Learn 49 HTTP & Protocol concepts for Backend development, with definitions, aliases, and ready-to-use AI prompts.
Listens for HTTP requests and returns protocol-compliant responses.
Create a production-ready HTTP server with explicit host and port configuration, request timeouts, bounded body sizes, structured access logs, graceful shutdown, health endpoints, secure defaults, and no framework debug details exposed in production.A client message containing a method, target, headers, and optional body.
Handle an HTTP request by parsing the method, target, headers and body with strict size and content-type limits. Preserve a request ID, reject malformed input safely, apply cancellation and timeouts, and avoid logging secrets or personal data.A server message containing a status, headers, and optional representation.
Return a consistent HTTP response with the correct status code, explicit content type, safe cache policy, request correlation ID and schema-valid body. Prevent sensitive internal details from appearing in errors and omit a body when the selected status forbids one.Tracks a request from connection acceptance through parsing, routing, handling, and completion.
Implement an observable HTTP request lifecycle covering connection acceptance, parsing, request-ID creation, middleware, routing, validation, handler execution and response completion. Propagate cancellation, record duration and outcome, and guarantee cleanup on every exit path.Tracks response creation, header commitment, body transmission, and connection completion.
Implement a clear HTTP response lifecycle that selects status and representation, applies headers and compression before committing them, streams or writes the body safely, records bytes and duration, handles client disconnects, and prevents writes after completion.Expresses the intended operation semantics of an HTTP request.
Route HTTP requests by method with explicit handlers, return Allow metadata for unsupported methods, preserve safe and idempotent semantics, reject unknown method tokens cleanly, and keep authorization and validation consistent across method-specific handlers.Retrieves a representation without requesting a state change.
Create a GET endpoint that performs no state-changing work, validates query parameters, supports conditional requests and deliberate caching, returns a stable representation, handles missing resources clearly, and never depends on a request body.Submits data for processing or creates a subordinate resource.
Create a POST endpoint with schema and business validation, an explicit content type, idempotency support when retries are possible, transaction-safe processing, a 201 response with Location when a resource is created, and consistent validation and conflict errors.Creates or completely replaces the state of a resource at a known URI.
Create an idempotent PUT endpoint that validates a complete resource representation, defines create-versus-replace behavior, supports If-Match concurrency control, uses a transaction, and returns consistent 200, 201, 204, 404 and 412 outcomes without silently merging omitted fields.Applies a defined partial modification to an existing resource.
Create a PATCH endpoint with a documented patch media type, field-level validation, immutable-field protection, If-Match concurrency control, atomic application, clear no-op behavior, and a response that distinguishes malformed patches, conflicts and missing resources.Requests removal or deactivation of a resource.
Create an idempotent DELETE endpoint with explicit soft-versus-hard deletion semantics, authorization at the resource boundary, dependency and conflict checks, optional If-Match protection, an audit event, and a stable response when the resource is already absent.Returns the headers a GET would produce without transferring its body.
Implement HEAD with the same routing, authorization, validators, content type and content length semantics as GET while suppressing the response body. Avoid performing unnecessary body generation and test parity between GET headers and HEAD headers.Describes communication options supported by a target resource or server.
Implement OPTIONS responses with an accurate Allow header and deliberate CORS preflight handling. Validate requested methods and headers, scope allowed origins narrowly, set cache duration intentionally, avoid credentials with wildcard origins, and return no unnecessary body.A method intended only for retrieval or observation rather than requested state change.
Design GET, HEAD and OPTIONS handlers as safe methods: do not trigger business state changes, charges or destructive side effects; separate analytics from domain mutations; permit crawling and retries safely; and document any unavoidable incidental logging or cache warming.A method whose repeated identical requests have the same intended effect as one request.
Implement an idempotent state-changing endpoint with a stable resource target or idempotency key, atomic result storage, request fingerprint validation, concurrent duplicate handling, replay of the original outcome, bounded retention, and protection against key reuse with different payloads.Locates a resource using a scheme, authority, path, query, and optional fragment.
Build and parse URLs with a standards-aware URL library rather than string concatenation. Validate allowed schemes and hosts, encode path and query components separately, preserve Unicode safely, avoid credentials in URLs, prevent open redirects and SSRF, and use an explicit base URL.Identifies a resource by name, location, or both.
Design stable resource URIs that identify domain resources independently of implementation details. Use consistent nouns and encoding, document canonical forms, avoid leaking internal filenames or database keys, and distinguish identifiers from dereferenceable URLs when the system uses both.Maps an HTTP method and path pattern to a handler.
