Site Updates
Changelog
Recent additions and updates — new guides, comparisons, reference pages, and content improvements. Updated as new content is published.
October 2026
- Method
HTTP DELETE Method: Remove Resources
Learn how the HTTP DELETE method works, when to use it, and best practices for deleting resources in REST APIs.
- Method
HTTP GET Method: Complete Guide with Examples
Learn how the HTTP GET method works. Understand when to use GET requests, query parameters, caching, and best practices with real-world examples.
- Method
HTTP HEAD Method
Learn how HTTP HEAD requests retrieve resource metadata (headers) without downloading the body. Useful for checking existence, size, and modification dates.
- Method
HTTP OPTIONS Method
Learn how HTTP OPTIONS requests discover server capabilities, supported methods, and handle CORS preflight checks for cross-origin requests.
- Method
HTTP PATCH Method
Learn how HTTP PATCH requests apply partial modifications to resources. Understand JSON Patch, merge patch formats, and when to use PATCH vs PUT.
- Method
HTTP POST Method: Complete Guide with Examples
Learn how the HTTP POST method works. Understand when to use POST requests, request bodies, form submissions, and API calls with practical examples.
- Method
HTTP PUT Method: Update Resources
Learn how the HTTP PUT method works, when to use PUT vs POST vs PATCH, and best practices for updating resources in REST APIs.
- Status Code
100 Continue
The server received the request headers and the client should proceed to send the body. Learn when and how to use 100 Continue for efficient large uploads.
- Status Code
HTTP 200 OK: What It Means and When to Use It
200 OK means the request succeeded and the response carries the result. What a 200 should contain, and when 201, 204 or 206 is the better answer for your API.
- Status Code
201 Created
Resource successfully created. Learn when to use 201 Created, proper response format, and best practices for creation endpoints.
- Status Code
202 Accepted
The request was accepted for processing but not completed yet. Learn when to use 202 for asynchronous operations.
- Status Code
HTTP 301 Moved Permanently: Permanent Redirect
Learn what 301 redirect means, when to use it vs 302, and how to implement permanent redirects for SEO and URL changes.
- Status Code
HTTP 302 Found: Temporary Redirect
Learn what 302 redirect means, when to use temporary vs permanent redirects, and how 302 differs from 301, 307, and 308.
- Status Code
304 Not Modified
Cached response is still valid. Learn how 304 Not Modified improves performance through conditional requests and caching.
- Status Code
400 Bad Request
400 Bad Request means the server could not parse your request. Find which layer sent it, fix bad JSON and oversized cookies or headers, and reproduce with curl.
- Status Code
HTTP 401 Unauthorized: Authentication Required
401 Unauthorized means missing or invalid credentials. Read WWW-Authenticate, check the Authorization header, token expiry and proxies, with fixes by stack.
- Status Code
HTTP 403 Forbidden: Access Denied
403 Forbidden means the server refuses the request. Find whether Cloudflare, nginx, Apache, S3 or your app sent it; fix permissions, WAF rules and role checks.
- Status Code
406 Not Acceptable
The server cannot produce a response matching the client's Accept headers. Learn about content negotiation and how to handle format mismatches.
- Status Code
408 Request Timeout
408 Request Timeout means the server gave up waiting for the client to finish sending. Tune nginx, Apache, Node and ALB timeouts and tell it apart from 504.
- Status Code
409 Conflict
409 Conflict means the request clashes with the resource's current state: duplicates, stale versions, locks. Use ETags and If-Match, and handle retries.
- Status Code
412 Precondition Failed: Meaning and How to Fix It
412 means an If-Match or If-Unmodified-Since condition was false, usually because the resource changed after you read it. How to fix it and retry safely.
- Status Code
415 Unsupported Media Type
415 Unsupported Media Type: the server won't accept your Content-Type. Real Spring, DRF and ASP.NET errors, curl reproduction, fixes for fetch and FormData.
- Status Code
422 Unprocessable Entity (Unprocessable Content) Explained
422 Unprocessable Content (formerly Unprocessable Entity): the JSON parsed but failed validation. FastAPI, Laravel and Rails errors, 422 vs 400, RFC 9457.
- Status Code
HTTP 429 Too Many Requests: Causes, Retry-After and Fixes
Fix HTTP 429 Too Many Requests: read Retry-After and RateLimit headers, back off with jitter, and set up express-rate-limit v7, nginx limit_req and Cloudflare.
- Status Code
460 Client Closed Connection (AWS ALB)
An AWS ALB 460 means the client disconnected before the load balancer idle timeout. Confirm it in access logs, then compare client and target timings.
- Status Code
463 Too Many Forwarded IP Addresses (AWS ALB)
AWS ALB 463 rejects an X-Forwarded-For header with more than 30 IP addresses. Trace proxy appends and correct the forwarding chain at a trusted ingress.
- Status Code
464 Incompatible Request Protocol (AWS ALB)
AWS ALB 464 means the incoming HTTP or gRPC request conflicts with the target group protocol version. Inspect ProtocolVersion and listener routing.
- Status Code
HTTP 500 Internal Server Error: Meaning and Fixes
500 means the server hit an error it did not handle. Find which layer sent it, read the right log for nginx, Apache, WordPress, Django, Next.js or Express.
- Status Code
HTTP 502 Bad Gateway: nginx, ALB and Cloudflare Fixes
Fix 502 Bad Gateway: decode nginx error-log lines, php-fpm sockets, ALB keep-alive mismatches and Cloudflare 502 vs 52x, with curl checks.
- Status Code
HTTP 503 Service Unavailable: Causes, Fixes and Retry-After
Fix HTTP 503 Service Unavailable: nginx no live upstreams, Kubernetes endpoints, ALB healthy hosts, Cloudflare, and a maintenance page with Retry-After.
- Status Code
504 Gateway Timeout: nginx, ALB and Cloudflare Fixes
Fix 504 Gateway Timeout: nginx proxy_read_timeout (60s default), ALB 60s idle, API Gateway 29s, Cloudflare 524 at 125s, with error-log strings and curl timing.
- Status Code
507 Insufficient Storage: What the Error Means
507 means the server ran out of space to store what your request needs. Where it comes from, including WebDAV, uploads and quotas, and what to check.
- Status Code
509 Bandwidth Limit Exceeded (cPanel Hosting)
cPanel documents 509 Bandwidth Limit Exceeded for an administrator-imposed transfer limit. Confirm account usage in WHM and adjust the quota or wait.
- Status Code
524 A Timeout Occurred
Cloudflare-specific error when the origin server takes too long to respond. Learn how to diagnose and fix 524 timeout errors.
