HTTP headers that matter

Caching and content negotiation live in headers. `Cache-Control` decides whether your CDN does any work at all.

#http#cache#cors#headers

text

Content-Type: application/json
Accept: application/json
Authorization: Bearer <token>

Cache-Control: public, max-age=31536000, immutable   # hashed assets
Cache-Control: no-store                              # personal data
ETag / If-None-Match                                 # 304 revalidation

Access-Control-Allow-Origin: https://example.com     # CORS
Retry-After: 30                                      # with 429 / 503

HTTP status codes worth memorizing

2xx succeeded, 3xx go elsewhere, 4xx the caller is wrong, 5xx the server is wrong. These are the ones that come up in real APIs.

REST basics

Nouns in the path, verbs in the method. GET must be safe and cacheable, PUT/DELETE idempotent, POST neither.

HTTP headers that matter

Related

HTTP status codes worth memorizing

REST basics