Define a route with one unambiguous path pattern, explicit supported methods, parameter constraints, middleware ordering and a named handler. Detect conflicts at startup, return 404 versus 405 correctly, and keep routing independent from business logic.Captures a dynamic value embedded in an endpoint path.
Create a route parameter for a resource identifier with explicit syntax and length constraints, one decoding pass, canonicalization rules, type-safe parsing, clear invalid-versus-missing responses, authorization after lookup, and no direct interpolation into file paths or queries.Supplies a named optional or repeatable value after the URL path.
Handle documented query parameters with explicit types, defaults, allowed repetition, length and range limits, unknown-parameter policy, consistent boolean and date formats, safe decoding, and validation errors that identify the parameter without echoing unsafe input.Encodes a sequence of query parameters following the question mark in a URL.
Parse and construct query strings with a standard encoder, preserving repeated keys and empty values deliberately. Apply total length and parameter-count limits, define array conventions, avoid logging secrets, reject ambiguous encodings, and produce a canonical order when signatures or cache keys depend on it.Carries request metadata such as accepted formats, conditions, and tracing context.
Read request headers case-insensitively through the server framework, enforce per-header and total-size limits, validate structured values, define trusted proxy boundaries, reject duplicates when ambiguity is dangerous, redact credentials from logs, and never treat client-supplied forwarding headers as trusted by default.Carries response metadata controlling interpretation, caching, security, and delivery.
Set response headers before committing the body, including an explicit content type, deliberate cache policy, security headers and correlation ID. Prevent header injection, avoid contradictory values, expose only required CORS headers, and keep representation metadata consistent with the actual body.Stores a small name-value value that a browser returns according to its scope and attributes.
Issue a narrowly scoped cookie with an explicit lifetime, Path, Domain only when necessary, Secure, HttpOnly and an appropriate SameSite value. Keep payloads opaque and minimal, rotate sensitive identifiers, support deletion with matching scope, and never store secrets or excessive personal data in readable cookies.Contains the representation or command data sent with a request.
Process a request body as a bounded stream with an allowed content type, decompression limits, schema validation, unknown-field policy, cancellation and safe parse errors. Avoid buffering unbounded payloads, reject trailing data when inappropriate, and never log the raw body by default.Contains the representation or result returned by the server.
Produce a schema-valid response body from an explicit response DTO, omitting internal and unauthorized fields. Match it to the status and content type, stream large output, encode dates and numbers consistently, handle serialization errors before headers commit, and avoid bodies for HEAD, 204 and 304 responses.Declares the media type and optional parameters of a message body.
Validate request Content-Type against an explicit allowlist before parsing and return 415 for unsupported media. Set the response Content-Type from the actual serializer, include charset where appropriate, prevent MIME sniffing, and never copy an untrusted header directly into the response.Lists response media types a client can process, optionally with preferences.
Parse the Accept header with media ranges, wildcards and quality weights, select only a supported representation, use a documented default when the header is absent, return 406 when none match, emit Vary when caches need it, and never mirror an untrusted Accept value into Content-Type.Selects a representation based on client preferences and server capabilities.
Implement deterministic content negotiation across the supported media types and languages. Respect quality weights, define stable defaults, return 406 when required, set the matching Content-Type and Vary headers, keep error formats consistent, and avoid multiplying cache variants without need.Returns structured data using the JSON media type.
Return a JSON response from an explicit schema or DTO using application/json, predictable property names, consistent null and date handling, finite numeric values, safe escaping, no secret fields, and a stable error shape. Stream or paginate output rather than constructing an unbounded object graph.Returns structured data using an XML media type and document model.
Return a well-formed XML response with an explicit media type and encoding, one documented namespace strategy, schema-valid element order, correct escaping and no secret fields. Disable unsafe external entity behavior in related parsing and stream large documents when practical.Submits key-value form fields using URL-encoded body syntax.
Handle application/x-www-form-urlencoded input with strict body and field-count limits, one decoding pass, explicit repeated-field rules, schema validation, CSRF protection when browser credentials are involved, secret redaction, and clear errors for malformed percent encoding.Transfers multiple body parts, commonly fields and uploaded files, in one request.
Process multipart form data as a stream with limits for total size, part count, headers and individual files. Generate safe server-side filenames, validate content independently of the claimed type, quarantine uploads until scanning completes, clean temporary files on every exit path, and reject malformed boundaries.Executes a request only when validators or modification dates satisfy its preconditions.
Implement conditional requests using strong or weak validators appropriate to the operation. Evaluate preconditions in protocol order, return 304 for cache validation or 412 for failed write preconditions, preserve headers required on those responses, and avoid computing expensive bodies when the condition fails.Identifies a specific version of a selected representation for caching or concurrency checks.
