Blog

The fastest request is the one the browser never sends. How Cache-Control, max-age, ETags and 304 responses decide when a cached copy can be reused, and the content-hash pattern that lets you cache forever without ever serving stale files.

An API is a menu of requests one program agrees to answer for another. What that means on the web, how REST maps resources to URLs and actions to HTTP methods, what JSON looks like, and how to call an API from JavaScript.

HTTP forgets you after every request, yet you stay logged in for weeks. How Set-Cookie and session IDs work, what HttpOnly, Secure and SameSite protect against, and how sessions compare with tokens like JWTs.

“Blocked by CORS policy” is the most common error in front-end development, and the most misunderstood. What the same-origin policy protects, what a preflight is, and why the fix always lives on the server you're calling.

Every page load, image, form and API call is the same exchange: a request with a method, path and headers, and a response with a status code, headers and a body. A plain-language tour of what's inside each one.

No single server knows every domain. How resolvers walk from the root to the .com servers to a domain's own nameservers, what A, CNAME and MX records are, and why TTLs decide how fast a DNS change takes effect.

Two strangers on an open network agree on a secret key that eavesdroppers can't learn, and one proves its identity to the other. What the TLS handshake does, what certificates prove, and what HTTPS does and doesn't hide.

The classic question, answered step by step: URL parsing, DNS, TCP, TLS, HTTP, and rendering. A map of the whole trip, with links to a deeper post for each stop.