HTTP.protocol.txt

        
   HTTP  
        


STANDARDS ==>                     #RFCs mostly (see below)

GOAL ==>                          #Application-layer adding CRUD actions on [linked] generic whole resources:
                                  #  - whole: as opposed to parts of resources
                                  #  - generic: rich generic semantics with no assumption of type|format|purpose
                                  #  - linked:
                                  #     - good support for links between resources
                                  #     - hence good for documents
                                  #     - generic semantics reduce probability of broken links
                                  #Oriented:
                                  #  - more towards consumption: client-server, proxies-friendly
                                  #  - than interaction: concurrency|realtime
                                  #Properties:
                                  #  - good efficiency
                                  #  - poor security, rely on TLS instead
                                  #On TCP/IP
                                  #Wide support:
                                  #  - so is used for other purpose like tunneling

SUMMARY ==>                       #Protocol/format:
                                  #  protocols/versions       application layer, TCP/IP, versioning, switching protocols,
                                  #                           tunneling, extensions
                                  #  syntax                   HTTP/1.* (text-based), HTTP/2 (binary-based (frames) with
                                  #                           streams), syntax error, exit, charset, case, headers syntax
                                  #  body formatting          body length hint, unknown (streaming), encoding
                                  #Errors:
                                  #  general                  error codes, types, response body
                                  #  specific                 limits, validation, financial, legal
                                  #Content:
                                  #  semantics                status codes, methods (allowed, safety),
                                  #                           CRUD (GET, HEAD, POST, PUT, PATCH, DELETE)
                                  #  content processing       transformations, preferences, expectations
                                  #  content negotation       types (MIME, charset, language, compression, delta encoding,
                                  #                           features, objectionable, datetime), proactive vs reactive
                                  #  links                    URI scheme, redirects (client-side, server-side, alternative
                                  #                           services), wrong location, body location, semantic links, source maps
                                  #State/context
                                  #  session                  1 multiplexed TCP socket, PING, cookies
                                  #  tracking                 referer, negotiation (DNT [C])
                                  #  logging                  timestamp, response time
                                  #  software identification
                                  #Communication:
                                  #  browser                  HTTP requests, rendering
                                  #  client-server, proxies   proxy chain info, transformations, caching, authentication,
                                  #                           errors
                                  #  concurrency              conflicts, preconditions, method idempotency, realtime
                                  #Security:
                                  #  security                 TLS, authentication (cookies, basic|digest, headers|body|query),
                                  #                           integrity
                                  #Efficiency:
                                  #  caching                  client vs server, history, unconditional caching,
                                  #                           conditional caching, no caching, delta encoding
                                  #  prefetching              server push, resource hints
                                  #  body size                compression, big body (streaming, byte serving),
                                  #                           partial|empty body
                                  #  tasks                    async, stream prioritization
                                  #  performance errors       load, timeout
                                  #Development:
                                  #  documentation            OPTIONS
                                  #  debugging                TRACE



                   
   PROTOCOL/FORMAT  
                   


                                             /=+===============================+=\
                                            /  :                               :  \
                                            )==:      PROTOCOLS/VERSIONS       :==(
                                            \  :_______________________________:  /
                                             \=+===============================+=/


LAYERS ==>                        #  - application layer
                                  #  - usually on top of TCP/IP
                                  #     - TCP ports: 80 (HTTP), 443 (HTTPS)

VERSIONING ==>                    #Current:
                                  #  - 2
                                  #  - previous: 1.1, 1.0
                                  #To guess support, can use:
                                  #  - ALPN, TLS extension (see SSL/TLS doc)
                                  #  - Upgrade: h2[c] [C|S] (see switching protocols)
                                  #     - h2 is HTTS, h2c HTTPS
                                  #     - must include SETTINGS frame as HTTP2-Settings [C] (base64-encoded)
                                  #     - not supported by most browsers
                                  #     - can Upgrade to but not from HTTP/2
                                  #  - prior knowledge: client already knows server supports HTTP/2
                                  #Wrong version:
                                  #  - 505 (HTTP Version Not Supported)
                                  #  - (HTTP/2) HTTP_1_1_ERROR (0xd) error code: ask to downgrade to HTTP/1.1

SWITCHING PROTOCOLS ==>           #Starting a session in HTTP then continuing in another protocol:
                                  #How:
                                  #  - client:
                                  #     - Upgrade: PROTOCOL[/VERSION],... [C]: requested ones
                                  #     - Connection: Upgrade [C]
                                  #  - server (success):
                                  #     - 101 (Switching Protocols)
                                  #     - Upgrade: PROTOCOL[/VERSION],... [S]: picked ones
                                  #     - Connection: Upgrade [S]
                                  #     - no response body
                                  #  - server (missing Upgrade [C])
                                  #     - 426 (Upgrade Required)
                                  #Upgrade [C] allowed with HTTP/1.1 -> HTTP/2, but not with HTTP/2 -> *

TUNNELING ==>                     #Goal:
                                  #  - wrapping another protocol packets in HTTP
                                  #  - either:
                                  #     - proxy and endpoints wraps|unwraps request|response
                                  #     - initial setup is done with HTTP, then proxy forwards the other protocol
                                  #Advantages:
                                  #  - compatibility with existing software, including firewalls
                                  #  - with HTTPS, can completely hide the other protocol packet
                                  #    (including which protocol it is)
                                  #  - can use HTTP features, e.g. caching
                                  #Problems:
                                  #  - adds HTTP features that might not be needed -> complexity
                                  #  - slower
                                  #Should register|use different:
                                  #  - URI scheme or HTTP methods: if very different from HTTP usual behavior
                                  #  - port: if separate from HTTP server (different goal|traffic|data)
                                  #  - status codes: never, should instead reuse existing ones and make sure it
                                  #    matches behavior:
                                  #     - because proxies will behave according to status code (e.g. for caching)
                                  #     - if nothing matches, use general ones like 200 or 500
                                  #How:
                                  #  - CONNECT:
                                  #     - how:
                                  #        - client:
                                  #           - HTTP method CONNECT (unsafe non-idempotent)
                                  #           - URI: ORIGIN only
                                  #           - no request body
                                  #        - server:
                                  #           - 2**
                                  #           - (HTTP/2) can use CONNECT_ERROR (0xa) error code
                                  #        - then server will forward the TCP connection used by HTTP request
                                  #           - it will only forward without interpreting, i.e. can be any TCP-based protocol,
                                  #             including HTTP
                                  #     - intented for forward proxies
                                  #     - use cases:
                                  #        - using HTTPS end-to-end, i.e. proxy forwards SSL packets without needing to
                                  #          decrypt/re-encrypt them
                                  #        - any other HTTP tunneling case
                                  #     - allow client to do any TCP request, which can be security concern:
                                  #        - should restrict to specific use case by whitelisting ORIGIN and|or PORT

EXTENSIONS ==>                    #  - new headers
                                  #  - HTTP/2:
                                  #     - new frame type
                                  #     - new SETTINGS_*
                                  #     - new *_ERROR
                                  #  - should prefix with X-*
                                  #  - if unavailable:
                                  #     - HTTP extensions: 510 (Not Extended)
                                  #     - feature: 501 (Not Implemented)


                                             /=+===============================+=\
                                            /  :                               :  \
                                            )==:            SYNTAX             :==(
                                            \  :_______________________________:  /
                                             \=+===============================+=/


HTTP/1.* ==>                      #Newline is CRLF
                                  #Request:
                                  #  METHOD URI HTTP/1.*
                                  #  HEADER: VAL          (Host [C] mandatory)
                                  #  ...
                                  #
                                  #  [BODY]
                                  #Response:
                                  #  HTTP/1.* STATUS_NUM STATUS_STR
                                  #  [HEADER: VAL
                                  #  ...]
                                  #
                                  #  [BODY]

HTTP/2 ==>                        #Stream: one request+response, or server push:
                                  #  - several ordered frames connected by stream ID
                                  #  - is what makes multiplexing possible
                                  #  - stream ID:
                                  #     - 0: hypothetical main stream
                                  #     - odd is started by client, even by server
                                  #     - incremental ID
                                  #Frames:
                                  #  - headers: length [0-2], type [3], flags [4], reserved [5.0], stream ID [5.1-8],
                                  #    payload [*]
                                  #  - payload:
                                  #     - DATA (0x0): [padding length [0], ]data [*][, padding [*]]
                                  #     - HEADERS (0x1): [padding length [0], ][exclusive [1.0], stream parent ID [1.1-4],
                                  #       weight [5]], headers [*][, padding [*]]
                                  #     - PRIORITY (0x2): exclusive [0.0], stream parent ID [0.1-3], weight [4]
                                  #     - RST_STREAM (0x3): error code [0-3]
                                  #     - SETTINGS (0x4): several times: VAR [0-1], VAL [2-5]
                                  #     - PUSH_PROMISE (0x5): [padding length [0], ]reserved [1.0], promise stream ID [1.1-4],
                                  #       headers [*][, padding [*]]
                                  #     - PING (0x6): data [0-7]
                                  #     - GOAWAY (0x7): reserved [0.0], last stream ID [0.1-3], error code [4-7],
                                  #       debug data [*]
                                  #     - WINDOW_UPDATE (0x8): reserved [0.0], increment [0.1-3]
                                  #     - CONTINUATION (0x9): headers [*]
                                  #  - flags:
                                  #     - END_STREAM (0x1) (DATA, HEADERS)
                                  #     - ACK (0x1) (SETTINGS, PING)
                                  #     - END_HEADERS (0x4) (HEADERS, PUSH_PROMISE, CONTINUATION)
                                  #     - PADDED (0x8) (DATA, HEADERS, PUSH_PROMISE)
                                  #     - PRIORITY (0x20) (HEADERS)
                                  #Init (for each endpoint):
                                  #  - start:
                                  #      PRI * HTTP/2.0
                                  #
                                  #      SM
                                  #
                                  #  - SETTINGS frame:
                                  #     - options, noted SETTINGS_*
                                  #     - receiver must respond with empty SETTINGS frame with ACK flag
                                  #     - can be sent again later to change settings
                                  #Normal (request|response) stream:
                                  #  - request:
                                  #     - 1 HEADERS, 0-n DATA (body), 0-1 trailing HEADERS
                                  #     - HEADERS:
                                  #        - must contain pseudo-headers:
                                  #            :method METHOD [C]
                                  #            :authority URI [C]
                                  #            :path PATH [C] : can be *
                                  #            :scheme PROTOCOL [C]
                                  #        - if 1 frame not enough, send extra CONTINUATION frames with extra headers
                                  #        - last frame should have flag END_HEADERS
                                  #  - response:
                                  #     - same but HEADERS must contain instead pseudo-header :status UINT [S]
                                  #End:
                                  #  - END_STREAM flag:
                                  #     - normal stream end
                                  #     - on last DATA frame (or last HEADERS if none) for each endpoint
                                  #     - might be followed by CONTINUATION frames
                                  #  - RST_STREAM frame:
                                  #     - cancels current stream
                                  #  - GOAWAY frame:
                                  #     - end of session , i.e. stops any new stream
                                  #     - keep processing existing streams
                                  #     - contains last stream ID that will be processed
                                  #     - can contain arbitrary debug info
                                  #     - should respond with another GOAWAY

SYNTAX ERROR ==>                  #Request:
                                  #  - HTTP method: 405 (see HTTP methods)
                                  #  - any: 400 (Bad Request)
                                  #Response:
                                  #  - 500 (Internal Server Error)
                                  #Request|response (HTTP/2 error codes):
                                  #  - PROTOCOL_ERROR (0x1): e.g. wrong frame order or content
                                  #  - COMPRESSION_ERROR (0x9): HPACK error
                                  #  - INTERNAL_ERROR (0x2): protocol-related generic error

EXIT ==>                          #Cancel stream (HTTP/2 error codes):
                                  #  - REFUSED_STREAM (0x7): stream refused
                                  #  - CANCEL (0x8): stream no longer needed
                                  #Normal exit (HTTP/2 error codes):
                                  #  - STREAM_CLOSED (0x5)
                                  #  - NO_ERROR (0x0)

