# Browser concerns
# HTTPS and protocol versions
HTTPS is HTTP protected by TLS. TLS encrypts traffic and authenticates the server through certificates; it does not make an unsafe application design safe. HTTP/1.1 commonly uses one request stream per connection, HTTP/2 multiplexes streams over a connection, and HTTP/3 uses QUIC over UDP; application code usually talks to all of them through the same Fetch/browser APIs.
# Cookies and caching
Cookies are small values a browser sends to matching servers, often for sessions or preferences. They are sent automatically, so secure applications must consider scope, Secure, HttpOnly, and SameSite attributes. Caches reuse responses when their headers permit it, while validators such as ETag allow a server to answer 304 Not Modified without sending the full body again.
# CORS
The browser’s same-origin policy restricts scripts from reading responses from another origin. Cross-Origin Resource Sharing (CORS) lets a server explicitly allow selected origins and methods through response headers. CORS is enforced by browsers; it is not a replacement for authentication or server-side authorization.
# DevTools exercise
- Open any HTTP-served page (not a
file://URL) in a browser. - In Network, reload and inspect the document request.
- Record its method, URL, status, request headers, response headers, size, and timing.
- Submit the form from the forms and accessibility lesson and compare its method, URL, payload, and response.
- For a REST request, identify the resource, representation, status code, and whether the request changed server state.