- Status Code
529 Site Is Overloaded (SSL Labs and Anthropic)
529 is a non-standard overload code used by SSL Labs and Anthropic. Identify the API, inspect overloaded_error, and back off without confusing it with 429.
- Status Code
561 Unauthorized (AWS ALB Authentication)
AWS ALB 561 means the identity provider returned an error during listener authentication. Read error_reason in access logs and inspect the IdP response.
- Header
Accept Header
Learn how the Accept header tells servers which content types (JSON, HTML, XML) your client can handle. Master content negotiation and quality values.
- Header
Accept-Encoding Header
Learn how Accept-Encoding tells servers which compression formats (gzip, br, deflate) your client supports to reduce bandwidth and speed up page loads.
- Header
Accept-Language Header
Learn how the Accept-Language header tells servers which languages your client prefers for localized content. Understand language tags and quality values.
- Header
Accept-Ranges Header
Learn how the Accept-Ranges header tells clients whether your server supports partial content requests (byte ranges) for efficient downloads and streaming.
- Header
Access-Control-Allow-Credentials Header
Learn how Access-Control-Allow-Credentials controls whether browsers expose responses when credentials (cookies, auth headers) are included in CORS requests.
- Header
Access-Control-Allow-Headers Header
Learn how Access-Control-Allow-Headers specifies which custom HTTP headers can be used during cross-origin requests in CORS preflight responses.
- Header
Access-Control-Allow-Methods Header
Learn how Access-Control-Allow-Methods specifies which HTTP methods are permitted for cross-origin requests in CORS preflight responses.
- Header
Access-Control-Request-Method Header
Learn how Access-Control-Request-Method tells servers which HTTP method will be used in the actual CORS request. Essential for preflight request handling.
- Header
Age Header
Learn how the Age header indicates how long a response has been cached in seconds. Understand cache freshness calculations and CDN behavior.
- Header
Authentication-Info Header
Learn how Authentication-Info provides additional authentication data in responses to successful requests. Covers digest authentication and session info.
- Header
Connection Header
Learn how the Connection header controls whether HTTP connections stay open (keep-alive) or close after each request. Optimize with persistent connections.
- Header
Content-Disposition Header
Learn how the Content-Disposition header controls whether content displays inline or downloads as an attachment. Set custom filenames for file downloads.
- Header
Content-Language Header
Learn how the Content-Language header specifies the natural language(s) of response content. Understand language tags and internationalization best practices.
- Header
Content-Length
Learn how Content-Length specifies the body size in bytes. Essential for progress indicators, connection management, and chunked transfer decisions.
- Header
Content-Location Header
Learn how Content-Location indicates an alternate URL for returned content. Useful for content negotiation and identifying canonical resource locations.
- Header
Content-Range Header
Learn how the Content-Range header indicates which portion of a resource is being sent in partial content (206) responses for range requests and streaming.
- Header
Content-Type Header: Values, Examples, charset
Content-Type tells the receiver what the body is: application/json, text/html; charset=utf-8, multipart/form-data. Common values, examples and 415 fixes.
- Header
Cross-Origin-Embedder-Policy
Learn how Cross-Origin-Embedder-Policy (COEP) controls cross-origin resource loading. Required for SharedArrayBuffer and high-resolution timer access.
- Header
Cross-Origin-Opener-Policy
Learn how Cross-Origin-Opener-Policy (COOP) isolates your browsing context from cross-origin documents. Required for SharedArrayBuffer and enhanced security.
- Header
Cross-Origin-Resource-Policy
Learn how Cross-Origin-Resource-Policy (CORP) blocks no-cors cross-origin requests to protect resources from Spectre attacks and data leaks.
- Header
Early-Hints
Learn how 103 Early Hints allows servers to send preload hints while preparing the main response. Improve page load performance with early resource loading.
- Header
ETag Header: Strong vs Weak, If-None-Match and 304 Debugging
ETag identifies a resource version for cache validation and optimistic locking. Strong vs weak ETags, If-None-Match, If-Match, and why nginx gzip weakens them.
- Header
Forwarded
Learn how the Forwarded header preserves original client information (IP, protocol, host) that would otherwise be lost when requests pass through proxies.
- Header
Host Header
Learn how the Host header specifies the target server domain name and port for HTTP requests. Essential for virtual hosting and routing on shared servers.
- Header
If-Match Header
Learn how the If-Match header makes requests conditional based on ETag matching. Prevent conflicts and lost updates in concurrent editing scenarios.
- Header
If-None-Match Header
Learn how the If-None-Match header makes conditional requests using ETags. Avoid downloading unchanged resources and reduce bandwidth with cache validation.
- Header
If-Range Header
Learn how the If-Range header requests partial content only if the resource is unchanged. Efficiently resume downloads without re-fetching entire files.
- Header
If-Unmodified-Since Header
Learn how the If-Unmodified-Since header makes requests conditional on resources not being modified. Prevent conflicts in concurrent update scenarios.
- Header
Keep-Alive Header
Learn how the Keep-Alive header controls HTTP connection persistence and reuse. Reduce latency and improve performance by avoiding repeated TCP handshakes.
- Header
Link Header
Learn how the Link header provides resource hints and enables preloading of CSS, fonts, and scripts to improve page load performance and user experience.
- Header
Location
Learn how the Location header specifies redirect URLs or the location of newly created resources. Essential for 201, 301, 302, and other redirect responses.
- Header
Origin Header
Learn how the Origin header identifies where cross-origin requests come from. Essential for CORS security policies and preventing cross-site request forgery.
- Header
Permissions-Policy Header
Learn how the Permissions-Policy header controls which browser features and APIs can be used in your site and embedded iframes. Enhance security and privacy.
- Header
Proxy-Authenticate Header
Learn how the Proxy-Authenticate header challenges clients for credentials when accessing resources through a proxy. Understand proxy authentication schemes.
- Header
Proxy-Authorization Header
Learn how Proxy-Authorization provides credentials to access resources through a proxy server. Understand proxy authentication schemes and security.
- Header
Range Header
Learn how the Range header requests partial content from servers to enable resumable downloads, video streaming, and efficient large file transfers.
- Header
Referer Header: What It Sends and How to Control It
Referer tells a server which page a request came from. What browsers send under the default strict-origin-when-cross-origin policy, and how to trim it.
- Header
Referrer-Policy Header
Learn how Referrer-Policy controls how much referrer information is sent with requests. Protect user privacy while maintaining analytics functionality.
- Header
Refresh Header
Learn how the Refresh header instructs browsers to reload or redirect after a delay. Understand its use cases, limitations, and better alternatives.
