This chapter organizes cookie attributes by "where to send", "how long to keep", and "who can read", and explains the incidents that arise from the scope not matching origin. It covers that Domain widens into subdomains and that SameSite is evaluated at the site level.
This chapter starts from the structure of HTTP requests and responses and then covers the nine standard methods with their safety and idempotency, and the classification of status codes. It covers how to choose between PUT, PATCH, and POST by what the body means, explains that methods appear only on the request line, and why UPDATE and REMOVE are not the ones to use.
This chapter organizes the directives of Cache-Control by "who it applies to", "how long it stays fresh", and "what to do after expiry", and derives caching designs from the nature of the resource. It covers the differences between no-cache and no-store, max-age and s-maxage, where stale-while-revalidate and immutable belong, and why Vary is needed.
This chapter defines an origin as the triple of scheme, host, and port, and explains that the same-origin policy blocks reading, not sending. It covers when preflight is triggered, why wildcard and credentials can't be combined, and why Vary is needed.
This chapter classifies failures into determined, indeterminate, and overload, and derives when a retry is safe from idempotency. It covers why exponential backoff needs jitter, why the ceiling is two values (attempt count and total elapsed time), and what an idempotency key guarantees.
This chapter explains TCP/IP's layered model from the division of labor where IP decides where to deliver and TCP guarantees how it is delivered. It covers the three ranges of port numbers, why the server port is fixed and the client port is variable, and that IANA registration is optional.