CHARSET ==>                       #  - ASCII
                                  #  - headers:
                                  #     - unescaped:
                                  #        - [:alnum:] ! # $ % & ' * + - . ^ _ ` | ~
                                  #     - escaped with "..." or (...):
                                  #        - [:print:] TAB
                                  #        - in values only
                                  #        - \" or \( or \) to escape delimiters inside
                                  #     - escaped with URI encoding (UTF-8):
                                  #        - only for VAL in ;VAR=VAL
                                  #           - must be written VAR*=UTF-8'[LANG]'VAL
                                  #           - VAR must escape % ' *
                                  #           - UTF-8|LANG are case insensitive
                                  #        - can use both VAR*= and VAR= (as fallback)
                                  #        - for VAL that needs to human-readable, should be avoided otherwise
                                  #        - browser support is only for specific headers now:
                                  #           - Content-Disposition [S] filename
                                  #           - Link [S] title (partial support)
                                  #  - escaping of body depends on MIME type

CASE ==>                          #HTTP methods: uppercase
                                  #Headers:
                                  #  - name: case insensitive. Capitalized often used
                                  #  - value: depends on header, but many define it as case insensitive when value is token

HEADERS ==>                       #  - order is not significant
                                  #  - no duplicates, except Set-Cookie [S]. Should use commas for multiple header values
                                  #  - should use (...) for comments inside values
                                  #  - written [C|S] for server|client in my doc
                                  #  - binary compressed (HTTP/2)
                                  #     - algo is 'HPACK'
                                  #     - common HEADER or HEADER: VAL have predefined numbers
                                  #     - each endpoint caches HEADER: VAL in a dynamic table
                                  #  - :HEADER are called pseudo-headers:
                                  #     - same as headers but with extra restrictions on when can be used (HTTP/2)
                                  #  - <meta http-equiv="HEADER" content="VAL">:
                                  #     - add HTTP header client-side
                                  #     - only ones that are crossbrowser: refresh, Content-Security-Policy, set-cookie
                                  #  - <meta name="HEADER" content="VAL">:
                                  #     - add HTTP header client-side
                                  #     - only ones that are crossbrowser: referrer (Referrer-Policy [S])


                                             /=+===============================+=\
                                            /  :                               :  \
                                            )==:        BODY FORMATTING        :==(
                                            \  :_______________________________:  /
                                             \=+===============================+=/


BODY LENGTH HINT ==>              #Content-Length: NUM [C|S]:
                                  #  - request|response body length ('entity', not 'instance')
                                  #  - presence:
                                  #     - mandatory if body present
                                  #     - forbidden with chunked transfer encoding
                                  #     - can use 411 (Length Required)
                                  #  - only hint to help allocating resources or download progress:
                                  #     - not substitute for reading actual body length

BODY UNKNOWN LENGTH ==>           #(HTTP/2)
                                  #  - not sending END_STREAM flag
                                  #  - use trailer HEADER frame for headers that are based on body, when body is not known
                                  #    in advance
                                  #     - TE: trailers [C] can be used
                                  #(HTTP/1.1)
                                  #Chunked transfer encoding:
                                  #  - send request|response body in several times
                                  #  - how:
                                  #     - TE: WORD[;q=NUM],... [C]:
                                  #        - optional
                                  #        - indicates preference for WORD:
                                  #           - trailers: Trailer [S]
                                  #           - other WORD: Transfer-Encoding: WORD [S]
                                  #        - q=NUM: like content negotiation
                                  #     - Transfer-Encoding: chunked [C|S]:
                                  #        - sent with each chunk:
                                  #           - first line is SIZE_HEX_NUM[;VAR=VAL;...]
                                  #           - rest is data
                                  #        - empty chunk indicates end
                                  #     - Trailer: HEADER [S]
                                  #        - optional
                                  #        - unless HEADER is not important (client can use body without it),
                                  #          only if TE: trailers [C]
                                  #        - HEADER is limited, e.g. cannot be related to:
                                  #           - message processing: Transfer-Encoding, Content-Length
                                  #           - content processing: Content-Encoding, Content-Type, Content-Range, Trailer
                                  #           - routing: Host, :authority
                                  #           - authentication
                                  #           - response control: Cache-Control, Expires, Date, Location, Retry-After, Vary,
                                  #             Warning
                                  #           - request modifiers: Range, Max-Forwards
                                  #  - applied after any transformation (compression, range, delta encoding)
                                  #     - should use compression

BODY ENCODING ==>                 #Often used:
text/plain                        #STR. For OBJ:
                                  #  - VAR=VAL, newline-separated
application/x-www-form-urlencoded #STR. For OBJ:
                                  #  - VAR=VAL:
                                  #     - &-separated
                                  #     - URI-encoded anything but [:alnum:] * , - _
                                  #     - space converted to + instead of %20
                                  #  - for nesting, can use VAR[VAR2]=VAL, but must be supported by server
                                  #    (e.g. Express BODY-PARSER)
                                  #Legacy (used by <form>). Should prefer others like application/json
multipart/form-data; boundary=STR #Binary|big STR, e.g. file upload:
                                  #    --DELIM
                                  #    Content-Disposition: form-data; name="VAR"[; filename="FILE"]
                                  #    [Content-Type: TYPE]
                                  #    [Other headers]
                                  #
                                  #    content as is
                                  #    --DELIM
                                  #    ... (another file)
                                  #    --DELIM--
                                  #DELIM:
                                  #  - should be long enough and random
                                  #  - can include a graphical line with "------" for humans reading the request.
                                  #Must user CRLF newlines
multipart/related; boundary=STR   #Like multipart/form-data except each part is not individual, i.e. needs to be put together
 ; type="MIME"                    #with other parts to make sense.
 [; start="CONTENT_ID"]           #Differences:
 [; start-info="STR|CONTENT_ID2"] #  - each part:
                                  #     - must use Content-Id: "CONTENT_ID" (part identifier)
                                  #  - root part:
                                  #     - must be Content-Id: "CONTENT_ID" (def: first part)
                                  #     - must be Content-Type: "MIME" (from ;type)
                                  #     - can have metadata from ;start-info
                                  #  - Content-Disposition is optional
application/json                  #JSON
application/xml                   #XML
application/octet-stream          #Binary



          
   ERRORS  
          



                                             /=+===============================+=\
                                            /  :                               :  \
                                            )==:            GENERAL            :==(
                                            \  :_______________________________:  /
                                             \=+===============================+=/


ERROR CODES ==>                   #Contained in GOAWAY|RST_FRAME frame (HTTP/2)
                                  #Types:
                                  #  - NO_ERROR (0x0)
                                  #  - PROTOCOL_ERROR (0x1): e.g. wrong frame order or content
                                  #  - INTERNAL_ERROR (0x2)
                                  #  - FLOW_CONTROL_ERROR (0x3): too much buffered DATA because of flow control
                                  #  - SETTINGS_TIMEOUT (0x4): SETTINGS timeout
                                  #  - STREAM_CLOSED (0x5)
                                  #  - FRAME_SIZE_ERROR (0x6): frame too small|big
                                  #  - REFUSED_STREAM (0x7):
                                  #     - sender notifies receiver that request has not been processed, allowing safe retry.
                                  #     - e.g. too many concurrent streams or refused server push
                                  #  - CANCEL (0x8): stream no longer needed or server push refused
                                  #  - COMPRESSION_ERROR (0x9)
                                  #  - CONNECT_ERROR (0xa): when using CONNECT method
                                  #  - ENHANCE_YOUR_CALM (0xb): throttling, e.g. too many server pushes
                                  #  - INADEQUATE_SECURITY (0xc): does not use TLS or wrong TLS setup
                                  #  - HTTP_1_1_ERROR (0xd): should downgrade to HTTP/1.1

TYPES ==>                         #  syntax            405, 400, 500,                          See syntax errors
                                  #                    PROTOCOL|COMPRESSION|INTERNAL_ERROR
                                  #  size              414, 431, 413                           See limits
                                  #  not implemented   501, 510, 505                           See extensions, versioning
                                  #  (server)
                                  #  validation        415, 406                                See validation
                                  #  location          404, 410                                See wrong location
                                  #  proxies           502, 504, Warning [S]                   See proxies
                                  #  concurrency       409                                     See concurrency
                                  #  authentication    401|407, 403, 419, 511                  See authentication
                                  #  financial         402                                     See financial
                                  #  legal             451                                     See legal

ERROR RESPONSE BODY ==>           #5** should include response body with error information
                                  #Can be a "problem detail" (see REST doc)


                                             /=+===============================+=\
                                            /  :                               :  \
                                            )==:            LIMITS             :==(
                                            \  :_______________________________:  /
                                             \=+===============================+=/


LIMITS ==>                        #Streams:
                                  #  (HTTP/2)
                                  #  - SETTINGS_MAX_CONCURRENT_STREAMS (0x3) (def: unlim)
                                  #Frames:
                                  #  (HTTP/2)
                                  #  - SETTINGS_MAX_FRAME_SIZE (0x5) (def/min: 16KB, max: 16MB)
                                  #     - can use FRAME_SIZE_ERROR (0x6) error code
                                  #URI:
                                  #  - 414 (Request URI Too Long)
                                  #Headers:
                                  #  - 431 (Request Header Fields Too Large)
                                  #  - implementation has additional limits, e.g. Apache limits 8MB/header and 1000 headers,
                                  #    Node.js 80KB/header
                                  #  (HTTP/2)
                                  #  - SETTINGS_MAX_HEADER_LIST_SIZE (0x6) (def: unlim):
                                  #     - max HEADERS frame size, uncompressed, with extra 32 bytes per header.
                                  #     - not mandatory to respect it.
                                  #  - SETTINGS_HEADER_TABLE_SIZE (0x1) (def: 4KB): headers dynamic table size
                                  #Body:
                                  #  - 413 (Request Entity Too Large)
                                  #  (HTTP/2)
                                  #  - max receiver buffer (flow control) for DATA frames:
                                  #     - counter SETTINGS_INITIAL_WINDOW_SIZE (0x4) bytes (def: 64KB, max: 2GB):
                                  #        - decreased when sender sends
                                  #        - increased when receiver sends WINDOW_UPDATE frame:
                                  #           - includes how much to increase
                                  #           - e.g. when receiver consumed (i.e. received and do not buffer anymore)
                                  #        - if exhausted, each endpoint should terminate stream with FLOW_CONTROL_ERROR (0x3)
                                  #          error code
                                  #        - should amount to how much receiver can buffer
                                  #     - can be for a stream, or whole connection (if stream ID is 0)


                                             /=+===============================+=\
                                            /  :                               :  \
                                            )==:          VALIDATION           :==(
                                            \  :_______________________________:  /
                                             \=+===============================+=/


VALIDATION ==>                    #Missing headers:
                                  #  - 411 (Length Required): Content-Length [C]
                                  #  - 426 (Upgrade Required): Upgrade [C]
                                  #  - 428 (Precondition Required): If-* [C]
                                  #Body:
                                  #  - 415 (Unsupported Media Type): wrong request body MIME_TYPE
                                  #  - 406 (Not Acceptable): wrong (requested) response body media type or encoding
                                  #    (See content negotiation, delta encoding, compression)
                                  #  - Prefer: handling=strict|lenient [C]: should validate [not] strictly request body


                                             /=+===============================+=\
                                            /  :                               :  \
                                            )==:            CONTEXT            :==(
                                            \  :_______________________________:  /
                                             \=+===============================+=/


FINANCIAL ==>                     #402 (Payment Required)

LEGAL ==>                         #451 (Unavailable For Legal Reasons):
                                  #  - censorship, copyright, privacy.
                                  #  - can include Link [S] with rel="blocked-by"



           
   CONTENT  
           



                                             /=+===============================+=\
                                            /  :                               :  \
                                            )==:           SEMANTICS           :==(
                                            \  :_______________________________:  /
                                             \=+===============================+=/