- Header
Retry-After
Learn how the Retry-After header tells clients how long to wait before retrying a request. Understand its use with 503, 429, and 301 status codes.
- Header
Sec-WebSocket-Accept
Learn how the Sec-WebSocket-Accept header indicates server acceptance of a WebSocket connection upgrade. Understand the handshake process and key validation.
- Header
Sec-WebSocket-Key
Learn how the Sec-WebSocket-Key header provides a random key for WebSocket handshake validation. Understand the upgrade process and security implications.
- Header
Server-Timing Header
Learn how the Server-Timing header communicates server-side performance metrics to browsers. Analyze backend timing, database queries, and optimize performance.
- Header
Transfer-Encoding Header
Learn how the Transfer-Encoding header specifies encoding formats like chunked transfer for streaming responses when content length is unknown beforehand.
- Header
Upgrade Header
Learn how the Upgrade header requests protocol upgrades to WebSocket, HTTP/2, or other protocols on the same TCP connection. Understand upgrade negotiation.
- Header
User-Agent Header
Learn how the User-Agent header identifies the client software, browser, or application making HTTP requests. Understand user agent strings and best practices.
- Header
Via Header
Learn how the Via header tracks the path of HTTP requests through proxies and gateways. Debug routing issues and understand your network infrastructure.
- Header
Warning Header
Learn about the deprecated Warning header that provided additional status information about message transformations. Understand why it was removed from HTTP.
- Header
WWW-Authenticate
Learn how the WWW-Authenticate header specifies authentication methods required to access protected resources. Understand Basic, Bearer, and Digest schemes.
- Header
X-Cache Header
Learn how the X-Cache header indicates cache hit or miss status from CDNs and proxies. Debug caching issues and verify CDN configuration with this header.
- Header
X-Content-Type-Options Header
Learn how X-Content-Type-Options with nosniff prevents browsers from MIME-sniffing responses. Protect against XSS attacks from content type confusion.
- Header
X-Forwarded-Proto
Learn how the X-Forwarded-Proto header identifies the original protocol (HTTP/HTTPS) used by clients connecting through proxies or load balancers.
- Header
X-Frame-Options Header
Learn how X-Frame-Options prevents clickjacking attacks by controlling whether your site can be embedded in frames, iframes, or objects on other domains.
- Header
X-Response-Time
Learn how the X-Response-Time header indicates server processing time in milliseconds. Useful for performance monitoring and debugging slow requests.
- Header
X-XSS-Protection Header
Deprecated header that enabled browser XSS filters to detect and block reflected cross-site scripting attacks.
- Glossary Term
HTTP Method
Learn what HTTP methods are and how they define actions on resources. Understand GET, POST, PUT, DELETE, PATCH, and other methods with examples.
- Glossary Term
HTTP Response
Learn what an HTTP response is and how servers reply to client requests. Understand response structure, status codes, headers, and body content.
- Glossary Term
HTTP Session
Learn what HTTP sessions are and how they maintain state across stateless HTTP requests. Understand session cookies, tokens, and server-side storage.
- Glossary Term
HTTP Status Code
Learn what HTTP status codes are and how they indicate request results. Understand 1xx, 2xx, 3xx, 4xx, and 5xx code classes with common examples.
- Glossary Term
Idempotent
Learn what idempotent means in HTTP. Understand why GET, PUT, and DELETE are idempotent, why POST is not, and how idempotency affects API design.
- Guide
Content Negotiation: Accept, Languages and Caches
Implement HTTP content negotiation with Accept headers, q-values, Vary and 406 responses, with Express, Django and nginx examples and language SEO guidance.
- Guide
WebSockets over HTTP: Handshakes, Proxies and Auth
Trace a WebSocket HTTP handshake, verify Sec-WebSocket-Accept, configure nginx, secure browser authentication, and debug idle disconnects and close codes.
- Debug Guide
DNS_PROBE_FINISHED_NXDOMAIN: Find and Fix DNS Failures
Fix DNS_PROBE_FINISHED_NXDOMAIN by comparing authoritative and cached answers, then checking VPN DNS, hosts files, Docker, CoreDNS and DNSSEC.
- Debug Guide
ERR_CERT_AUTHORITY_INVALID: Chain and CA Trust Fixes
Fix ERR_CERT_AUTHORITY_INVALID by inspecting missing intermediates, private CAs, TLS inspection and the CA stores actually used by curl, Node and Python.
- Debug Guide
ERR_CERT_DATE_INVALID: Expired Certificates and Fixes
Fix NET::ERR_CERT_DATE_INVALID by checking certificate dates, client clocks, failed renewals, stale nginx deployments and expired intermediate certificates.
- Debug Guide
ERR_CONNECTION_REFUSED: Localhost, Docker and Node Fixes
Fix ERR_CONNECTION_REFUSED by checking listeners, localhost IPv4/IPv6, Docker port mappings, firewall rejection, service crashes and Kubernetes endpoints.
- Debug Guide
ERR_CONNECTION_TIMED_OUT: Trace TCP Connection Failures
Fix ERR_CONNECTION_TIMED_OUT by tracing SYN packets, checking firewalls and stale DNS, testing IPv6, and separating backlog pressure from MTU stalls.
- Debug Guide
ERR_CONTENT_DECODING_FAILED: Fix Broken Compression
Fix ERR_CONTENT_DECODING_FAILED by comparing raw bytes with Content-Encoding, checking double compression, truncated gzip and cached encoding variants.
- Debug Guide
ERR_EMPTY_RESPONSE: Find Who Closed the Connection
Debug ERR_EMPTY_RESPONSE and curl empty replies by checking app crashes, wrong ports, nginx 444, Docker listeners, keep-alive races and request framing.
- Debug Guide
ERR_HTTP2_PROTOCOL_ERROR: Find the Broken Response
Debug Chrome ERR_HTTP2_PROTOCOL_ERROR and curl (92): compare HTTP versions, inspect invalid headers and body lengths, then trace the failing hop.
- Debug Guide
ERR_INCOMPLETE_CHUNKED_ENCODING: Fix Truncated Responses
Fix ERR_INCOMPLETE_CHUNKED_ENCODING by finding missing final chunks, upstream crashes, nginx read timeouts, buffering failures and stalled SSE streams.
- Debug Guide
nginx Upstream Sent Too Big Header: Fix the 502
Fix nginx upstream sent too big header: measure response headers, size proxy or FastCGI buffers, and shrink oversized Set-Cookie and redirect headers.
- Comparison
301 vs 308: Permanent Redirects and POST Requests
301 vs 308: both signal a permanent move, but only 308 preserves POST. Compare browser handling, Google indexing, cache controls, and curl traces.
