Posts tagged "web"

CSP is the most powerful XSS defense most sites either don't use or deploy wrong. Here's what it actually stops, what it doesn't, and how to ship a working policy without breaking everything.

HTTP caching is one of the most powerful and most misunderstood web performance tools. Getting Cache-Control right can eliminate most of your server's traffic for static assets.

CSS specificity is the invisible rule that decides which style wins when two selectors target the same element. Understanding it lets you debug style conflicts without resorting to !important.

CSS sprites were the standard performance technique for reducing icon HTTP requests in the HTTP/1.1 era. With HTTP/2 and SVG, the calculus has changed — but understanding sprites is still valuable.

SVG is the only image format that is also code — you can write it by hand, animate it with CSS, and scale it to any size without quality loss. Here is what every web developer should know about it.

Your server already compresses responses with gzip or Brotli — but do you know what those algorithms actually do? Understanding compression helps you optimize assets and set correct headers.

You type a domain and a page loads — but between those two events is a surprisingly elegant distributed lookup system. Here is exactly what happens at each step.

HTTP headers carry critical information about authentication, caching, content type, and security — yet many developers only interact with them when something goes wrong. This reference covers the most important ones.

CORS errors block your frontend from talking to your own API — and the fix is not to disable it. Understanding why browsers enforce the same-origin policy makes the solution obvious.

A space in a URL becomes %20, a plus sign becomes %2B — but not always, and the rules differ depending on where in a URL you are. This post explains the why and the how of percent-encoding.

Base64 shows up everywhere from JWTs to CSS data URIs to HTTP Basic Auth — but it is often misunderstood. Here is a clear explanation of what it actually does and when it makes sense to reach for it.

Is that a 401 or a 403? A 404 or a 410? HTTP status codes have precise meanings that most developers only half-remember. Here is the definitive guide with practical guidance on when to use each.