STATUS CODES ==>                  #Indicates response main semantics
                                  #WebDAV-only: 102, 207, 208, 422, 423, 424, 425, 507, 508
                                  #1**: informational, i.e. establish communication (no response body)
                                  #  100 (Continue)                         client sent only headers and can proceed to send body                   See Expect: 100-continue [C]
                                  #  101 (Switching Protocols)              switch protocol success, e.g. from HTTP to HTTPS                        See Upgrade [C]
                                  #  103 (Early Hints)                      final response's headers hints                                          See prefetching
                                  #2**: success
                                  #  200 (OK)                               simple
                                  #  201 (Created)                          new resource                                                            See POST
                                  #  202 (Accepted)                         response is ongoing and will take some time to process                  See async
                                  #  203 (Non-Authoritative Information)    proxy transformed server's 200                                          See proxies
                                  #  204 (No Content)                       OK, but nothing is to be returned and client should not refresh         See empty body
                                  #  205 (Reset Content)                    like 204 but client should reset                                        See empty body
                                  #  206 (Partial Content)                  response is only a subset of the full resource                          See Range [C]
                                  #  226 (IM Used)                          returns diff not full resource                                          See Delta encoding
                                  #3**: client redirect
                                  #  300 (Multiple Choices)                 redirect need client input                                              See content negotiation
                                  #  301 (Moved Permanently)                permanent, GET (even if different method, but should ask first)         See redirects
                                  #  302 (Found)                            temp, GET (even if different method, but should ask first)              See redirects
                                  #  303 (See Other)                        different resource (not only different URI) than requested              See redirects
                                  #  304 (Not Modified)                     resource did not change                                                 See unconditional caching
                                  #  305 (Use Proxy)                        redirect to a proxy (deprecated)                                        See redirects
                                  #  306 (Unused)                           Reserved
                                  #  307 (Temporary Redirect)               temp, same HTTP method                                                  See redirects
                                  #  308 (Permanent Redirect)               permanent, same HTTP method                                             See redirects
                                  #4**: client-side failure
                                  #  400 (Bad Request)                      syntax error                                                            See syntax errors
                                  #  401 (Unauthorized)                     authentication problem                                                  See authentication
                                  #  402 (Payment Required)                 e.g. should pay to increase request rate                                See financial
                                  #  403 (Forbidden)                        authorization problem (and location not secret)                         See authentication
                                  #  404 (Not Found)                        wrong URI, but correct domain (or auth problem with secret location)    See wrong location
                                  #  405 (Method Not Allowed)               HTTP method not implemented or not allowed                              See HTTP methods
                                  #  406 (Not Acceptable)                   wrong (requested) response body media type or encoding                  See validation
                                  #  407 (Proxy Authentication Required)    like 401 but for application proxy                                      See authentication
                                  #  408 (Request Timeout)                  as opposed to response timeout                                          See timeout
                                  #  409 (Conflict)                         multi-client conflict                                                   See concurrency
                                  #  410 (Gone)                             like 404, but indicates URI was present before                          See wrong location
                                  #  411 (Length Required)                  missing request body length                                             See body length hint
                                  #  412 (Precondition Failed)              resource changed even though client assumed it did not                  See conditional caching
                                  #  413 (Payload Too Large)                                                                                        See limits
                                  #  414 (URI Too Long)                                                                                             See limits
                                  #  415 (Unsupported Media Type)           unsupported request body media type (inverse of 406)                    See validation
                                  #  416 (Range Not Satisfiable)            wrong Range [C]                                                         See Range [C]
                                  #  417 (Expectation Failed)               Expect [C] failed                                                       See request processing
                                  #  419 (Authentication Timeout)           like 401 but for authentication timeout                                 See authentication
                                  #  421 (Misredirected Request)            request picked wrong server                                             See redirections
                                  #  426 (Upgrade Required)                 switch protocol denied                                                  See switching protocols
                                  #  428 (Precondition Required)            must use If-* [C]                                                       See conditional caching
                                  #  429 (Too Many Requests)                throttle. May include Retry-After [S]                                   See load
                                  #  431 (Request Header Fields Too Large)                                                                          See limits
                                  #  451 (Unavailable For Legal Reasons)                                                                            See legal
                                  #5**: server-side failure
                                  #  500 (Internal Server Error)            bug in server, e.g. syntax error                                        See syntax errors
                                  #  501 (Not Implemented)                  feature not available yet                                               See extensions
                                  #  502 (Bad Gateway)                      sent by proxy when it received error from server                        See proxies
                                  #  503 (Service Unavailable)              server is down (cannot connect)                                         See load
                                  #  504 (Gateway Timeout)                  sent by proxy on server timeout                                         See proxies
                                  #  505 (HTTP Version Not Supported)                                                                               See versioning
                                  #  506 (Variant Also Negotiates)          negotiation circular loop                                               See content negotation
                                  #  510 (Not Extended)                     HTTP extension not implemented                                          See extensions
                                  #  511 (Network Authentication Required)  like 401 but for network proxy, containing link where to authenticate   See authentication

INFORMATIONAL STATUS CODES ==>    #A server can sent one or several 1** responses before the final response.

METHODS ==>                       #Request main semantics
                                  #Whitelisting:
                                  #  - Allow: HTTP_METHOD,... [S]:
                                  #     - in response to OPTIONS request
                                  #  - errors:
                                  #     - not allowed: 405 (Method Not Allowed). Must also include Allow [S]
                                  #     - not understood: 501 (Not Implemented)
                                  #X-HTTP-Method-Override: METHOD [C]:
                                  #  - request should be interpreted as if HTTP METHOD had been used
                                  #  - goal is to overcome proxies HTTP methods restrictions
                                  #  - should use POST:
                                  #     - does not break semantics (potentially non-safe and non-idempotent)
                                  #     - e.g. GET assumes safe, and breaking it arise security issue, because browsing users
                                  #       might trigger action unknowlingly
                                  #Safety:
                                  #  - read vs write (on the resource)
                                  #  - list:
                                  #     - safe: GET, HEAD, OPTIONS, TRACE
                                  #     - unsafe: PUT, DELETE, [UN]LINK, POST, PATCH, CONNECT
                                  #  - Safe: yes|no [S]:
                                  #     - declares unsafe method being actually safe
                                  #     - goal is to imply idempotency, i.e. client can retry without prompting user, e.g.:
                                  #        - safe POST when need to submit x-www-urlencoded safe request without using XHR
                                  #        - idempotent PATCH
                                  #     - not implemented by clients

CRUD ==>                          #GET:
                                  #  - retrieve resource
                                  #  - safe method
                                  #  - body:
                                  #     - request: none
                                  #     - response: resource representation
                                  #HEAD:
                                  #  - like GET but no response body
                                  #  - content-related headers may also be omitted, e.g. content encoding or transfer encoding
                                  #POST:
                                  #  - generic modification|processing
                                  #  - including creating resource, without known resource URI (e.g. no specific ID)
                                  #     - use 201 (Created) with Location: URL [S]
                                  #  - unsafe method
                                  #  - usually non-idempotent
                                  #  - body:
                                  #     - request: modification, e.g. new resource representation
                                  #     - response: status of modification
                                  #        - e.g. new resource representation, in which case should add Content-Location [S]
                                  #PUT:
                                  #  - replace|create (completely) resource, with known resource URI (e.g. specific ID)
                                  #  - if created, use 201 (Created) with Location: URL [S]
                                  #  - unsafe idempotent method
                                  #  - body:
                                  #     - request: new resource representation
                                  #     - response: either:
                                  #        - none, with 204|205
                                  #        - replace|creation status, with 200 (OK), e.g. new resource representation
                                  #PATCH:
                                  #  - modify (partially) resource, with known resource URI (e.g. specific ID)
                                  #     - if not existing, can create, or not (preferred)
                                  #  - unsafe method
                                  #  - non-idempotent, unless it just appends or sets parts (as opposed to merge)
                                  #  - body:
                                  #     - request: resource diff|changes
                                  #     - response: diff status, e.g. new resource representation
                                  #  - can e.g. use JSON merge patch (see its doc) or JSON patch (see its doc)
                                  #  - Accept-Patch: MIME[;charset=CHARSET],... [S]
                                  #     - in response to OPTIONS request, meaning MIME types accepted by PATCH
                                  #DELETE:
                                  #  - erase resource
                                  #  - unsafe idempotent method
                                  #  - body:
                                  #     - request: none
                                  #     - response: either:
                                  #        - none, with 204|205
                                  #        - deletion status, with 200 (OK)


                                             /=+===============================+=\
                                            /  :                               :  \
                                            )==:       CONTENT PROCESSING      :==(
                                            \  :_______________________________:  /
                                             \=+===============================+=/


CONTENT TRANSFORMATION ==>        #Possible transformations:
                                  #  - variants:
                                  #     - specific to the entity, changes final representation
                                  #     - e.g. language, charset, Content-Type, features
                                  #  - content-encoding:
                                  #     - specific to the entity, does not change final representation
                                  #     - e.g. compression, ranges, delta encoding
                                  #     - order is unspecified, except by A-IM [C] and IM [S]
                                  #  - transfer-encoding:
                                  #     - specific to the request|response
                                  #     - e.g. Transfer-Encoding [S]
                                  #     - forbidden in HTTP/2
                                  #Content can be:
                                  #  - resource: highest-level
                                  #  - resource state: resource at a given time
                                  #  - variant: resource state variations
                                  #  - instance: a variant inside a request|response body
                                  #  - entity[-header|body]/representation: an instance after content-encoding, then
                                  #    transfer-encoding
                                  #Resource can be dynamic (server modifies content) or static

REQUEST PROCESSING ==>            #Prefer [C]:
                                  #  - client:
                                  #     - Prefer: VAR[=VAL][;ATTR=VAL...] ,... [C]:
                                  #     - ask server to handle request body in a specific way
                                  #        - should not be used for content negotiation
                                  #     - can be present several times per request (with different VARs)
                                  #     - def VAL: ""
                                  #     - VAR:
                                  #        - respond-async, time=NUM, return=minimal, return=representation,
                                  #          handling=strict|lenient, safe (see this doc)
                                  #        - x-VAR
                                  #  - server:
                                  #     - Preference-Applied: VAR[="VAL"] ,... [S]: which Prefer [C] were honored
                                  #Expect: VAL,... [C]
                                  #  - generic expectation on how server should handle request
                                  #  - 417 (Expectation Failed) if expectation not met

CONTENT NEGOTIATION ==>           #How:
                                  #  - client:
                                  #     - only GET|HEAD
                                  #     - Accept* [C]:
                                  #        - accepted variants:
                                  #           - Accept:                 MIME_TYPE[;q=NUM],... [C]
                                  #              - can use * for TYPE and|or SUBTYPE
                                  #           - Accept-Charset:           CHARSET[;q=NUM],... [C]
                                  #              - can use *
                                  #           - Accept-Language:         LANGUAGE[;q=NUM],... [C]
                                  #           - Accept-Encoding: COMPRESSION_ALGO[;q=NUM],... [C] (see compression)
                                  #           - A-IM:              ALGO[;VAR=VAL][;q=NUM],... [C] (see delta encoding)
                                  #           - Accept-Datetime:                         DATE [C] (see memento)
                                  #              - has priority over other dimensions
                                  #              - works a bit differently than other dimensions
                                  #           - Accept-Features:          FEATURE[;q=NUM],... [C]
                                  #              - FEATURE: FEAT, FEAT=|!=VAL, FEAT=[NUM-NUM2], !FEAT, *
                                  #              - anything not covered by MIME_TYPE, CHARSET or LANGUAGE: MEDIAQUERYLIST,
                                  #                web API support, speed vs graphics, etc.
                                  #              - should be x-FEATURE if not standard
                                  #        - NUM is preference (see below)
                                  #        - if omitted: should not use 'choice'
                                  #     - Negotiate: VAL [C]:
                                  #        - VAL:
                                  #           - trans: supports list|choice
                                  #           - VERSION,...: supports list|choice with those variant selection algorithm versions. Can be '*'
                                  #           - guest-small: supports and ask for list|choice providing list is small enough
                                  #           - vlist: supports and ask for list|choice
                                  #           - (default): ask for ad-hoc
                                  #        - TCN: list, re-choose [S]:
                                  #           - server forced TCN: list, although not asked by Negotiate [C]
                                  #  - server:
                                  #     - list|choice is called 'transparent content negotiation',
                                  #       ad-hoc 'server-side negotiation'
                                  #     - TCN: VAL [S]:
                                  #        - 2xx or 3xx, except 304
                                  #        - ad-hoc[, keep]:
                                  #           - picks one variant, provides no choice to client
                                  #           - should use:
                                  #              - Content-Location:                       URI [S]
                                  #              - Content-Type:  MIME_TYPE[; charset=CHARSET] [S]
                                  #                 - def: either application/octet-stream of content sniffing
                                  #              - Content-Language:              LANGUAGE,... [S]
                                  #              - Content-Encoding:      COMPRESSION_ALGO,... [S] (see compression)
                                  #              - IM:                      ALGO[;VAR=VAL],... [S] (see delta encoding)
                                  #              - Memento-Datetime:                      DATE [S] (see memento)
                                  #           - 406 (Not Acceptable): wrong Accept-* [C]
                                  #        - list[, re-choose]:
                                  #           - provides client only with possible variants:
                                  #              - should be kept short, e.g. 2 to 10
                                  #              - variant URI:
                                  #                 - should not have variant itself.
                                  #                   Otherwise should return 506 (Variant Also Negotiates)
                                  #                 - are best as relative "FILENAME"
                                  #              - requires extra HTTP request
                                  #           - 300 status code
                                  #           - Alternates: CHOICE,... [S] (variants):
                                  #              - {"URI" NUM {ATTR VAL} ...}
                                  #                 - ATTR:
                                  #                    - type|charset|language VAL
                                  #                    - features FEATURE ...:
                                  #                       - can also use FEATURESET;[+NUM][-NUM2],
                                  #                         where FEATURESET is FEATURE or [FEATURE ...]
                                  #                       - NUM is max quality improvement (def: 1),
                                  #                         NUM2 max degradation (def: 0)
                                  #                    - length NUM
                                  #                    - description "STR". Use %xXX for Unicode encoding.
                                  #                    - any other x-ATTR
                                  #                 - NUM (0-1):
                                  #                    - quality value ("qvalue")
                                  #                       - represents both the preference, and the min resource quality
                                  #                         (in percentage)
                                  #                       - def: 1
                                  #                       - 0 is "not acceptable"
                                  #                       - max 3 decimals
                                  #                    - calculated by remote variant selection algorithm:
                                  #                       - it also selects whether to use list or choice
                                  #                       - e.g. RVSA 1.0:
                                  #                          - NUM = product of all matching Accept*;q preferences
                                  #                          - should use list if no NUM > 0, or only used wildcards
                                  #                            (e.g. Accept-Features: * or Accept: */*)
                                  #              - <URI>: fallback
                                  #              - proxy-rvsa="VERSION,...": remote variant selection algorithm versions
                                  #        - choice:
                                  #           - ad-hoc + list
                                  #           - "URI" must be relative "FILENAME" for security reasons
                                  #           - proxy can choose to only respond with ad-hoc answer by:
                                  #              - Variant-Vary [S] -> Vary [S]
                                  #              - remove Content-Location [S], Alternates [S]
                                  #              - remove ';LIST_ETAG'
                                  #     - caching:
                                  #        - Vary: Negotiate, Accept*... [S]: list itself (list|choice)
                                  #        - Variant-Vary [S]: ad-hoc answer (choice)
                                  #        - must append ";LIST_ETAG" to each variant ETAG
                                  #  - client:
                                  #     - accepts chosen variant (ad-hoc, choice) or ask for a specific one (choice, list)
                                  #     - when using TCN: ad-hoc, keep, force accepting chosen variant
                                  #Proactive (ad-hoc) vs reactive (list):
                                  #  - proactive:
                                  #     - puts work on the server
                                  #     - Accept* [C] allows fingerprinting user agent (privacy concern)
                                  #     - requires Vary [S] (see Vary [S] for problems associated with it)
                                  #  - reactive:
                                  #     - puts work on the client
                                  #     - might yield better guess
                                  #     - one more request
                                  #Prefer: Safe [C]:
                                  #  - should not respond with "objectionable" content, e.g. for parental control
                                  #  - Firefox, IE10 use OS/browser UI to set it