- Comparison
Cookies vs localStorage vs sessionStorage: What to Use
Cookies vs localStorage vs sessionStorage: request behavior, size limits, expiry, tab scope, partitioning, XSS and CSRF risks, and auth token choices.
- Comparison
CORS vs CSRF: Response Reads vs Forged Writes
CORS controls cross-origin response reads; CSRF abuses automatically sent credentials. Compare preflights, SameSite, tokens, Origin and Sec-Fetch-Site.
- Comparison
ETag vs Last-Modified: HTTP Cache Validators
ETag vs Last-Modified: strong and weak validation, one-second timestamps, conditional request precedence, multi-server consistency, and CDN debugging.
- Comparison
HTTP/2 vs HTTP/3: TCP, QUIC and Fallback
Compare HTTP/2 over TCP with HTTP/3 over QUIC: packet loss, stream blocking, connection migration, 0-RTT replay, discovery and curl fallback checks.
- Comparison
JWT vs Session Cookies: Logout and Security
Compare stateless JWT bearer tokens with opaque session cookies: revocation, rotation, request size, browser storage, CSRF, XSS and algorithm validation.
- Method
HTTP CONNECT Method: Proxy Tunnels Explained
HTTP CONNECT opens a TCP tunnel through a proxy so HTTPS can pass untouched. See the exact request and 200 response, 407 proxy auth, and extended CONNECT.
- Method
HTTP QUERY Method: Safe Requests With a Body (RFC 10008)
HTTP QUERY is a safe, idempotent method with the query in the body. RFC 10008 status, an example exchange, caching rules, and why GET with a body fails.
- Method
HTTP TRACE Method: What It Does and Why to Disable It
HTTP TRACE echoes the request back for diagnostics. Cross-Site Tracing history, why scanners flag "TRACE enabled", and how to disable it in Apache and nginx.
- Status Code
101 Switching Protocols
The server is switching to a different protocol as requested by the client. Learn about WebSocket upgrades and protocol negotiation.
- Status Code
102 Processing
The server has accepted the request and is processing it, but no response is available yet. Learn about this WebDAV status code for long-running operations.
- Status Code
103 Early Hints
The server sends preliminary response headers to help the client start preloading resources. Learn how 103 Early Hints improves page load performance.
- Status Code
203 Non-Authoritative Information
203 means a proxy modified the origin response before passing it on. Learn when it is sent, how it differs from 200, caching rules and what clients should do.
- Status Code
204 No Content
The request succeeded with no response body. Learn when to use 204 No Content for successful operations that don't return data.
- Status Code
205 Reset Content: What It Does and Browser Support
205 Reset Content tells the client to reset the view that sent the request, like clearing a form. Learn its rules, fetch behaviour and why it is rarely used.
- Status Code
206 Partial Content: Range Requests Explained
206 Partial Content returns only the byte range requested. See a curl transcript, Content-Range, If-Range, video seeking and resumable downloads.
- Status Code
207 Multi-Status: WebDAV Per-Resource Results
207 Multi-Status carries an XML body with a separate status per resource. See a PROPFIND example, how to parse it, and why the top-level code is not the result.
- Status Code
226 IM Used: HTTP Delta Encoding
226 IM Used is the response to a delta-encoded request under RFC 3229. See the A-IM and IM headers, how it works, and why almost nothing implements it.
- Status Code
300 Multiple Choices
The request has multiple possible responses. Learn when to use 300 Multiple Choices for content negotiation and alternative resource locations.
- Status Code
303 See Other
Redirect to a different resource using GET. Learn when to use 303 to prevent form resubmission and implement the Post-Redirect-Get pattern.
- Status Code
307 Temporary Redirect
Temporary redirect that preserves the HTTP method. Learn when to use 307 instead of 302 for method-sensitive redirects.
- Status Code
308 Permanent Redirect
Permanent redirect that preserves the HTTP method. Learn when to use 308 instead of 301 for method-sensitive permanent redirects.
- Status Code
402 Payment Required
Reserved for future use in digital payment systems. Learn about this experimental status code and modern payment verification alternatives.
- Status Code
HTTP 404 Not Found: What It Means and How to Fix It
404 Not Found means no resource exists at that URL. Find which layer sent it, then fix routing, deploys, rewrites, CDN cache and soft 404s, with curl checks.
- Status Code
405 Method Not Allowed
405 Method Not Allowed means the URL exists but not for that method. Read the Allow header, then fix redirects turning POST into GET, static hosting and WAFs.
- Status Code
407 Proxy Authentication Required: Fix It
407 means your proxy wants credentials before forwarding the request. Fix it in curl, npm, pip, git and browsers, and learn how Proxy-Authenticate works.
- Status Code
410 Gone
Learn what 410 Gone means and when resources are permanently removed. Understand the difference between 410 and 404, and SEO implications for deleted content.
- Status Code
411 Length Required: Why It Happens
411 Length Required: the server wants a Content-Length and got chunked or none. Fix it in curl, Node, Python and fetch, and on nginx and Google Frontend.
- Status Code
413 Payload Too Large (Content Too Large): Causes and Fixes
413 Content Too Large (formerly Payload Too Large): find which layer rejected the upload and raise the limit in nginx, Apache, Cloudflare, Express and more.
- Status Code
414 URI Too Long
The requested URI exceeds the server's maximum length limit. Learn about URI length limits and how to handle oversized requests.
- Status Code
416 Range Not Satisfiable: Causes and Fixes
416 Range Not Satisfiable means the requested byte range lies outside the resource. Find why resumed downloads and video requests fail, and how to fix it.
- Status Code
417 Expectation Failed: Expect 100-continue
417 Expectation Failed means a server or proxy rejected your Expect header, usually Expect: 100-continue. Learn the causes and fixes for curl, .NET and Squid.
- Status Code
418 I'm a Teapot: Origin and Real-World Use
418 I'm a teapot comes from the 1998 April Fools RFC 2324. See why RFC 9110 reserves it, why Node and Go keep it, and why some sites return it to bots.
- Status Code
419 Page Expired (Laravel CSRF Token Mismatch)
Laravel 419 Page Expired means the CSRF token did not match the session. Causes: expired session, missing @csrf, dropped cookie, cached forms. Fixes included.
- Status Code
421 Misdirected Request: HTTP/2 Connection Coalescing
421 Misdirected Request means the server cannot answer for the host on this connection. Fix SNI and certificate mismatches caused by HTTP/2 connection reuse.
- Status Code
423 Locked
The resource is locked and cannot be accessed or modified. Learn about WebDAV locks and how to handle locked resources.
