones a client may resend after a dropped connection, why POST and PATCH need care, and how If-Match makes an update conditional.
HTTP Range requests, 206 and 416: how resuming a download works
How Range, Content-Range and If-Range work with 206 Partial Content and 416 Range Not Satisfiable, per RFC 9110, and why a server may ignore Range and send 200.
401 vs 403: missing authentication or a refused request
How HTTP 401 Unauthorized and 403 Forbidden differ under RFC 9110 and the OAuth 2.0 Bearer Token spec: WWW-Authenticate, retry rules, and hiding a resource with 404.
no-cache vs no-store: which Cache-Control directive stops storage
no-cache doesn't mean "don't cache". Using RFC 9111, this post compares no-cache, no-store, max-age=0 and Pragma, and shows where behavior varies across CDNs and browsers.
X-Frame-Options vs CSP frame-ancestors: which clickjacking header wins when you send both
How the two headers that stop your pages being framed differ, per CSP Level 3 and the HTML Standard: which one wins when both are sent, why ALLOW-FROM is ignored, and why a meta tag won't work.
301, 302, 307 or 308? Permanent vs temporary redirects, and why POST turns into GET
The differences between HTTP redirects 301, 302, 303, 307 and 308, from RFC 9110 and the WHATWG Fetch standard: when POST becomes GET, and how caches and search engines treat each code.
Why URLs fill up with %C3%A9: percent-encoding explained
Why non-English characters in a link turn into %C3%A9 or %E3%81%82, how encodeURI, encodeURIComponent and URLSearchParams differ, %20 versus +, and the double-encoding bug behind %2520.
No posts match. Try another word.