                                             /=+===============================+=\
                                            /  :                               :  \
                                            )==:            MEMENTO            :==(
                                            \  :_______________________________:  /
                                             \=+===============================+=/



MAIN RESOURCES ==>                #URI-R: original resource
                                  #  - resource original URI
                                  #URI-G: timegate
                                  #  - content negotiation server
                                  #URI-M: memento
                                  #  - resource replicating original resource state
                                  #  - must keep same status code and headers
                                  #  - can be slightly different:
                                  #     - URI rewriting:
                                  #        - so links (including redirections) point to other mementos
                                  #        - optional, so client should figure out other mementos itself if no URI rewriting
                                  #     - adding content:
                                  #        - e.g. branding or archival status
                                  #        - should use Link: <http://mementoweb.org/terms/donotnegotiate>; rel="type" [S]
                                  #     - compression
                                  #URI-T: timemap
                                  #  - list of mementos for an original resource

RETRIEVAL METHODS ==>             #  - content negotiation: best for a single resource
                                  #  - timemaps: best for several resources
                                  #  - mementos list: for single resource, if wants to manually control content negotiation

CONTENT NEGOTATION ==>            #To URI-R:
                                  #  - client:
                                  #     - Accept-Datetime: DATE [C]
                                  #  - server:
                                  #     - Link: URI-G;rel=timegate [S] ...
                                  #     - for any 2**|3**|4** status code, including 404|410
                                  #To URI-G:
                                  #  - client:
                                  #     - Accept-Datetime: DATE [C]
                                  #        - how to pick memento DATE according to requested DATE
                                  #          (nearest, lower round, upper round) is implementation-dependant
                                  #        - def: most recent
                                  #        - has priority over other content negotiation dimensions
                                  #  - server:
                                  #     - 302 (Found)
                                  #     - Location: URI-M [S]
                                  #     - Link: URI-R;rel=original [S]
                                  #     - Vary: Accept-Datetime [S]
                                  #To URI-M:
                                  #  - client:
                                  #     - Accept-Datetime: DATE [C]
                                  #  - server:
                                  #     - Link: URI-R;rel=original [S]
                                  #     - Link: URI-G;rel=timegate [S] ...
                                  #     - Memento-Datetime: DATE [S]
                                  #        - memento's mtime (whereas Last-Modified [S] is actual response mtime)
                                  #     - Vary: Memento-Datetime [S]
                                  #... means there can be several Link [S] for same REL
                                  #Special cases:
                                  #  - URI-R === URI-G:
                                  #     - when origin server and timegate server are the same
                                  #     - URI-R response include URI-G response fields
                                  #  - URI-G === URI-M:
                                  #     - when timegate provides memento itself
                                  #     - URI-G response include URI-M response fields
                                  #     - 200 (OK) + memento in response body
                                  #     - Content-Location: URI-M [S]:
                                  #        - if different that current one
                                  #     - no Location [S]
                                  #  - chain of URI-G:
                                  #     - each URI-G but the last one redirect to another timegate:
                                  #     - same response except:
                                  #        - redirect to URI-G
                                  #        - no Vary [S]
                                  #  - no URI-G:
                                  #     - when set of mementos is not gonna change anymore:
                                  #        - snapshot of a discontinued origin server
                                  #        - resources that never change after creation
                                  #     - URI-R response include URI-M response fields
                                  #     - Link: URI-M;rel=memento [S] ...
                                  #     - no Link: URI-G;rel=timegate [S]

TIMEMAPS ==>                      #To URI-R|G|M|T:
                                  #  - Link: URI-T;rel=timemap;type="MIME"[;from|until="DATE"] [S] ...
                                  #     - from|until: first|last memento
                                  #To URI-T:
                                  #  - list of possible URI-M (including datetime) for a given URI-R
                                  #     - in response body
                                  #     - can also include URI-T and URI-G
                                  #     - can specify several URI-T:
                                  #        - should be retrieved
                                  #        - goal is to divide response into several timemaps for:
                                  #           - pagination (should use from|until)
                                  #           - indexing|redirections
                                  #  - possible formats:
                                  #     - Content-Type: application/link-format [S]
                                  #        - newline-separated of Link: URI-T|G|R|M;... [S] values
                                  #        - "self" instead of "timemap" for current one
                                  #     - Content-Type: application/json [S]
                                  #        - might have less support than link-format
                                  #        - members:
                                  #           - original_uri "URI-R"
                                  #           - timegate_uri "URI-G"
                                  #           - timemap_uri.json|link_format "URI_T"
                                  #           - mementos:
                                  #              - list MEMENTO_ARR: datetime "DATE", uri "URI-M"
                                  #              - first|last|prev|next|closest MEMENTO
                                  #           - [pages:]
                                  #              - prev|next TIMEMAP:
                                  #                 - from|until "DATE"
                                  #                 - uri "URI-T"
                                  #                 - [memento_compliant "yes|no"]
                                  #                 - [archive_id STR]
                                  #           - [timemap_index: TIMEMAP_ARR]

MEMENTOS LIST ==>                 #To URI-R|G|M:
                                  #  - Link: URI-M;rel=memento;datetime="DATE"[;license="URI"] [S] ...
                                  #     - all mementos, including current one
                                  #     - optional
                                  #     - can optionally add REL first|last|prev|next, predecessor|successor|latest-version
                                  #       or working-copy[-of]
                                  #  - Link: <http://mementoweb.org/terms/donotnegotiate>; rel="type" [S]
                                  #     - specifies there are no mementos
                                  #     - client should not use Accept-Datetime [C]

SUPPORT ==>                       #Client:
                                  #  - no browsers natively
                                  #  - Chrome extensions: memento-time-travel, mink
                                  #  - Python: py-memento-client
                                  #Server:
                                  #  - openwayback (Java)
                                  #  - pywb (Python)
                                  #  - mementoweb timegate (Python)
                                  #  - MediaWiki memento extension
                                  #  - mementoweb.org/tools/archive/ (Apache, use purl.org)
                                  #Websites implementing it: many web archives, Wikipedia, some CMS, GitHub
                                  #(using .git history)
                                  #Validators: mementoweb.org/tools/validator/

MEMENTO AGGREGATOR ==>            #Tools that retrieve timegates|mementos|timemaps by just providing URI
                                  #  - either use Memento
                                  #  - or if unavailable, check among popular archives
                                  #Examples:
                                  #  - Memento timetravel REST API


                                             /=+===============================+=\
                                            /  :                               :  \
                                            )==:             LINKS             :==(
                                            \  :_______________________________:  /
                                             \=+===============================+=/


URI SCHEME ==>                    #http[s]:
                                  #  - relative URI can only be absolute path reference (/PATH/...)
                                  #  - HOSTNAME[:PORT]:
                                  #      - required
                                  #      - if relative URI, uses:
                                  #         - (HTTP/2) :authority HOSTNAME[:PORT] [C]
                                  #         - (HTTP/1.1) Host: HOSTNAME[:PORT] [C]
                                  #      - IP address or DNS name
                                  #      - case sensitivity depends on server
                                  #  - PATH: def is "/"
                                  #http:
                                  #  - over TCP
                                  #  - default port: 80
                                  #https:
                                  #  - over SSL
                                  #  - default port: 443

REDIRECTS ==>                     #Client-side:
                                  #  - status code is 3**:
                                  #     - general cases:
                                  #        - use GET (even if HTTP method was not GET, but should ask first)
                                  #           - permanent: 301 (Moved Permanently)
                                  #           - temp: 302 (Found)
                                  #        - use same HTTP method
                                  #           - permanent: 308 (Permanent Redirect)
                                  #           - temp: 307 (Temporary Redirect)
                                  #     - specific cases:
                                  #        - different resource (not only different URI): 303 (See Other)
                                  #           - body should contain same URI as Location [S]
                                  #        - server ask client to use proxy instead: 305 (Use Proxy) (deprecated)
                                  #        - need client input: 300 (Multiple Choices) (see content negotiation)
                                  #           - can use Location [S] to indicate preferred choice
                                  #        - caching: 304 (Not Modified) (see caching)
                                  #  - client should request again:
                                  #     - Location: URI [S]: right away
                                  #     - Retry-After: NUM|DATE [S]: in future, same URI
                                  #     - Refresh: NUM[, url=URI] [S]: in future, same URI or not.
                                  #       Can be used as <meta http-equiv>
                                  #  - 5+ redirects is considered infinite loop
                                  #  - keep #HASH
                                  #Server-side:
                                  #  - Content-Location: URL [S]:
                                  #     - notifies client of URL, so it can be used for caching, or future requests
                                  #     - status code is not 3**
                                  #     - similar to alternative services, but for single URL and less features
                                  #Alternative service:
                                  #  - like redirects but:
                                  #     - for an ORIGIN not URI
                                  #     - routing is performed server-side, so URI remains the same client-side
                                  #     - inform client to optionally request it, instead of requiring client
                                  #  - use cases:
                                  #     - load balancing, CDN, protocol changes (HTTP->HTTPS, HTTP/1.1->HTTP/2)
                                  #     - similar to how CNAME or load balancing works
                                  #  - support: Chrome, Firefox
                                  #  - request alternative ORIGIN using header:
                                  #     - but use same URI
                                  #     - alternative ORIGIN has same privilege and behaves the same as if it was main ORIGIN
                                  #     - should be done by hop-to-hop, i.e. (if proxy) last proxy to server not client to
                                  #       server
                                  #  - how:
                                  #     - server:
                                  #        - Alt-Svc: ORIGIN[;VAR=VAL],... [S]
                                  #           - ORIGIN is ALPN_SCHEME="[HOST]:PORT"
                                  #           - order indicates preference
                                  #        - frame ORIGIN (0xc)
                                  #           - Same as Alt-Svc [S] but for HTTP/2. Can be used together with Alt-Svc [S]
                                  #           - Origin length [0-1], Origin [*]: main ORIGIN
                                  #           - only used when stream has no :scheme nor :authority, i.e. on stream ID 0
                                  #        - frame ALTSVC (0xa):
                                  #           - alternative to ORIGIN frame (does same thing)
                                  #           - contains:
                                  #              - Origin length [0-1], Origin [*]: like ORIGIN frame
                                  #              - Alt-Svc-Field-Value [*]: same as Alt-Svc [S]
                                  #     - client:
                                  #        - Alt-Used: HOST[:PORT] [C]
                                  #     - server:
                                  #        - 421 (Misredirected Request): if wrong Alt-Used [C]
                                  #  - caching:
                                  #     - ORIGIN clear: invalidates all cached SERVICE
                                  #     - VAR:
                                  #        - ma=NUM
                                  #           - how long to cache, in seconds (def: 1 day)
                                  #           - same calculation as Cache-Control max-age
                                  #           - checked when creating new connections, i.e. does not terminate current ones
                                  #        - persist=1:
                                  #           - if not present, should invalidate cache on server network configuration change
                                  #Retry-After: NUM|DATE [S]: client should request same URI again in the future