- Status Code
424 Failed Dependency (WebDAV)
424 Failed Dependency means a request failed because another action it depended on failed first. See WebDAV multi-status examples and what to fix.
- Status Code
425 Too Early: TLS 1.3 0-RTT Replay Protection
425 Too Early tells a client not to send a request in TLS early data because it could be replayed. See the Early-Data header and nginx config for 0-RTT.
- Status Code
426 Upgrade Required
The server refuses to perform the request using the current protocol and requires the client to upgrade to a different protocol.
- Status Code
428 Precondition Required
The server requires the request to be conditional. Learn when to use 428 Precondition Required to prevent lost updates and race conditions.
- Status Code
431 Request Header Fields Too Large
The server refuses to process the request because header fields are too large. Learn how to handle and prevent 431 errors in your applications.
- Status Code
444 Connection Closed Without Response (nginx)
nginx 444 closes the connection without sending any response. Learn how to use return 444 to drop bots and unknown hosts, and what clients see.
- Status Code
451 Unavailable For Legal Reasons
The requested resource is unavailable due to legal demands. Learn about 451 status code used for censorship and content blocking.
- Status Code
497 HTTP Request Sent to HTTPS Port (nginx)
nginx 497 means plain HTTP hit an HTTPS port; clients see "400 The plain HTTP request was sent to HTTPS port". Fix with error_page 497. Also 494, 495, 496.
- Status Code
499 Client Closed Request (nginx)
nginx 499 means the client hung up before the response was sent. Why it spikes with slow upstreams, how proxy_ignore_client_abort works, and how to debug it.
- Status Code
501 Not Implemented
The server doesn't support the functionality required to fulfill the request. Learn about unimplemented features.
- Status Code
505 HTTP Version Not Supported
Learn what 505 HTTP Version Not Supported means when servers reject protocol versions. Understand HTTP/1.1, HTTP/2 compatibility and version negotiation.
- Status Code
506 Variant Also Negotiates
506 Variant Also Negotiates is a server configuration error in transparent content negotiation (RFC 2295). See what triggers it in Apache and how to fix it.
- Status Code
508 Loop Detected: Proxy and Redirect Loops
508 Loop Detected means the server found an infinite loop while processing a request. Learn the WebDAV origin, proxy loops, CDN-Loop and how to find the cycle.
- Status Code
510 Not Extended (HTTP Extension Framework)
510 Not Extended comes from the experimental HTTP Extension Framework in RFC 2774, now historic. See what it meant and what to do if you hit it.
- Status Code
511 Network Authentication Required: Captive Portals
511 is returned by a network gateway, such as hotel or airport Wi-Fi, that requires login before granting internet access. Learn how apps should handle it.
- Status Code
520 Web Server Returned an Unknown Error
Cloudflare-specific error when the origin server returns an unexpected response. Learn about 520 errors and how to troubleshoot them.
- Status Code
521 Web Server Is Down
Cloudflare-specific status code indicating the origin server refused the connection. Learn about this proxy error and how to troubleshoot it.
- Status Code
522 Connection Timed Out
Cloudflare-specific error when unable to establish a TCP connection to the origin server. Learn how to diagnose and fix 522 timeout errors.
- Status Code
523 Origin Is Unreachable
Cloudflare-specific error when the origin server's IP address is unreachable. Learn about DNS and routing issues causing 523 errors.
- Status Code
525 SSL Handshake Failed (Cloudflare)
Cloudflare 525 means the TLS handshake with your origin server failed. Diagnose with openssl s_client, check SSL modes, ciphers, SNI and port 443, and fix it.
- Status Code
526 Invalid SSL Certificate (Cloudflare)
Cloudflare 526 means the origin certificate failed Full (strict) validation. Check expiry, hostname and chain with openssl, then fix it.
- Status Code
530 Error with 1xxx Codes (Cloudflare)
Cloudflare 530 never appears alone: it comes with a 1xxx error such as 1016 Origin DNS error or 1033 Tunnel error. Read the code in the page body and fix it.
- Header
Access-Control-Allow-Origin Header: CORS Errors and Fixes
Access-Control-Allow-Origin explained: exact browser errors, why * fails with credentials, why you need Vary: Origin, and fixes for nginx, Express and Django.
- Header
Access-Control-Expose-Headers: Read Headers in fetch()
Fix response.headers.get() returning null on cross-origin fetch. Access-Control-Expose-Headers, safelisted headers, and why * fails with credentials.
- Header
Access-Control-Max-Age Header
Learn how Access-Control-Max-Age specifies how long browsers can cache CORS preflight results. Reduce preflight requests and improve cross-origin performance.
- Header
Access-Control-Request-Headers Header
Learn how Access-Control-Request-Headers tells servers which custom headers will be used in CORS requests. Essential for preflight request handling.
- Header
Alt-Svc Header: How Browsers Discover HTTP/3
Alt-Svc advertises an alternative protocol for an origin. How h3=":443"; ma=86400 moves browsers to HTTP/3, what clear does, and how HTTPS DNS records differ.
- Header
Authorization Header: Bearer, Basic and 401 Fixes
Authorization header carries credentials as scheme plus token. Bearer and Basic formats, WWW-Authenticate, why proxies strip it, redirects, CORS and storage.
- Header
Cache-Control Header: Directives, Examples and CDN Behavior
Cache-Control directives explained: max-age, no-cache vs no-store, s-maxage, stale-while-revalidate, immutable, with nginx, Cloudflare and Next.js examples.
- Header
Clear-Site-Data Header: Logout and Wipe Browser Data
Clear-Site-Data tells the browser to delete cookies, storage and cache on logout. Directives, quoting rules, HTTPS-only limits, browser gaps, Express and nginx.
- Header
Content-Encoding
Learn how Content-Encoding specifies compression algorithms (gzip, br, deflate) used to encode response bodies. Reduce bandwidth and improve load times.
- Header
Content-Security-Policy Header: Directives, Nonces and Console Errors
Content-Security-Policy (CSP) limits what a page may load or run. Directives, nonces, strict-dynamic, Report-Only rollout, console errors, helmet and Next.js.
- Header
Cookie Header
Learn how the Cookie header sends stored cookies to servers with each request. Understand cookie transmission, session management, and security considerations.
- Header
CSP Report-Only Header: Roll Out CSP Safely
Content-Security-Policy-Report-Only tests a policy without blocking. Rollout steps, report-uri vs report-to, sample violation JSON, and cutting noise.
- Header
Date Header
Learn how the Date header specifies when the HTTP message was originated by the server. Understand date formats and its role in caching and logging.
- Header
Expect Header: 100-continue, curl Delays and 417
Expect: 100-continue asks the server to approve a request before the body is sent. Why curl adds it past 1 MB, the 1s delay, -H "Expect:", and 417.
