Web protocols & security

The client sends Authorization: Basic <base64 of userid:password>, recomputed on every request. Base64 is reversible encoding, not encryption or hashing — anyone who captures the header decodes the password instantly, so only TLS provides confidentiality.

Send Authorization: Bearer <token> on each request, over TLS. 'Bearer' means possession alone proves authorization: the request carries no proof of who is holding it, so whoever copies the token can use it exactly like the legitimate client.

The server refuses with 401 and a WWW-Authenticate header naming an authentication scheme, usually plus a realm. The client gets credentials for that scheme and retries the same request with an Authorization header. HTTP is stateless, so the header repeats on every later request.

no-store means never write this to any cache. no-cache means you may store it but must check with the origin before every reuse. must-revalidate means you may serve it freely while fresh, but once it expires you must revalidate rather than serve it stale. Use no-store for secrets, no-cache for always-current data, must-revalidate when stale answers are unacceptable.

A stored response is fresh while its age is below its freshness lifetime; it can be reused with no network trip. Once age exceeds that lifetime it is stale — which does not mean deleted. The cache normally revalidates with the origin, and a successful check makes the copy usable again with a reset clock.

Strict-Transport-Security tells a browser to rewrite every later request for that host to https before the request leaves the machine, for max-age seconds. The browser learns the policy only from a response, so the first plaintext request stays unprotected.

The script is blockable mixed content, so the browser fails that request as a network error. The image falls in the narrow upgradeable category, so the browser rewrites its URL to https and fetches it instead of blocking it.

It sets the no-sniff flag, so the browser takes the declared Content-Type as the computed type instead of guessing one from the response bytes. nosniff is the only defined value, matched without regard to ASCII case.

Referrer-Policy is a response header that tells a conforming browser how much of the current page's URL to put in the Referer request header on outgoing requests. Username, password and fragment are removed in every case.

The Strict-Transport-Security max-age directive is a required delta-seconds value counting from the moment the browser received the header; it is how long that host stays a Known HSTS Host. max-age=0 tells the browser to drop the stored entry.

Certificate carries the chain as a certificate_list of CertificateEntry structures. CertificateVerify carries a signature over the handshake transcript, made with the private key of the first certificate in that list. The chain alone proves nothing.

A TLS 1.2 suite name lists four choices in fixed order: the key exchange, the algorithm that authenticates the server, the bulk cipher with its key size and mode, and the hash used for the record MAC or the pseudorandom function.

TLS assumes an ordered, reliable byte stream: drop or reorder one record and decryption fails, and a lost handshake message stalls forever. DTLS puts that back into the protocol itself with explicit per-record numbering, fragmented handshake messages and its own retransmission timer.

A completed TLS 1.3 handshake has fixed one protocol version and one cipher suite, derived shared traffic keys, established the server's identity by signature, selected an application protocol, and confirmed both peers saw an identical message transcript.

The key_share extension carries ephemeral Diffie-Hellman public values the client generated, one per named group it guessed the server would accept. The ServerHello returns exactly one such value, for the group the server chose.

An ACME order for a DNS name becomes one authorization per identifier; the client completes one challenge in each, the server validates it, then the client posts a certification request to the order's finalize URL and downloads the chain.

Publicly trusted certificates are recorded in public append-only Certificate Transparency logs before clients will accept them, so a monitor watching your portal's DNS names reports any certificate issued for them, including one your team never asked for.

A PKCS#10 certification request carries the subject name being asked for, the public key and any requested extensions, all self-signed with the matching private key. The private key is not sent to the authority.

Only the private key matters. An end-entity certificate is handed to every client that connects, so publishing it costs essentially nothing; the private key is the one secret that proves a server is entitled to use that certificate.

Nothing in the certificate changed: the same bytes, the same issuer signature, the same notBefore and notAfter. The issuer publishes the withdrawal separately, as a signed revocation list or a signed responder answer, and a verifier learns of it only by fetching one.

A failed CORS check replaces the server's response with a network error before script sees it - type "error", status 0, an empty header list, a null body - so the call rejects with a bare TypeError that carries no protocol detail at all.

A CORS-preflight request: method OPTIONS, the calling page's Origin, Access-Control-Request-Method naming the method the real call will use, Access-Control-Request-Headers listing any CORS-unsafe request-header names, and Accept: /. It carries no body.

Access-Control-Expose-Headers, sent by the server on that response, names the extra fields script may read. Without it a cross-origin caller sees only seven names: Cache-Control, Content-Language, Content-Length, Content-Type, Expires, Last-Modified and Pragma.

The Origin request header carries only scheme, host and a non-default port: https://board.example.org. The path, the query, the fragment and any trailing slash are absent, and scheme and host are ASCII-lower-cased.

default-src supplies the source list for any fetch directive absent from the policy. A directive you do write takes nothing from it - the written list replaces the default wholly for that resource type, and an empty list blocks everything.