WRONG LOCATION ==>                #Errors:
                                  #  - 404 (Not Found): wrong URI and never was right
                                  #  - 410 (Gone): wrong URI but used to be right, and permanently moved

BODY LOCATION ==>                 #Content-Location: URL [C|S]:
                                  #  - URL of request|response body itself
                                  #     - if GET|HEAD request and 200|203|204|205|206|226|304 response,
                                  #       response body is requested resource, i.e. Content-Location [S] def to request URI
                                  #  - body can be partial|symbolic, in which case URL points to full representation
                                  #  - use cases:
                                  #     - request body provenance
                                  #     - response body alternative|real provenance,
                                  #       e.g. server-side redirects or content negotiation
                                  #     - partial|symbolic body, e.g. Prefer: return=representation [S] or 202 (Accepted)
                                  #     - with unsafe methods (e.g. POST|PUT|PATCH), indicating response body is
                                  #       latest representation

SEMANTIC LINKS ==>                #Location: URI [S]
                                  #  - like Link [S] but semantics is defined by status code
                                  #  - ex:
                                  #     - 201: created resource
                                  #     - 3**: redirect to
                                  #Link: <URI>[; ATTR="VAL"];... [, <URI>...] [S]
                                  #  - goal:
                                  #     - semantic relationship
                                  #        - i.e. independant of representation (including MIME type)
                                  #     - between:
                                  #        - RESOURCE: the one returned
                                  #        - RESOURCE2: at URI
                                  #     - any cardinality, including n-n relationship
                                  #  - ATTR:
                                  #     (for RESOURCE, authoritary)
                                  #     - rel "REL ..." (mandatory):
                                  #        - relation type from RESOURCE to RESOURCE2
                                  #        - REL can be URI describing a REL type (instead of a 'REL' name)
                                  #        - prefer:
                                  #           - one Link [S] with two RELs
                                  #           - over two Link [S] with one REL and same URI
                                  #     - anchor "URI|#HASH": for RESOURCE
                                  #     (for RESOURCE2, hints only)
                                  #     - type "MIME"
                                  #     - hreflang "LANG"
                                  #     - media "MEDIAQUERYLIST"
                                  #     - title "STR": for accessibility
                                  #     - VAR "VAL"
                                  #<link href="URI" ATTR="VAL">: same as Link [S], except:
                                  #  - no: anchor
                                  #  - only works with <link> syntax: 'stylesheet', icon-related, crossorigin, as, sizes,
                                  #    referrerpolicy
                                  #[UN]LINK:
                                  #  - HTTP method unsafe, idempotent
                                  #  - asks to add (or change) or remove links to a resource
                                  #     - only one LINK between RESOURCE and RESOURCE2 for a given REL (so it can be changed)
                                  #  - accompanied with Link [C] (same as Link [S])
                                  #  - no request body
                                  #REL:
                                  #  (general)
                                  #  - 'type': information about the semantic type (not MIME) of resource
                                  #  - 'profile': similar to 'type'
                                  #  (versions of same resource)
                                  #  - 'alternate': alternative versions
                                  #  - 'canonical':
                                  #     - preferred version among alternatives
                                  #     - search engines will use this link instead
                                  #  - 'latest-version'
                                  #  - 'working-copy[-of]'
                                  #  - 'predecessor|successor-version'
                                  #  - 'version-history'
                                  #  (collection type)
                                  #  - 'first|last'
                                  #  - 'next|prev'
                                  #  - 'index|up'
                                  #  - 'collection', 'item'
                                  #  (information type)
                                  #  - 'bookmark'
                                  #  - 'preview'
                                  #  - 'tag'
                                  #  - 'create|edit-form': create or edit a FORM
                                  #  (meta-information)
                                  #  - 'about': resource meta-information
                                  #  - 'author' should be served as text/plain, with format:
                                  #    /* TEAM */
                                  #       POSITION: NAME
                                  #       Contact: EMAIL [at] EMAIL
                                  #       Twitter: @...
                                  #       ...
                                  #       From: City, Country
                                  #
                                  #    /* THANKS */
                                  #       ...
                                  #
                                  #    /* SITE */
                                  #       Last update: YYYY/MM/DD
                                  #       Language: LANG / ...
                                  #       Doctype: HTML5
                                  #       IDE: ...
                                  #       Other technologies...
                                  #  - 'me': author
                                  #  (section type)
                                  #  - 'contents': table of contents
                                  #  - 'chapter|[sub]section': full chapter or [sub]section
                                  #  - 'search'
                                  #  - 'sidebar'
                                  #  - 'appendix'
                                  #  - 'archives': e.g. web archives
                                  #  - 'help': e.g. FAQ, documentation
                                  #  - 'glossary'
                                  #  - 'copyright'
                                  #  - 'license'
                                  #  - 'disclosure': patent disclosures
                                  #  - 'privacy-policy'
                                  #  - 'terms-of-service'
                                  #  (external references)
                                  #  - 'external': not endorsed (e.g. ads)
                                  #  - 'nofollow': crawlers (see SEO)
                                  #  - 'noreferrer': see web security doc
                                  #  - 'pingback': should get a notification at this URI when used as reference
                                  #  (prefetching)
                                  #  - '[module]preload', 'prerender', 'preconnect', 'dns-prefetch'
                                  #  (not semantic)
                                  #  - 'stylesheet': e.g. CSS (or CSS preprocessor) stylesheet
                                  #  - icon-related: 'icon', 'shortcut', 'apple-touch-icon-precomposed'
                                  #  (memento)
                                  #  - 'original|timegate|memento|timemap'

SOURCE MAP ==>                    #[X-]SourceMap: URI [S] (see source map doc)



                 
   STATE/CONTEXT  
                 



                                             /=+===============================+=\
                                            /  :                               :  \
                                            )==:             STATE             :==(
                                            \  :_______________________________:  /
                                             \=+===============================+=/


SESSION ==>                       #State:
                                  #  - protocol-level:
                                  #     - HTTP/1.* is stateless, i.e. requests/responses independant from each other
                                  #       (except request order)
                                  #        - is only a performance optimization (no need to store state)
                                  #     - HTTP/2 introduces some state: stream current state, frame ID,
                                  #       headers compression dynamic table
                                  #  - need to use headers|body to keep state (e.g. cookies)
                                  #Set of TCP sockets:
                                  #  - HTTP/2:
                                  #     - one per host (not hostname) + port
                                  #  - HTTP/1.*:
                                  #     - 6 (depends on client) per hostname + port
                                  #     - hostname sharding: using different hostnames on a server to overcome limit
                                  #     - hostname unsharding|coalescing:
                                  #        - HTTP/2 client circumventing HTTP/2 server still using hostname sharding
                                  #          (for historical reasons)
                                  #        - reuse socket between different hostnames if they resolve to same IP
                                  #        - only Firefox, Chrome, Opera
                                  #Parallel requests per TCP socket:
                                  #  - HTTP/2:
                                  #     - multiplexing:
                                  #        - SETTINGS_MAX_CONCURRENT_STREAMS (def: unlim)
                                  #        - no order (unless client suggest specific order)
                                  #        - because there is a stream ID
                                  #  - HTTP/1.1:
                                  #     - (idempotent methods) pipelining:
                                  #        - 4-8 (depends on client)
                                  #        - head-of-line blocking (answers in same order as requests)
                                  #        - because there is no request ID to match request with response
                                  #     - (non-idempotent methods) serial: 1
                                  #  - HTTP/1.0:
                                  #     - serial: 1
                                  #How long:
                                  #  - HTTP/2:
                                  #     - until GOAWAY frame
                                  #     - timeout not mandatory nor forbidden
                                  #     - can check if connection not broken with PING frames
                                  #  - HTTP/1.*:
                                  #     - until Connection: close [C|S]
                                  #     - until timeout: Keep-Alive: timeout=NUM [S] (in ms)
                                  #        - often 5000-15000ms
                                  #     - until NUM requests: Keep-Alive: max=NUM [S]
                                  #     - TCP keepalive is completely different from HTTP keepalive
                                  #  - HTTP/1.0: requires Connection: Keep-Alive [C|S] to remain open

PING FRAME ==>                    #(HTTP/2)
                                  #  - use cases:
                                  #     - calculating round-trip time
                                  #     - check connection to endpoint is not broken
                                  #  - contains 8 bytes of arbitrary data
                                  #  - have priority over other frame types
                                  #  - must respond with another PING frame with flag ACK

COOKIES ==>                       #Goal:
                                  #  - store state for a specific client+server pair
                                  #  - can be ignored by some clients
                                  #  - clients will remove them due to memory constraints or end-user demand
                                  #How:
                                  #  - server:
                                  #      Set-Cookie: VAR=VAL[;SVAR=VAL;...] [S]: one header per cookie
                                  #  - client, next request on same domain+path:
                                  #      Cookie: VAR=VAL[;...] [C]: one header for all cookies
                                  #  - VAL are percent-encoded
                                  #  - SVAR:
                                  #     - domain STR:
                                  #        - must be same as server, or superdomain
                                  #        - subdomains will match
                                  #     - path '/PATH'
                                  #        - recursive
                                  #     - expires|max-age:
                                  #        - DATE|NUM seconds before expiration
                                  #        - max-age has priority
                                  #        - def: end of session
                                  #        - 0 deletes cookie
                                  #     - secure: can only get|set via HTTPS
                                  #     - HttpOnly: can't be used via JavaScript (document.cookies), for security reasons
                                  #     - SameSite: Referer URL must have same superdomain, to prevent CSRF
                                  #        - 'Strict': yes
                                  #        - 'Lax' (def): yes, except if it's a navigation action
                                  #        - 'None': no
                                  #            - require "secure" to be set
                                  #     - Priority 'low|medium|high':
                                  #        - hint to client when it removes some cookies for a given domain,
                                  #          to prioritize deleting some over others
                                  #        - Chrome only
                                  #     - Partitioned
                                  #        - CHIPS (Cookies Having Independent Partitioned State)
                                  #Limits:
                                  #  - 4KB/cookie (most browsers)
                                  #  - 50/domain (IE11)
                                  #  - 10KB/domain (IE11)
                                  #Types:
                                  #  - first-party cookie:
                                  #     - cookie path/domain (i.e. HTTP request) is same as top-level page path/domain
                                  #  - third-party cookie:
                                  #     - inverse
                                  #     - can be blocked in browser settings
                                  #     - only disabled by default in Safari
                                  #  - Zombie cookie:
                                  #     - use cookies but also other storage at once, e.g. localStorage, ETag [S], Flash cookies, etc.
                                  #     - removing from one place -> others recreate it
                                  #Security: see web security doc