- Header
Expires Header
Learn how the Expires header specifies when cached responses become stale. Understand date formats and when to use Expires vs Cache-Control for caching.
- Header
Idempotency-Key Header: Safe POST Retries
Idempotency-Key lets clients retry POST and PATCH without duplicating work. The IETF draft, Stripe behavior, and how to design the server side.
- Header
If-Modified-Since Header
Learn how the If-Modified-Since header requests resources only if modified since a specific date. Reduce bandwidth with efficient conditional caching.
- Header
Last-Modified
Learn how the Last-Modified header indicates when a resource was last changed. Enable efficient cache validation with If-Modified-Since conditional requests.
- Header
Performance-Timing: Server-Timing, Timing-Allow-Origin and Performance APIs
There is no Performance-Timing HTTP header. Use Server-Timing, Timing-Allow-Origin, the Navigation and Resource Timing APIs, TTFB and INP instead.
- Header
Reporting-Endpoints Header: Reporting API Setup
Reporting-Endpoints names the URLs where browsers send CSP, COOP, deprecation and crash reports. Syntax, the default endpoint, and replacing Report-To.
- Header
Sec-Fetch-Dest Header: All Values Explained
Sec-Fetch-Dest tells the server where a response will be used: document, iframe, image, script, empty. Full value list and server-side uses.
- Header
Sec-Fetch-Mode Header: Values and Server Use
Sec-Fetch-Mode reports the request mode: navigate, cors, no-cors, same-origin or websocket. What sets each value and how servers use it.
- Header
Sec-Fetch-Site Header: Block Cross-Site Requests
Sec-Fetch-Site says whether a request is same-origin, same-site, cross-site or user-initiated. Resource isolation policy for Express and nginx, plus CSRF use.
- Header
Sec-Fetch-User Header: ?1 and User Activation
Sec-Fetch-User is always ?1 and appears only on user-activated navigations, like a link click. When it is absent and why Safari does not send it.
- Header
Server Header: Fingerprinting and How to Hide It
The Server header names the software that answered. Use it to find which layer replied, and hide version numbers in nginx, Apache and Cloudflare, with limits.
- Header
Set-Cookie Header: Attributes, Examples and Browser Rules
Set-Cookie syntax and every attribute: Expires, Max-Age, Domain, Path, Secure, HttpOnly, SameSite, Partitioned, __Host- prefixes, with Express and Django.
- Header
Strict-Transport-Security (HSTS) Header: Setup and Preload
Strict-Transport-Security (HSTS) forces HTTPS for a set time. max-age, includeSubDomains, preload rules, nginx and Apache config, and how to roll it back.
- Header
Traceparent Header: W3C Trace Context Format
The traceparent header carries trace id, parent span id and flags across services. Exact format, tracestate limits, OpenTelemetry, and privacy rules.
- Header
Vary Header: Cache Keys, Vary: Origin and Accept-Encoding
Vary lists the request headers a response depends on, so caches keep separate copies. Vary: Accept-Encoding, Vary: Origin for CORS, Vary: *, and CDN cache keys.
- Header
X-Forwarded-For
X-Forwarded-For carries the client IP through proxies and load balancers, but clients can forge it. Trust it safely in nginx, Express, Cloudflare and AWS.
- Header
X-Powered-By Header: Remove It in Express, PHP, Next.js
X-Powered-By advertises your framework, such as Express or PHP. Remove it in Express, PHP, Next.js, ASP.NET and nginx, and why it is hygiene, not security.
- Header
X-RateLimit Headers
Learn how X-RateLimit headers inform API clients about rate limits, remaining requests, and reset times. Implement proper rate limiting in your applications.
- Header
X-Request-ID Header: Correlation IDs Across Services
X-Request-ID tags one request so you can find it in every log. nginx $request_id, Heroku behavior, propagation between services, and traceparent.
- Header
X-Robots-Tag Header: noindex for PDFs and Staging
X-Robots-Tag sends noindex and snippet rules as an HTTP header for PDFs, images and staging sites. nginx, Apache and Cloudflare config, and the robots.txt trap.
- Cookie Attribute
Cookie Prefixes: __Host- and __Secure- Rules
Cookie prefixes make the browser enforce attributes. The exact __Host- and __Secure- rules from RFC 6265bis, how to set them, and why a cookie vanishes.
- Cookie Attribute
Domain
Learn how the Domain cookie attribute controls which domains can access cookies. Understand subdomain sharing, security implications, and restrictions.
- Cookie Attribute
Expires
Learn how the Expires cookie attribute sets an absolute expiration date. Understand date formats, timezone handling, and when to use Expires vs Max-Age.
- Cookie Attribute
HttpOnly Cookie Attribute: XSS Protection
Learn how the HttpOnly cookie attribute protects against XSS attacks by preventing JavaScript access to sensitive cookies.
- Cookie Attribute
Max-Age
Learn how the Max-Age cookie attribute sets expiration in seconds from now. Understand why Max-Age is preferred over Expires for reliable lifetime control.
- Cookie Attribute
Partitioned Cookies (CHIPS): The Partitioned Attribute
The Partitioned cookie attribute (CHIPS) gives third-party embeds a separate cookie jar per top-level site. Syntax, Secure requirement, and browser support.
- Cookie Attribute
Path
Learn how the Path cookie attribute restricts which URL paths can receive cookies. Understand path matching rules and how to scope cookies to specific routes.
- Cookie Attribute
Secure
Learn how the Secure cookie attribute ensures cookies are only sent over HTTPS connections. Protect sensitive data from man-in-the-middle attacks.
- Glossary Term
CDN (Content Delivery Network)
A CDN is a network of edge servers that cache and serve responses near users. See how cache hits show up in headers and what CDNs do not cache by default.
- Glossary Term
Content Negotiation
Content negotiation lets one URL serve different formats, languages or encodings based on Accept headers. See q-values, Vary, 406 and the caching traps.
- Glossary Term
CSRF (Cross-Site Request Forgery)
CSRF tricks a logged-in browser into sending an unwanted request to your site. See how it works, why CORS does not stop it and which defenses actually do.
- Glossary Term
HTTP Cookie
Learn what HTTP cookies are and how browsers store small data pieces for websites. Understand cookie attributes, security, and session management.
- Glossary Term
HTTP Error Handling
Learn HTTP error handling best practices for detecting, managing, and responding to errors gracefully. Understand status codes, retry logic, and user feedback.
- Glossary Term
HTTP Header
Learn what HTTP headers are and how they provide metadata about requests and responses. Understand common headers like Content-Type and Authorization.
