HTTP frames

Chunked responses were also supported

GET if to obtain information. There should not be any "body" data sent with that request. This will not trigger error, but we just simply don't look there in GET request. Only query string parameters ale allowed. This request will never change anything, you can call it as many times as you want. It is called that GET is IDEMPOTENT request. POST is to add new or modify existing information. If request url doesn't contain resource ID then we will treat that as new data that must be inserted. If you want to modify existing data you need to specify an ID in the Rrequest URL (like POST /contacts/hg5fF). POST is NOT IDEMPOTENT, you need to be carefull to not send the same request twice... DELETE is only to remove infomration. As a general rule we do not allow to add any "body" data to that type of request nor we allow any query string. This should be just simply DELETE /contacts/hg5fF.

Conceptually, OHTTP is a simple protocol: end-to-end encrypted requests and responses are forwarded between client and server through a relay, decoupling who from what was sent

HTTP header examples with Curl

四连问：API 接口应该如何设计？如何保证安全？如何签名？如何防重？

我终于决定要放弃 okhttp、httpClient，选择了这个牛逼的神仙工具！贼爽

form-data方式提交对象数组，java后台解析为对象集合

http-decision-diagram

Java中提高密码的安全性（禁止直接使用String），Spring Boot中有哪些现实的方案？

既然有 HTTP 请求，为什么还要用 RPC 调用？

HTTPS 要比 HTTP 多用多少服务器资源？

如何理解 restful 中操作的无状态 “stateless”?

如何获取https页的referrer？

简单聊一聊Cookie、Session、Token、JWT的区别和作用

基于 HTTP 连接下 token 安全问题？

怎样正确做 Web 应用的压力测试？

合并 HTTP 请求是否真的有意义？

http中的payload怎么理解？

HTTP 协议中 URI 和 URL 有什么区别？

COOKIE和SESSION有什么区别？

你怎么用最通俗的话解释AJAX是什么东西？

But anti- spam software often fetches all resources in mail header fields automatically, without any action by the user, and there is no mechanical way for a sender to tell whether a request was made automatically by anti-spam software or manually requested by a user. To prevent accidental unsubscriptions, senders return landing pages with a confirmation step to finish the unsubscribe request. A live user would recognize and act on this confirmation step, but an automated system would not. That makes the unsubscription process more complex than a single click.

The mail sender MUST NOT return an HTTPS redirect, since redirected POST actions have historically not worked reliably, and many browsers have turned redirected HTTP POSTs into GETs.

This document describes a method for signaling a one-click function for the List-Unsubscribe email header field. The need for this arises out of the actuality that mail software sometimes fetches URLs in mail header fields, and thereby accidentally triggers unsubscriptions in the case of the List-Unsubscribe header field.

PostBin, a simple web service for testing and logging of the receival of WebHooks (HTTP POST requests).

Hypothesis REST API

How do REST APIs work? REST, or “representational state transfer,” is a type of software design that gives access to data (aka “web resources”) by using a uniform and predefined set of operations. The payload - the data to be delivered - defined in the request itself, will be formatted in a language such as HTML, JSON, or XML. The set of operations are the methods available to HTTP, which is the underlying protocol for how browsers retrieve websites from servers. These methods include GET, POST, PUT, DELETE, and others.

REST APIs If you’ve heard people talk about JSON (javascript object notation), chances are they’re talking about REST APIs. Over 70% of all public APIs use REST, because of its fast performance, reliability, and ability to scale by reusing modular components without affecting the system as a whole.

Communication with this endpoint consists of JSON-encoded messages sent from client to server and vice versa.

Para solicitar a primeira API, crie um URL que aponte para o “endpoint” da API com a qual deseja se comunicar e passe o URL à ação “Obter Conteúdo do URL”. Quando o atalho é executado, essa ação faz a solicitação de API.

400 Bad Request is the status code to return when the form of the client request is not as the API expects.401 Unauthorized is the status code to return when the client provides no credentials or invalid credentials.403 Forbidden is the status code to return when a client has valid credentials but not enough privileges to perform an action on a resource.

The server possibly can send back a 406 (Not Acceptable) error code when unable to serve content in a matching language. However, such a behavior is rarely implemented for a better user experience, and servers often ignore the Accept-Language header in such cases.

The “work around” was to detect users in an IAB and display a message on first navigation attempt to prompt them to click the “open in browser” button early.