TRACKING ==>                      #All come with privacy concern
                                  #Private browsing:
                                  #  - a private session erases at the end all the traces (history, cookies, cache) it created.
                                  #  - called Incognito in Chrome
                                  #From: EMAIL_ADDRESS [C]:
                                  #  - often used with bots for support email
                                  #Do Not Track:
                                  #  - client:
                                  #     - DNT: VAL [C]
                                  #        - VAL is preference about tracking:
                                  #           - 1: disallow
                                  #           - 0: allow
                                  #           - (default) no preference
                                  #        - must be explicitely enabled inside browser settings
                                  #        - can check WINDOW|NAVIGATOR.doNotTrack (see DOM doc)
                                  #        - NAVIGATOR.store|remove|confirmSiteSpecific|WebSideTrackingException():
                                  #           - change site-specific or all-sites privacy settings (not implemented yet)
                                  #  - server:
                                  #     - Tk: VAL [S]:
                                  #        - VAL:
                                  #           - N: no tracking
                                  #           - T: tracking, normal
                                  #           - C: tracking, consent through a different way than DNT [C]
                                  #           - P: tracking, consent will come later.
                                  #                If constent rejected, previous data will be deleted|anonymized.
                                  #           - D: tracking, ignore DNT (e.g. for technical|legal reasons)
                                  #           - G: tracking, is only gateway
                                  #           - U: switched tracking, because of a different way than DNT [C]
                                  #           - ?[;ID]: different VAL per request
                                  #           - !: currently implementing DNT
                                  #        - is per resource
                                  #     - 409 if refuse to deliver resource because of DNT: 1 [C]
                                  #  - GET /.well-known/dnt/[ID]:
                                  #     - must contain Content-Type "application/trackings-status+json":
                                  #        - tracking VAL (mandatory): current Tk [S]
                                  #        - compliance URI_ARR:
                                  #           - privacy law/regulation
                                  #           - should be available at /.well-known/dnt-policy.txt too
                                  #        - qualifiers STR: compliance options opted in, as list of chars
                                  #        - controller URI_ARR: responsible for holding data
                                  #        - same-party URI_ARR: websites that have different domains but actually are
                                  #          first-party
                                  #        - audit URI_ARR: external audits of DNTs
                                  #        - policy URI: privacy policy
                                  #        - config URI:
                                  #           - where user can configure privacy
                                  #           - mandatory if Tk: C|P
                                  #     - ID is used with Tk: ?[;ID] [S]
                                  #     - this GET request should never be tracked itself
                                  #  - what "tracking disallow" means with DNT: 1 [C]:
                                  #     - depends on compliance URI
                                  #     - W3C "Tracking Compliance and Scope"
                                  #       (http://www.w3.org/TR/2016/CR-tracking-compliance-20160426), tracking must:
                                  #        - anonymize data:
                                  #           - cannot link data to specific user
                                  #              - user-agent, device, geolocation: allowed if general enough, e.g.:
                                  #                 - no IP address
                                  #                 - no fingerprinting
                                  #                 - no very specific geolocation
                                  #              - that implies no cross-site tracking
                                  #           - cannot link patterns (i.e. several datapoints) to specific user|device,
                                  #             even anonymous
                                  #        - receive consent, except for (letters are "qualifiers", see above):
                                  #           - c: frequency capping (e.g. only showing something once)
                                  #           - s: security
                                  #           - f: financial|billing (e.g. rate limiting)
                                  #           - d: debugging
                                  #        - sharing with service providers (e.g. AWS) require:
                                  #           - consent
                                  #           - qualifier "t"
                                  #        - not collect more nor longer than needed
                                  #           - retention period must be public
                                  #        - use sound security practices
                                  #     - EFF DNT policy (https://www.eff.org/dnt-policy), version 1.0, tracking must:
                                  #        - anonymize data: like W3C but:
                                  #           - cannot link patterns to groups <5000 users neither
                                  #           - can only link patterns to groups >5000 users if publicly disclose
                                  #             anonymization methods
                                  #        - not collect longer than 10 days
                                  #        - includes third parties
                                  #        - exceptions:
                                  #           - data used only for a specific transaction
                                  #           - response to security incident
                                  #           - law enforcement, but must notify user by email or regular mail


                                             /=+===============================+=\
                                            /  :                               :  \
                                            )==:            CONTEXT            :==(
                                            \  :_______________________________:  /
                                             \=+===============================+=/


LOGGING ==>                       #DATE:
                                  #  - e.g. Sun 01 Nov 1900 12:00:00 GMT
                                  #  - should be UTC
                                  #  - case-sensitive
                                  #Date: DATE [C|S]:
                                  #  - when request|response body was generated
                                  #  - i.e. just before request|response sent
                                  #X-Response-Time: NUM [S]:
                                  #  - time taken by server to process answer

SOFTWARE IDENTIFICATION ==>       #All come with fingerprint and|or privacy concern
                                  #Identification:
                                  #  - X-Requested-With: STR [C]:
                                  #     - client technology (often used: XMLHttpRequest)
                                  #  - User-Agent: PRODUCT[/VERSION]|(COMMENT) ... [C]:
                                  #     - client application (e.g. web browser)
                                  #     - first token cannot be (COMMENT)
                                  #  - X-Powered-By [S]: like X-Requested-With but for server (e.g. PHP)
                                  #  - Server [S]: like User-Agent but for server (e.g. Apache)
                                  #Directive:
                                  #  - Pragma: VAL [C|S]:
                                  #     - directive specific to a given client|server technology
                                  #  - X-UA-Compatible: CLIENT=VERSION;... [S]:
                                  #     - client, if CLIENT, should render as it was VERSION
                                  #     - used with IE, e.g. IE=NUM|edge


                 
   COMMUNICATION  
                 


                                             /=+===============================+=\
                                            /  :                               :  \
                                            )==:            BASICS             :==(
                                            \  :_______________________________:  /
                                             \=+===============================+=/


ORDER ==>                         #  - client sends request
                                  #  - [proxies forwards request]
                                  #  - server receives request
                                  #  - server sends response
                                  #  - [proxies forwards response]
                                  #  - client receives response
                                  #  - client receives response
                                  #Should always assume a proxy might be present

TERMINOLOGY ==>                   #Roles:
                                  #  - client vs server: endpoints (exclude proxies)
                                  #     - user agent: client application, e.g. web browser, web crawler, mobile app
                                  #     - origin server: server where resource resides
                                  #  - sender vs receiver: hop-by-hop (include proxies)
                                  #Direction:
                                  #  - inbound vs outbound: client <-> server
                                  #  - upstream vs downstream: sender <-> receiver
                                  #Content:
                                  #  - message: request|response hop-by-hop
                                  #  - connection: TCP socket hop-by-hop


                                             /=+===============================+=\
                                            /  :                               :  \
                                            )==:            BROWSER            :==(
                                            \  :_______________________________:  /
                                             \=+===============================+=/


BROWSER HTTP REQUESTS ==>         #By changing current URL:
                                  #  - UI:
                                  #     - browser chrome: back|forward|home button, URL bar, searchbar, bookmarks, etc.
                                  #     - <a|area> click event
                                  #     - <form> submit event
                                  #  - programatically:
                                  #     - WINDOW.location|history
                                  #Not changing current URL:
                                  #  - programatically:
                                  #     - XHR.send(), FETCH

RENDERING ==>                     #Content-Disposition: DISPOSITION[; ATTR="VAL"] [S]:
                                  #  - how to process, among:
                                  #     - attachment: prompts for download
                                  #     - inline: render
                                  #  - ATTR:
                                  #     - filename 'FILE':
                                  #        - def: use content-type
                                  #        - even for inline, might be used later when Saving through browser UI
                                  #        - must be validated (otherwise client could overwrite anywhere on the server)
                                  #  - def:
                                  #     - depends on Content-Type [S], i.e. if rendering is supported by client
                                  #     - Content-Type "multipart/form-data; boundary=STR" [S]: attachment


                                             /=+===============================+=\
                                            /  :                               :  \
                                            )==:            PROXIES            :==(
                                            \  :_______________________________:  /
                                             \=+===============================+=/


PROXIES ==>                       #Types:
                                  #  - forward proxy:
                                  #     - acts on behalf of client
                                  #  - tunnels (see tunneling)
                                  #     - acts on behalf of client, but only to forward another protocol
                                  #  - transparent|intercepting|inline|forced proxy:
                                  #     - acts on behalf of the network
                                  #     - can be used e.g. for authentication ("captive portal"), enforce use policy, etc.
                                  #  - reverse proxy / surrogate / gateway:
                                  #     - acts on behalf of server
                                  #     - can be:
                                  #        - ISP
                                  #        - web accelerator:
                                  #           - reverse proxy dedicated to caching
                                  #           - can also do prefetching, compression/minification
                                  #        - CDN:
                                  #           - network across several geographical regions to be closer to clients
                                  #           - optimized for high availability
                                  #Previous|current node info in the proxy chain:
                                  #  - comparison:
                                  #     - previous node: Forwarded [C], X-Forwarded-* [C] ;
                                  #       current node info: Forwarded [C], Via [C|S]
                                  #     - can add description: Via [C|S]
                                  #     - works also for responses: Via [C|S]
                                  #     - standard: Forwarded [C], Via [C|S]
                                  #     - record SCHEME change: Forwarded|X-Forwarded-* [C]
                                  #     - add each node to:
                                  #        - a new header value (all)
                                  #        - or a new header: Forwarded [C]
                                  #  - can use:
                                  #     - Forwarded: VAR=VAL;... ,... [C], with VAR:
                                  #        - host HOST, for NODE, proto SCHEME:
                                  #           - previous node info
                                  #           - NODE:
                                  #              - IP[:PORT]
                                  #              - unknown
                                  #              - CUSTOM_NAME (using [[:alnum:]._-])
                                  #        - by NODE: current node info
                                  #     - X-Forwarded-Host|For|Proto|Port: HOST|IP|SCHEME|PORT,... [C]: current node info
                                  #     - Via: [HTTP/]HTTP_VERSION HOST[:PORT]|CUSTOM_NAME [(DESCRIPTION)] ,... [C|S]:
                                  #       current node info
                                  #  - *host|proto|port are the forwarded request, but *for is the requester's address
                                  #  - optional for each proxy in the chain (can even remove existing ones)
                                  #  - when several, the rightmost is the closest to client (if [C]) or server (if [S])
                                  #Max-Forwards: NUM [C]:
                                  #  - max number of proxies
                                  #  - each proxy decrements NUM. When 0, proxy should respond as if it was final recipient.
                                  #  - only with OPTIONS|TRACE request, to target a specific proxy
                                  #Warnings|errors:
                                  #  - Warning: NUM - "DESCRIPTION" "DATE" [S]
                                  #     - 1**: caching-related (see caching)
                                  #     - 2**: other
                                  #        - 214 "Transformation applied" (see proxy transformations)
                                  #        - 299 "Miscellaneous Persistent Warning"
                                  #  - 502 (Bad Gateway): error from server
                                  #  - 504 (Gateway Timeout): server timeout
                                  #Transformations:
                                  #  - allowed:
                                  #     - Cache-Control: no-transform [C|S]:
                                  #        - don't allow proxy to compress|minify resources (e.g. images/videos)
                                  #          or inject JavaScript code
                                  #     - Surrogate-Control: content="TRANSFORM ..." [S]: from server to proxy
                                  #  - supported:
                                  #     - Surrogate-Capabilities: TARGET="TRANSFORM ..." [C]: from proxy to server
                                  #  - performed:
                                  #     - Warning: 214 - "Transformation applied" "DATE" [S]
                                  #     - if 200 (OK), should transform to 203 (Non-Authoritative Information)
                                  #Authentication: see authentication
                                  #Caching: see caching

IP ==>                            #The IP of the client, beyond proxies:
                                  #  - Forwarded [C], X-Forwarded-For [C]
                                  #  - X-Client-IP [C] (EC2, Heroku, Apache, HAProxy)
                                  #  - CF-Connecting-IP [C] (Cloudflare)
                                  #  - True-Client-Ip [C] (Cloudflare, Akamai)
                                  #  - X-Real-IP [C] (Nginx)
                                  #  - X-Cluster-Client-IP [C] (Rackspace)
                                  #  - TCPSOCKET.remoteAddress (Node.js)


                                             /=+===============================+=\
                                            /  :                               :  \
                                            )==:          CONCURRENCY          :==(
                                            \  :_______________________________:  /
                                             \=+===============================+=/


CONFLICTS ==>                     #409 (Conflicts)
                                  #  - multi-client conflict (see PATCH)
                                  #  - body should include information to help client resolve conflict
                                  #Precondition:
                                  #  - performing an action only if other clients did not change (usually)
                                  #    or changed the resource
                                  #  - use conditional caching mechanisms with also:
                                  #     - headers:
                                  #        - If-Unmodified-Since: DATE [C]
                                  #        - If-Match: "ETAG"|*,... [C]
                                  #        - If-Modified-Since [C] or If-None-Match [C], with unsafe method
                                  #     - status codes:
                                  #        - 412 (Precondition Failed): condition does not match
                                  #        - 428 (Precondition Required): missing If-* [C]