- Glossary Term
HTTP Payload
Learn what HTTP payload means and how message bodies carry data in requests and responses. Understand JSON, form data, and binary payloads.
- Glossary Term
HTTP Request
Learn what an HTTP request is and how clients send messages to servers. Understand request structure, methods, headers, and body components.
- Glossary Term
Idempotency Key (Safe POST Retries)
An Idempotency-Key header lets a client safely retry a POST: the server stores the first result and replays it. Learn the protocol, edge cases and conflicts.
- Glossary Term
Keep-Alive (Persistent Connections)
Keep-alive reuses one TCP connection for many HTTP requests. Learn the HTTP/1.1 default, idle timeout defaults in nginx and Node, and why mismatches cause 502s.
- Glossary Term
MIME Type (Media Type)
A MIME type, or media type, is the type/subtype label in Content-Type that tells clients how to interpret a body. Covers nosniff and blocked-script errors.
- Glossary Term
Origin (Scheme, Host, Port)
An origin is the scheme, host and port of a URL. See how browsers compare origins for the same-origin policy, CORS and the Origin header, with examples.
- Glossary Term
Preflight Request (CORS OPTIONS)
A CORS preflight is an automatic OPTIONS request the browser sends before a cross-origin request to check permission. See when it fires and how to answer it.
- Glossary Term
Reverse Proxy
A reverse proxy sits in front of origin servers and forwards client requests to them. Learn the headers it adds, nginx proxy_pass pitfalls and 502/504 causes.
- Glossary Term
Same-Site vs Same-Origin
Site and origin are not the same. Learn how eTLD+1 and the Public Suffix List define same-site, and why it decides SameSite cookie and CORS behavior.
- Glossary Term
SNI (Server Name Indication)
SNI is a TLS extension that sends the hostname in the ClientHello so one IP can serve many certificates. Learn debugging with curl and nginx upstream pitfalls.
- Glossary Term
TLS Handshake
The TLS handshake negotiates keys and authenticates the server before HTTP data flows. See the TLS 1.3 round trip, ALPN, session resumption and 0-RTT risks.
- Glossary Term
TTFB (Time to First Byte)
TTFB is the time from starting a request until the first byte of the response arrives. Learn what it includes, how to measure it and what usually inflates it.
- Glossary Term
URI vs URL (and URN)
A URL is a URI that says where a resource lives; a URI only identifies it. See the parts of a URL, what the server never receives and parser pitfalls.
- Glossary Term
XSS (Cross-Site Scripting)
XSS lets an attacker run JavaScript in your page by getting untrusted input rendered as code. Learn the three types, real examples, CSP and HttpOnly limits.
- Guide
API Rate Limiting: Algorithms, Headers and 429
Rate limit an HTTP API: fixed window, sliding window, token bucket and leaky bucket compared, plus 429, Retry-After, RateLimit headers, nginx and Express.
- Guide
HTTP Compression: gzip, Brotli and Zstandard Setup
How HTTP compression works: Accept-Encoding negotiation, gzip vs Brotli vs zstd, nginx, Caddy, Express and Cloudflare config, BREACH, and measuring with curl.
- Guide
HTTP Range Requests: 206, Resume and Video Seeking
How HTTP range requests work: Range, Accept-Ranges, 206 and Content-Range, multipart/byteranges, 416, If-Range for safe resumes, and CDN and compression traps.
- Guide
HTTP Security Headers Checklist: Values and Configs
Which HTTP security headers to send and which to drop: starting values for CSP, HSTS and more, with nginx, Apache, Express, Next.js and Cloudflare config.
- Guide
HTTP/3 and QUIC Explained: Setup, Fallback, 0-RTT
How HTTP/3 and QUIC work: UDP/443, connection IDs, 0-RTT replay risk, Alt-Svc and HTTPS DNS record discovery, nginx/Caddy/Cloudflare setup, and curl checks.
- Guide
REST API Design with HTTP Semantics
Choose HTTP methods and status codes for a REST API: 201, 202, 204, 400 vs 422, 409, ETag with If-Match, pagination, problem+json and idempotency keys.
- Guide
Webhooks: Delivery, Retries and Signature Verification
Build a reliable webhook receiver: respond 2xx fast, verify HMAC over the raw body, reject replays, dedupe by event ID. Covers Stripe and GitHub.
- Debug Guide
429 Too Many Requests: Fix It with Retry-After and Backoff
Fix 429 Too Many Requests as an API client: honor Retry-After, back off exponentially with jitter, read RateLimit headers, handle GitHub and LLM limits.
- Debug Guide
CDN Not Caching: cf-cache-status DYNAMIC, BYPASS, MISS
CDN not caching? Read cf-cache-status DYNAMIC, BYPASS, MISS or X-Cache: Miss from cloudfront, then fix Set-Cookie, Cache-Control, Vary and cache keys.
- Debug Guide
ERR_CONNECTION_RESET and ECONNRESET: Find the RST
Fix ERR_CONNECTION_RESET, ECONNRESET and curl (56) Connection reset by peer: keep-alive races, body limits, firewalls, crashes. Find who sent the RST.
- Debug Guide
ERR_SSL_PROTOCOL_ERROR: Causes and Fixes in Chrome
Fix ERR_SSL_PROTOCOL_ERROR: plain HTTP on port 443, TLS version mismatches, SNI, TLS-inspecting proxies and Cloudflare, with curl and openssl checks.
- Debug Guide
ERR_TOO_MANY_REDIRECTS: Find and Break the Redirect Loop
Fix ERR_TOO_MANY_REDIRECTS (redirected you too many times): Cloudflare Flexible SSL, WordPress URLs, nginx HTTPS loops and cookie loops, diagnosed with curl.
- Debug Guide
Mixed Content Blocked: HTTPS Page Requesting HTTP
Fix 'Mixed Content: The page was loaded over HTTPS, but requested an insecure resource': find the http:// URLs, add upgrade-insecure-requests, fix proxies.
- Debug Guide
NET::ERR_CERT_COMMON_NAME_INVALID: Fix the Name Mismatch
Fix NET::ERR_CERT_COMMON_NAME_INVALID and related ERR_CERT errors: SAN vs CN, wildcard limits, missing SNI, expired or incomplete chains, with openssl checks.
- Debug Guide
nginx 413 Request Entity Too Large: client_max_body_size
Fix nginx 413 Request Entity Too Large: raise client_max_body_size, then check Cloudflare limits, ingress-nginx proxy-body-size and PHP upload limits.
- Debug Guide
nginx 502 Bad Gateway: Causes and Fixes by Error Log
Fix nginx 502 Bad Gateway by matching the error log: connection refused, prematurely closed connection, php-fpm socket permissions, too big header, keepalive.