Generate stable ETags for representation versions, choose strong or weak validation deliberately, quote and compare tags correctly, vary them across materially different encodings, support If-None-Match cache validation and If-Match write protection, and avoid user-specific tracking identifiers.Reports when the selected representation was last changed at HTTP date precision.
Set Last-Modified from the actual representation modification time using a valid GMT HTTP date and second-level precision. Support If-Modified-Since as a secondary validator, keep dates monotonic where possible, and prefer ETags when timestamps cannot distinguish versions reliably.Allows an operation only when the current representation matches one of the supplied entity tags.
Protect an update or delete with If-Match using a strong current ETag. Evaluate the condition atomically with the write, return 412 when the representation changed, support the wildcard deliberately, provide the latest validator for recovery, and never silently overwrite newer data.Allows retrieval or modification only when the current representation does not match supplied entity tags.
Handle If-None-Match for GET and HEAD by returning 304 without a body when the selected representation matches. Support the wildcard for create-only writes when appropriate, evaluate it ahead of date validators, include required cache headers, and avoid regenerating the body on a match.Requests one or more byte ranges from a selected representation.
Implement byte range requests for seekable representations with Accept-Ranges, correct inclusive bounds, If-Range support, 206 responses and Content-Range metadata. Return 416 for unsatisfiable ranges, cap multi-range complexity, preserve authorization, and stream only the requested bytes.Returns a requested subset of a representation using status 206.
Return a correct 206 Partial Content response with Content-Range, Content-Length, validators and the requested media type. Support a single range first, define multipart behavior if multiple ranges are allowed, stream the exact byte interval, and fall back to 200 when Range is intentionally ignored.Instructs a client to use another URI through a 3xx response and Location header.
Create a redirect response with the correct permanent or temporary status and a validated Location value. Preserve or change the method intentionally, use relative redirects when suitable, prevent open redirects and header injection, document cache behavior, and avoid redirect loops.Encodes a response body to reduce transfer size when the client supports it.
Add response compression using Accept-Encoding negotiation, minimum-size and compressible-type rules, Content-Encoding and Vary headers, streaming-safe encoders, and correct ETag behavior. Skip already compressed media, HEAD, 204, 304 and range responses unless explicitly supported, and mitigate compression side channels for secrets.Transfers an HTTP/1.1 body as chunks when its final length is not known in advance.
Stream an HTTP/1.1 response whose size is not known in advance without setting Content-Length, letting the server manage chunk framing. Flush only at meaningful boundaries, propagate disconnects, avoid conflicting framing headers, reject request-smuggling ambiguities, and use protocol-native framing under HTTP/2 or HTTP/3.Sends response data incrementally instead of buffering the complete result.
Create a streaming HTTP response with an explicit media type and framing format, early header commitment only after validation, bounded buffering, backpressure, periodic meaningful flushes, client-disconnect cancellation, heartbeat only when needed, and a clear way to communicate terminal errors after streaming begins.Reuses a connection for multiple HTTP exchanges to reduce setup overhead.
Configure persistent HTTP connections with bounded idle and header timeouts, maximum request policies, graceful draining and correct connection-close behavior. Reuse outbound connections through a shared pool, consume or close response bodies correctly, and monitor saturation and stale connections.Communicates original client and request information across trusted proxies.
Process Forwarded or X-Forwarded headers only from explicitly trusted proxy addresses. Define the trusted hop count, normalize the client IP, scheme and host once, reject malformed values, preserve the raw peer address for audit, and prevent spoofing from direct clients.Determines the originating network address while accounting for trusted intermediaries.
Resolve the client IP from the direct peer and a configured chain of trusted proxies, not from arbitrary headers. Support IPv4 and IPv6, normalize mapped addresses, retain the proxy chain for audit, avoid using IP as identity, document privacy retention, and fail safely when the chain is ambiguous.Limits how long request processing may occupy server and dependency resources.
Apply a request deadline that covers parsing, handler work and dependent calls while allowing endpoint-specific budgets. Propagate the remaining deadline, cancel work promptly, distinguish client and upstream timeouts, return a consistent timeout response when headers are uncommitted, and record the timed-out stage without logging sensitive input.Stops unnecessary work when a client disconnects or the request context is cancelled.
Propagate request cancellation through handlers, database calls, outbound HTTP calls, streams and background coordination. Stop optional work promptly, make cleanup idempotent, preserve transaction integrity, avoid treating expected disconnects as server faults, and never continue sending after the response channel closes.