METHOD IDEMPOTENCY ==>            #  - resource state afterwards is always same if called again (with same parameters)
                                  #  - mean client can repeat|retry request without risk
                                  #     - if non-idempotent, should use preconditions If-* [C]
                                  #  - safe implies idempotent
                                  #  - list:
                                  #     - idempotent: GET, HEAD, OPTIONS, TRACE, PUT, DELETE, [UN]LINK
                                  #     - not idempotent: POST, PATCH, CONNECT
                                  #        - POST|PATCH can be made idempotent (see those methods)

REALTIME ==>                      #Allow server to initiate message to client
                                  #Types:
                                  #  - XHR short polling:
                                  #     - problems:
                                  #        - minimum delay to receive message
                                  #        - waste resources when no message
                                  #  - HTTP server push / HTTP streaming / Comet / AJAX push / Reverse AJAX:
                                  #     - leaves XHR always open, using:
                                  #        - HTTP/1.*: Transfer-Encoding: chunked [S]
                                  #        - HTTP/2: no END_STREAM flag
                                  #     - pushlet:
                                  #        - variation where XHR is initial HTML page request
                                  #        - server sends new DOM without closing request
                                  #     - problems:
                                  #        - proxies might buffer XHR, making message not come
                                  #        - XHR might be closed by browser, forcing another request
                                  #     - problems (also shared with long polling)
                                  #        - collides with max number of TCP sockets in client, and pipelining of HTTP/1.*
                                  #        - collides with max number of TCP sockets in reverse proxies
                                  #  - Long polling:
                                  #     - leaves XHR open, but close it (then start new one) with:
                                  #        - server response
                                  #        - timeout:
                                  #           - should be high enough for performance
                                  #           - but low enough so proxies/network do not time it out
                                  #           - usually 30 seconds is good
                                  #     - problems:
                                  #        - minimum delay to receive message after a message has just been received
                                  #          (because client need to start new request)
                                  #        - waste resources when timeout
                                  #  - TCP socket used by plugins like Flash or Java:
                                  #     - problems:
                                  #        - rely on browser plugins
                                  #  - Websockets
                                  #     - problems:
                                  #        - no HTTP semantics
                                  #        - no multiplexing (as opposed to HTTP/2)
                                  #Implementations:
                                  #  - Bayeux protocol: long polling or HTTP streaming
                                  #  - BOSH: long polling with a specific POST request with standardized parameters
                                  #  - Server-sent events (SSE): see below
                                  #Best: Websockets or SSE

SERVER-SENT EVENTS ==>            #Standard around HTTP streaming:
                                  #  - client: GET HTTP request
                                  #  - server:
                                  #     - 200 with Content-Type: text/event-stream [S] (UTF-8)
                                  #     - should not close connection|stream
                                  #Client reconnections:
                                  #  - proxies might drop connection, so might have to be re-established from time to time
                                  #     - sending comments can be used to ping (keep connection alive)
                                  #  - client will try to reconnect by themselves
                                  #     - with a client-specific timeout. Retrying several times or not is client-specific.
                                  #     - 204: client should not try reconnecting anymore
                                  #text/event-stream format:
                                  #  - list of events, separated by two newlines
                                  #  - each event has fields separated by one newline:
                                  #     - :COMMENT
                                  #     - event: TYPE (def: 'message')
                                  #     - data: STR (def: '')
                                  #        - STR can include anything but newlines (will be ignored) (use \n instead)
                                  #        - can be specified multiple times consecutively (will be concatenated)
                                  #     - id: 'ID' (def: '')
                                  #     - retry: NUM: retry connection timeout (def: client-specific)
                                  #Client implementation:
                                  #  - DOM EventSource: SSE connection firing event for each message (see DOM doc)



            
   SECURITY  
            


                                             /=+===============================+=\
                                            /  :                               :  \
                                            )==:           SECURITY            :==(
                                            \  :_______________________________:  /
                                             \=+===============================+=/


SECURITY ==>                      #TLS:
                                  #  - HTTP/2:
                                  #     - not required by specs, but browser implementation does
                                  #     - when used:
                                  #        - must use TLS 1.2+ with SNI extension
                                  #        - if using TLS 1.2, must disable compression, renegotiation
                                  #     - can use INADEQUATE_SECURITY (0xc) error code
                                  #  - HTTP/1.*: not required
                                  #See Websites_security doc

AUTHENTICATION ==>                #See authentication doc

INTEGRITY ==>                     #Digest:
                                  #  - how:
                                  #     - Want-Digest: ALGO[;q=NUM],... [C]
                                  #        - ALGO:
                                  #           - MD5|SHA[-256|512]|UNIXsum|UNIXcksum
                                  #           - MD5|SHA[-256|512] requires base64, other ASCII
                                  #        - NUM: like for Accept* [C]
                                  #     - Digest: ALGO=CHECKSUM[,...] [S]
                                  #  - check integrity for "instance" (not "entity"), body not headers
                                  #  - not implemented by most clients
                                  #Content-MD5 [C]: deprecated

ENCRYPTION ==>                    #As opposed to TLS, encrypt content, not communication
                                  #Reuse Content-Encoding and Accept-Encoding like compression, but with algo aes128gcm



              
   EFFICIENCY  
              



                                             /=+===============================+=\
                                            /  :                               :  \
                                            )==:            CACHING            :==(
                                            \  :_______________________________:  /
                                             \=+===============================+=/


CACHING ==>                       #Vocabulary:
                                  #  - cache hits ratio: % of requests that used cache instead
                                  #  - stale resource (as opposed to fresh): cached but not valid anymore
                                  #  - cache invalidation: removing caching on stale resources
                                  #Types:
                                  #  - client caching:
                                  #     - best performance but for single client
                                  #     - e.g. browser caching
                                  #  - server caching:
                                  #     - shared by many clients but less performant
                                  #     - types:
                                  #        - reverse proxy (between client and server)
                                  #        - between server and database (e.g. Memcached/Redis)
                                  #What is cached:
                                  #  - key:
                                  #     - HTTP method
                                  #     - URI, excluding #HASH
                                  #     - HTTP headers, if Vary: HEADER,... [S]:
                                  #        - whitespaces, orders, case, duplicates will be normalized before comparison
                                  #        - if unconditional caching failed because of different HTTP headers:
                                  #           - client should try conditional caching
                                  #           - but if client does not implement this HEADER, it might not send it, e.g.:
                                  #              - CLIENT_1 -> HEADER    -> PROXY -> HEADER                          -> SERVER -> 2** Vary: HEADER
                                  #              - CLIENT_2 -> no HEADER -> PROXY -> no HEADER (conditional caching) -> SERVER -> 304
                                  #                 - here CLIENT_2 gets same response as CLIENT_1 even though HEADER varied
                                  #           - solutions:
                                  #              - use new status code understood (thus cached) only by clients/proxies that implement HEADER
                                  #                 - ex: 226 for delta encoding
                                  #                 - problem: some clients/proxies cache any unknown status codes
                                  #              - solutions like Cache-Control: im (delta encoding)
                                  #        - HEADER can be *
                                  #        - can significantly increase reverse proxy cache size
                                  #        - use case:
                                  #           - when headers have impact on content, i.e. usually on Accept* [C]
                                  #           - usually towards proxies, since browsers usually use only one set of headers
                                  #     - does not include request body
                                  #  - value: full response (URI, headers, body)
                                  #HTTP methods allowed:
                                  #  - GET
                                  #  - HEAD: theoritically. But web browsers do not seem to allow it.
                                  #  - others: only with conditional caching (except If-Modified-Since), when manually added using XHR
                                  #Status codes:
                                  #  - specified as:
                                  #     - should be cached: 200, 203, 204, 206, 226, 300, 3001, 308, 404, 405, 410, 414, 421, 451, 501
                                  #     - should not cached: 302-307, 428, 429, 431, 511
                                  #     - rest is unspecified
                                  #  - browser default unconditional caching:
                                  #     - Chrome/Opera: 300, 301, 308, 410
                                  #     - Firefox: 410
                                  #  - browser allowed unconditional caching:
                                  #     - Chrome/Opera: all but 205, 401, 416
                                  #     - Firefox: only 200, 203, 206, 410
                                  #Default:
                                  #  - depends on browser, heuristics to guess which type of caching should be used and how long
                                  #  - to avoid
                                  #  - see above for which status code use unconditional cache by default or not
                                  #Types:
                                  #  - history backward/forward caching: no control over it
                                  #  - unconditional caching: see below
                                  #  - conditional caching: see below
                                  #  - no caching: see below
                                  #Debugging:
                                  #  - high-level: about:cache (Chrome, Firefox)
                                  #  - low-level: about:net-internals#httpCache (Chrome)

UNCONDITIONAL CACHING ==>         #Goal:
                                  #  - client uses cache for a given time period, without server interaction
                                  #  - has priority over conditional caching
                                  #Features:
                                  #  - fastest cache method
                                  #  - highest probability of stale resources, except when using timestamping or invalidation push
                                  #  - best for asset files
                                  #Cache-Control: STR,... [C|S]:
                                  #  - client override server
                                  #  - STR (client or server):
                                  #     - no-cache[="HEADER,..."]:
                                  #        - no unconditional caching [of a specific header]
                                  #        - HEADER: only for server
                                  #     - no-store: no form of caching, including unconditional or conditional
                                  #     - max-age=NUM:
                                  #        - how long to cache (in secs), i.e. how long stale resources are ok
                                  #        - max: 1 year
                                  #        - if fingerstamped, should be max value
                                  #        - initial age is max between:
                                  #           - 0
                                  #           - response_received - Date [S]
                                  #           - response_received - request_sent[ + Age: NUM [S]]
                                  #              - Age: in secs, should be incremented by proxies
                                  #     - Expires: DATE [S]:
                                  #        - same as max-age but using a given DATE
                                  #        - older header
                                  #     - stale-if-error=NUM:
                                  #        - on 500-504, use unconditional cache, if stale for <NUM seconds
                                  #        - def: unless must-revalidate
                                  #  - STR (server only):
                                  #     - must-revalidate:
                                  #        - when expires, use conditional caching (if setup)
                                  #        - default of most clients
                                  #     - state-while-revalidate=NUM:
                                  #        - if stale for <NUM seconds, proxy will:
                                  #           - serve stale resource
                                  #           - while retrieving fresh resource in the background for the next request
                                  #     - immutable
                                  #     - retain[=NUM]: see delta encoding
                                  #     - im: see delta encoding
                                  #  - STR (client only):
                                  #     - max-stale=NUM: extend max-age|Expires with NUM seconds
                                  #     - min-fresh=NUM: must be cacheable for at least NUM seconds, otherwise ignore
                                  #     - only-if-cached: 504 if no unconditional cache available
                                  #Proxies:
                                  #  - Cache-Control: STR,... [C|S]:
                                  #     - STR (client or server):
                                  #        - no-transform (see proxy transformations)
                                  #     - STR (server only):
                                  #        - public or private[="HEADER,..,"]:
                                  #           - allow or prohibit (def) proxy caching
                                  #           - private: good for sensitive data, e.g. cookies
                                  #        - s-maxage=NUM: same as max-age but for proxies
                                  #        - proxy-revalidate: same as must-revalidate but for proxies
                                  #  - Surrogate-Control: STR[;TARGET],... [S]:
                                  #     - similar to Cache-Control but from server to proxy (has priority)
                                  #     - supported by many reverse proxies
                                  #     - STR:
                                  #        - no-store: like above
                                  #        - no-store-remote: like no-store but non-last proxies
                                  #        - max-age=NUM[+NUM]: like max-age + stale-while-revalidate above
                                  #        - content="TRANSFORM ..." (see proxy transformations)
                                  #     - TARGET:
                                  #        - identify proxy, when there are several along the chain
                                  #        - no TARGET: "all other TARGET"
                                  #     - proxy use Surrogate-Capabilities: TARGET="VAL ..." to inform:
                                  #        - which Surrogate-Control values are supported
                                  #           - Surrogate/1.0 for the ones above
                                  #        - supported TRANSFORM (see proxy transformations)
                                  #On page refresh:
                                  #  - top-level resource never uses unconditional caching
                                  #  - secondary resources never uses unconditional caching unless Cache-Control: immutable [S] (Chrome/Firefox only)
                                  #Timestamping:
                                  #  - using an ID in the URI that changes when resource changes
                                  #     - e.g. version number, modification date or content checksum
                                  #  - used to invalidate cache on modified resources
                                  #  - top-level resources (i.e. that require timestamped resources) (e.g. main HTML file) cannot be timestamped itself
                                  #Invalidation push:
                                  #  - using push technologies to invalidate resources
                                  #  - allow using unconditional caching with top-level resources
                                  #  - but:
                                  #     - more complex to implement
                                  #     - higher risk of unwanted unconditional caching if something goes wrong