- Debug Guide
nginx 504 Gateway Timeout: Fix Upstream Timed Out (110)
Fix nginx 504 Gateway Time-out and 'upstream timed out (110)': proxy_read_timeout, fastcgi_read_timeout, ALB idle timeout, and Cloudflare 524 compared.
- Debug Guide
No 'Access-Control-Allow-Origin' Header Is Present: Fix CORS
Fix the CORS error 'No Access-Control-Allow-Origin header is present on the requested resource' with working Express, nginx, S3, Workers and Django fixes.
- Debug Guide
Request Header Or Cookie Too Large: Fix 400 and 431
Fix 400 Request Header Or Cookie Too Large and 431 errors: find the oversized cookie or token, then check nginx, Apache, Node, ALB and Cloudflare limits.
- Comparison
200 vs 201 vs 204: Which Success Code to Return
Choose between 200 OK, 201 Created and 204 No Content for REST APIs: what each means, the Location and body rules, raw responses for POST, PUT, PATCH and DELETE.
- Comparison
302 vs 307 Redirects
Compare 302 Found and 307 Temporary Redirect, including method preservation, request bodies, browser behavior, caching, and safe API redirect choices.
- Comparison
400 vs 422: Malformed vs Invalid Requests
400 Bad Request or 422 Unprocessable Content for validation errors? The syntax-vs-semantics rule, what Rails, Laravel, FastAPI and Spring return by default, and raw examples.
- Comparison
403 vs 404: Forbidden or Not Found
403 Forbidden vs 404 Not Found: when to admit a resource exists, when to hide it, the GitHub private-repo example, and the debugging cost of masking 403 as 404.
- Comparison
502 vs 503 vs 504: Which Gateway Error Is It
502, 503 and 504 side by side: who generated each one, what the upstream did, the nginx error-log line that proves it, and the Cloudflare 52x and ALB equivalents.
- Comparison
HTTP vs HTTPS: What TLS Adds and What It Does Not Hide
HTTP vs HTTPS: what TLS encrypts and authenticates, what still leaks (IP, SNI, sizes), where ECH stands, HSTS, mixed content, and the SEO effect of moving to HTTPS.
- Comparison
Cache-Control: no-cache vs no-store
Compare the no-cache and no-store Cache-Control response directives and choose the correct policy for sensitive or frequently changing responses.
- Comparison
PUT vs POST: Create or Replace a Resource
PUT vs POST in REST APIs: who picks the URL, idempotency, retries, upsert, and raw requests showing when to create with POST and when to replace with PUT.
- Comparison
SSE vs WebSockets vs Long Polling
Server-Sent Events vs WebSockets vs long polling: direction, reconnects with Last-Event-ID, the 6-connection limit and HTTP/2, nginx proxy buffering, and RFC 8441.
February 2026
- Comparison
301 vs 302 Redirects
Understand the difference between 301 Moved Permanently and 302 Found redirects. Learn when to use each, how browsers cache them, and their SEO implications.
- Comparison
304 Not Modified vs 200 OK
Understand when servers return 304 Not Modified instead of 200 OK. Learn how conditional requests, ETags, and Last-Modified headers enable efficient HTTP caching.
- Comparison
401 vs 403: Authentication vs Authorization
Understand the difference between 401 Unauthorized and 403 Forbidden. Learn when each status code applies, common mistakes, and how to use them correctly in APIs.
- Comparison
Cookie-Based vs Session-Based Authentication
Compare cookie-based and session-based authentication. Understand where state lives, security tradeoffs, scalability implications, and when to use each approach.
- Comparison
CORS vs CSP
Understand the difference between CORS and Content Security Policy. Both are browser security mechanisms but they protect against completely different threats.
- Comparison
GET vs POST
Understand the fundamental differences between GET and POST HTTP methods. Learn about safety, idempotency, caching, request bodies, and when to use each.
- Comparison
HTTP/1.1 vs HTTP/2
Compare HTTP/1.1 and HTTP/2. Understand multiplexing, header compression, server push, and when upgrading to HTTP/2 actually improves performance.
- Comparison
Permissions-Policy vs Feature-Policy
Understand the differences between Permissions-Policy and Feature-Policy headers. Compare syntax changes for geolocation, microphone, camera directives and learn how to migrate.
- Comparison
PUT vs PATCH
Understand the difference between PUT and PATCH HTTP methods. Learn when to use full replacement vs partial update, and how each affects idempotency and API design.
- Guide
HTTPS Explained: How TLS Secures HTTP
HTTPS is HTTP over TLS. What the TLS handshake does, how certificates prove identity, what HTTPS hides and what it does not, and how to migrate a site safely.
January 2026
- Guide
What Is HTTP? How the HTTP Protocol Works
HTTP is the request-response protocol behind every web page and API. See a real request and response, then methods, headers, status codes and what HTTPS adds.
- Header
Timing-Allow-Origin
Learn how the Timing-Allow-Origin header specifies which origins can access Resource Timing API data. Enable cross-origin performance monitoring securely.
- Guide
Cookie Security: HttpOnly, SameSite, and Secure Flags
A comprehensive guide to understanding and implementing secure HTTP cookies to protect against XSS, CSRF, and session hijacking attacks.
- Guide
Cross-Origin Resource Sharing (CORS)
Master Cross-Origin Resource Sharing (CORS) for secure cross-origin HTTP requests. Learn preflight requests, headers, credentials, and common error solutions.
- Guide
HTTP Authentication Methods and Best Practices
A comprehensive guide to HTTP authentication methods including Basic Auth, Bearer tokens, API keys, and OAuth 2.0.
- Guide
HTTP Headers and Caching: A Practical Guide
Master HTTP caching with Cache-Control, ETag, Last-Modified, and conditional request headers. Learn how to optimize performance with proper cache strategies.
- Guide
HTTP Sessions and State Management Explained
Learn how to manage user state and sessions in stateless HTTP applications using cookies, tokens, and server-side storage.
- Guide
HTTP Status Codes: Full List with Meanings
Every HTTP status code class from 1xx to 5xx with what each code means and when to return it, including the ones you meet most: 200, 301, 304, 404 and 500.
- Guide
Request and Response Lifecycle
Learn how HTTP requests travel from browser to server and back. Understand DNS resolution, TCP connections, request/response flow, and the complete lifecycle.
- Cookie Attribute
SameSite Cookie Attribute: Strict, Lax and None
How SameSite works: Strict, Lax and None, what counts as same-site, why Lax-by-default is Chromium behavior, and how to fix cookies blocked cross-site.