Http
50 bites tagged Http — interview questions with model answers, and 60-second explainers.
HTTP Cookies: State for a Stateless Web
Think of a cookie as a server's nametag for your browser. Since HTTP is stateless, this nametag helps the server remember you across requests for logins, shopping carts, or personalization. The main footgun is security: always use security flags.
The Fetch API's Request Object
The Fetch API's Request object is a blueprint for an HTTP call, bundling URL, method, headers, and body. It's key for intercepting traffic in service workers or building reusable fetches. The main footgun: its body is a stream that can only be read once.
URLSearchParams: Safely Build and Parse URL Queries
Think of `URLSearchParams` as a structured object for a URL's query string, saving you from messy string manipulation. Use it to read incoming parameters or build a query for a fetch request. The footgun: `get()` only returns the first value for a key.
The Headers Object: A Safer Way to Manage HTTP Headers
The `Headers` object is a specialized map for HTTP headers that handles sanitization for you. Use it with the Fetch API to build requests or read response headers. The footgun: headers from a `fetch()` response are immutable and will throw an error if you try.
Configuring Fetch Requests with `RequestInit`
`RequestInit` is the options object that customizes a `fetch` call beyond a simple GET. Use it to specify the HTTP method, send a request body, set headers, and control caching. A common footgun is sending a JSON body without setting the `Content-Type` header.
FormData: Package Form Data for HTTP Requests
The FormData API is a digital shipping container for your form's data, packaging input into a format HTTP requests understand. Use it to send forms, including files, with `fetch()` without manually setting headers.
Axios: A Simpler Way to Make HTTP Requests
Axios simplifies making network requests by wrapping native browser APIs in a promise-based client. Use it to GET or POST data in any JavaScript app. The main footgun is forgetting requests are asynchronous; you must use `async/await` to get the data.
HTTP Basic Auth: Simple but Insecure Access Control
HTTP Basic Auth is a simple gatekeeper for your API, prompting users for a username and password directly in the browser. It's useful for internal tools, but never use it over unencrypted HTTP as credentials are sent in a trivially decodable format.
FastAPI: Setting Custom Response Headers
Set custom HTTP headers in FastAPI by adding a `Response` parameter to your endpoint. This lets you add metadata like trace IDs without changing your return data. The footgun is thinking you must return the `Response` object; just return your data as usual.
Declaring Request Headers in FastAPI
Treat request headers like any other parameter in FastAPI. Declare them in your function signature to access values like `User-Agent` or `X-Token`. FastAPI automatically converts hyphens to underscores, so `User-Agent` is accessed via the `user_agent`…
FastAPI: Set a Response's HTTP Status Code
In FastAPI, set the success status code in the decorator, not the function. Use `status_code=201` in `@app.post()` to signal resource creation. The common footgun is placing `status_code` in the function signature instead of the decorator itself.
Server-Sent Events (SSE): One-Way Data Push from Server
Server-Sent Events (SSE) push data from server to client over one HTTP connection. It's a simpler, one-way alternative to WebSockets for things like live news feeds or status updates.
Polling vs. WebSockets: Stop Asking, Start Listening
Polling is like repeatedly asking "Are we there yet?", while WebSockets is a persistent, two-way conversation. Use polling for infrequent updates, but use WebSockets for real-time apps like chat. The footgun is using polling for high-frequency updates.
HSTS: Forcing Future Connections to Use HTTPS
HSTS is a response header that tells browsers to only use HTTPS for your site, automatically upgrading future HTTP requests. This prevents SSL stripping attacks.
Securing Cookies with HttpOnly, Secure, and SameSite
Think of cookie attributes as security guards for your session data. They prevent common attacks by telling the browser strict rules for sending the cookie, mitigating risks like cross-site scripting (XSS) and cross-site request forgery (CSRF).
Content Security Policy (CSP): An Allowlist for Browser Resources
Content Security Policy is an allowlist you send to the browser, dictating which scripts, styles, and images are safe to load. It's a primary defense against XSS attacks by blocking unauthorized resources.
Nock: Intercept and Mock Node.js HTTP Requests
Nock acts like a fake switchboard for your Node.js app's outgoing HTTP calls, redirecting them to pre-defined responses. This lets you unit test code that relies on external services, making tests fast, deterministic, and offline-capable.
Idempotency in REST APIs: Safe to Retry?
An idempotent API request means sending it once or 100 times has the same effect on the server's state. GET, PUT, and DELETE are idempotent, making them safe to retry. POST is not, so retrying can create duplicates.
HTTP Status Codes: The Server's Signal
HTTP status codes are the server's signal for a request's outcome: success, client error, or server error. You see them when fetching data (200 OK), hitting a bad link (404), or when a server fails (500). Footgun: Don't just check for 'not 200'.
Helmet.js: Secure Express Apps with HTTP Headers
Helmet.js adds a security layer to Express apps by setting crucial HTTP headers. Use it in any public-facing Node app to prevent common attacks like XSS. The footgun: its default Content-Security-Policy is strict and requires app-specific configuration.
Express Request and Response Objects (req, res)
Think of Express's `req` and `res` as an incoming letter and your reply. `req` contains the client's request details, like headers and data, while `res` is your toolkit for sending a response. They are the core of every route handler.
Creating a Basic HTTP Server in Node.js
A Node.js HTTP server is a listening post that waits for requests on a port and runs your code to reply. It's the foundation for any web service, from simple APIs to full apps. The footgun: forgetting `response.end()` leaves the client hanging indefinitely.
Dart's `http` Package: Simple Requests vs. Composable Clients
Dart's `http` package simplifies web requests. Use top-level functions like `http.get()` for one-off calls, or a `Client` for persistent connections. Forgetting to call `client.close()` is a common footgun that leaks resources.
Consuming REST APIs: Speaking to Web Services
Think of consuming a REST API like ordering from a menu. You use standard actions (GET, POST) on specific URLs to request or change data. This is how apps fetch user profiles, get weather data, or submit forms. The footgun: Don't ignore HTTP status codes.
Get Http bites daily.
Five a day, five minutes, offline. With quizzes so it sticks.
Open testing — you’ll join as an early tester.