CONDITIONAL CACHING ==>           #Goal:
                                  #  - client sends request with information about latest representation
                                  #  - server does not send body if resource has not changed
                                  #Features:
                                  #  - slower method but no possibility of stale resources
                                  #  - does not require timestamping
                                  #  - best for top-level resources, e.g. main HTML file or AJAX calls
                                  #How:
                                  #  - server use "validators":
                                  #     - Last-Modified: DATE [S]
                                  #        - of the "instance" (not "entity")
                                  #     - ETag: "ETAG" [S]
                                  #        - usually content hash or version number
                                  #        - [:graph:]
                                  #        - ETAG:
                                  #           - "...":
                                  #              - strong, same "instance" (not "entity"), i.e. same byte-wise
                                  #              - usually not shared by different representations
                                  #              - preferred
                                  #           - W/"...":
                                  #              - weak, same "resource", i.e. same semantically but not necessarily byte-wise
                                  #              - usually shared by different representations
                                  #              - cannot be used with:
                                  #                 - If-Range [C]
                                  #                 - If-Match [C] or If-Unmodified-Since [C]
                                  #                 - delta encoding
                                  #              - "..." == W/"..."
                                  #  - client include latest representation:
                                  #     - If-Modified-Since: DATE [C]
                                  #     - If-None-Match: "ETAG"|*,... [C]
                                  #        - if specified, If-Modified-Since is ignored
                                  #        - can use several if client cached several
                                  #  - server:
                                  #     - normal response: condition matches
                                  #     - 304 (Not Modified) with no body: condition does not match
                                  #Proxies:
                                  #  - Warning: 1** - "DESCRIPTION" "DATE" [S] + 304 (Not Modified)
                                  #     - caching-related warnings
                                  #     - can be:
                                  #        - 110 "Response is Stale": proxy served stale resource instead of retrieving fresh one from server
                                  #        - 111 "Revalidation Failed": same as 110, but reason is because server unavailable
                                  #        - 112 "Disconnected Operation": same as 110, but reason is proxy not connected to network
                                  #        - 113 "Heuristic Expiration"
                                  #        - 199 "Miscellaneous Warning"

NO CACHING ==>                    #Features:
                                  #  - slowest method, but:
                                  #     - best if resource never same, e.g. anything that contains time-dependent/always-unique server-side content
                                  #     - prevent caching credentials
                                  #How:
                                  #  - server:
                                  #      Cache-Control: no-cache[="HEADER"], no-store, private, must-revalidate
                                  #  - client (works also for HTTP/1.0 servers):
                                  #      Cache-Control: no-cache, no-store, private, must-revalidate
                                  #      Pragma: no-cache
                                  #      Expires: 0

DELTA ENCODING ==>                #Very poor support both client-side and server-side
                                  #Goal:
                                  #  - reduce response body size:
                                  #     - client:
                                  #        - use conditional caching request
                                  #        - but has cache of older version
                                  #     - server:
                                  #        - cannot respond with 304 (since older version)
                                  #        - responds with diff instead of full new entity
                                  #     - client applies diff to older cached version
                                  #  - means both server and client need to keep older versions
                                  #Must be done together with conditional caching:
                                  #  - If-None-Match: "ETAG",... [C] (strong)
                                  #  - ETag: "ETAG" [S]
                                  #How:
                                  #  - client:
                                  #     - A-IM: ALGO[;VAR=VAL][;q=NUM],... [C]
                                  #        - ALGO:
                                  #           - specifies:
                                  #              - order in which content-encoding transformation should be applied
                                  #              - which DIFF_ALGO are supported
                                  #           - can be:
                                  #              - DIFF_ALGO:
                                  #                 - vcdiff
                                  #                 - gdiff
                                  #                 - diffe: diff -e
                                  #              - COMPRESSION_ALGO
                                  #              - range
                                  #        - VAR: ALGO params
                                  #        - q=NUM: see content negotation
                                  #  - server:
                                  #     - 226 (IM Used)
                                  #     - IM: ALGO[;VAR=VAL],... [S] (see content negotiation)
                                  #     - Delta-Base: "ETAG" [S]
                                  #        - source of the diff
                                  #        - mandatory when several "ETAG" specified in If-None-Match [C], recommended otherwise
                                  #     - 406 (Not Acceptable): see content negotiation
                                  #Caching:
                                  #  - can cache 226 responses either as full entity (200 or 206) or as diff (226)
                                  #  - Vary: A-IM [S]:
                                  #     - client cache should implicitely use Vary: A-IM [S]
                                  #     - but needs to be explicit for proxies that do not understand delta encoding
                                  #     - should also use Cache-Control: no-store, im [S]:
                                  #        - see Vary [S] above for the problem associated with it
                                  #        - proxies that understand delta encoding should ignore no-store if "im" is present
                                  #        - proxies that do not understand delta encoding will use no-store
                                  #  - Cache-Control: retain[=NUM] [S]
                                  #     - hint that client should keep response cached because it might be used later as diff source
                                  #     - for NUM seconds (same calculation as Cache-Control max-age)

BAD PRACTICES ==>                 #But used to be good with HTTP/1.*
                                  #Domain sharding.
                                  #Concatenation:
                                  #  - performance impact:
                                  #     - lower number of requests
                                  #     - but invalidates cache more often
                                  #  - HTTP/2:
                                  #     - does not have limit on number of parallel requests
                                  #     - keep TCP socket always alive
                                  #     - so roundtrip performance impact is less important
                                  #  - types of concatenation:
                                  #     - file plain concatenation
                                  #     - sprites
                                  #     - inlining, e.g. <link> -> <style>
                                  #     - data URIs


                                             /=+===============================+=\
                                            /  :                               :  \
                                            )==:          PREFETCHING          :==(
                                            \  :_______________________________:  /
                                             \=+===============================+=/


PREFETCHING ==>                   #Types, from most performant to least:
                                  #  +--------------+----------------------------------------------+---------------------------------------------------------------------+---------------------------------+
                                  #  | Type/REL     | Use case                                     | Effects                                                             | Browser support                 |
                                  #  |              +--------------------+------------+------------+-----------+-------------------------+-------+---------+-------------+                                 |
                                  #  |              | Resource for which | Known path | Likelihood | Initiated | When is resource        | Loads | Parse + | Protocols   |                                 |
                                  #  |              | navigation action  |            |            | by        | fetched                 |       | render  |             |                                 |
                                  #  +--------------+--------------------+------------+------------+-----------+-------------------------+-------+---------+-------------+---------------------------------+
                                  #  | server push  | Current            | Yes        | Certain    | server    | right away (no request) | Yes   | Yes     | HTTP        | All                             |
                                  #  +--------------+--------------------+------------+------------+-----------+-------------------------+-------+---------+-------------+---------------------------------+
                                  #  | 103          | Current            | Yes        | Certain    | client    | async right away        | No    | No      | HTTP        | None                            |
                                  #  +--------------+--------------------+------------+------------+-----------+-------------------------+-------+---------+-------------+---------------------------------+
                                  #  | preload      | Current            | Yes        | Certain    | client    | async right away        | No    | No      | HTTP        | Chrome/Opera                    |
                                  #  +--------------+--------------------+------------+------------+-----------+-------------------------+-------+---------+-------------+---------------------------------+
                                  #  | modulepreload| Current            | Yes        | Certain    | client    | async right away        | No    | No      | HTTP        | Chrome                          |
                                  #  +--------------+--------------------+------------+------------+-----------+-------------------------+-------+---------+-------------+---------------------------------+
                                  #  | preconnect   | Current            | No         | Certain    | client    | async right away        | No    | No      | DNS         | Chrome/Opera/Firefox            |
                                  #  +--------------+--------------------+------------+------------+-----------+-------------------------+-------+---------+-------------+---------------------------------+
                                  #  | prerender    | Next               | Yes        | High       | client    | after document.onload   | No    | Yes     | HTTP        | Chrome/Opera/IE                 |
                                  #  +--------------+--------------------+------------+------------+-----------+-------------------------+-------+---------+-------------+---------------------------------+
                                  #  | prefetch     | Next               | Yes        | Middle/low | client    | after document.onload   | No    | No      | HTTP        | not [mobile] Safari             |
                                  #  +--------------+--------------------+------------+------------+-----------+-------------------------+-------+---------+-------------+---------------------------------+
                                  #  | dns-prefetch | Next               | No         | Middle/low | client    | after document.onload   | No    | No      | DNS+TCP/TLS | All                             |
                                  #  +--------------+--------------------+------------+------------+-----------+-------------------------+-------+---------+-------------+---------------------------------+

MODULEPRELOAD ==>                 #Like 'preload' except optimized for ES modules, i.e. <script type="module">:
                                  #  - does ES modules parsing
                                  #  - ignores "crossorigin" HTML attribute in cache key
                                  #  - some browsers will also preload dependencies (i.e. from "import"), but using a flat list
                                  #    is better

SERVER PUSH STREAM ==>            #(HTTP/2)
                                  #Send additional resources in a single response
                                  #How:
                                  #  - enabled by SETTINGS_ENABLE_PUSH (0x2) (def: true)
                                  #  - initiated by server, in reaction to client request
                                  #  - server: PUSH_PROMISE frame:
                                  #     - contains HEADERS frame information that client would send if it was to request this stream
                                  #     - the original request cannot contain request body
                                  #     - the pushed request must be cacheable, e.g. use safe method
                                  #  - client:
                                  #     - RST_STREAM frame with CANCEL|REFUSED_STREAM error code to cancel request, e.g. if cached
                                  #     - server reacts to RST_STREAM but does not wait for client to send next frames
                                  #  - server:
                                  #     - HEADERS, DATA: like normal response
                                  #Performance:
                                  #  - less roundtrips than resource hints
                                  #  - but should push only resources that would have been requested
                                  #Caching:
                                  #  - uses pseudo-client request for caching, so works the same as normal request
                                  #  - client request must be cacheable, i.e. GET with cache headers
                                  #Need to be initiated by a request (so not realtime)
                                  #As opposed to resource hints, coming from server so cannot be used if:
                                  #  - client needs knowledge about fetching: resource path, load|error event
                                  #  - fetching needs knowledge about client: state (cookies, localStorage), user agent info (Accept [C], etc.)

RESOURCE HINTS ==>                #Use Link [S] (or <link>) REL
                                  # ATTR:
                                  #  - pr 'FLOAT' (0-1) (all)
                                  #     - probability the link will be followed
                                  #     - used for prioritization or reducing optimization/fetching
                                  #  - as TYPE (preload|prefetch):
                                  #     - WINDOW.fetch() destination type,
                                  #       i.e. script|style|image|font|media|object|embed|document|xslt|manifest|report|service|shared]worker
                                  #     - used for CSP and Accept [C]
                                  #  - nopush (preload): if a HTTP2 server push has been received for that resource, do not use it
                                  #Prerender parsing/execution:
                                  #  - in the background, i.e. not visible but will provide very fast cache
                                  #  - only kept for short while, so should be next navigation
                                  #  - resource intensive: should only be used when confident about next navigation action
                                  #  - only HTML resources
                                  #  - can debug with about:net-internals#prerender (Chrome)
                                  #DNS prefetching:
                                  #  - already done by browsers on <a|area href>
                                  #  - can disable with <meta http-equiv="x-dns-prefetch-control" content="off">/
                                  #Does not delay document.onload
                                  #Could previously use noop XHR to achieve something similar
                                  #Can be:
                                  #  - speculative: before user interaction that might trigger HTTP request
                                  #  - reactive: after user interaction that will certainly trigger HTTP request, after some delay
                                  #Possible problems:
                                  #  - when HTTP GET request has side effects (which is improper)
                                  #  - increase bandwith usage
                                  #  - overestimate tracking (ads, analytics):
                                  #     - can use document.visibilityState 'prerender' to handle it
                                  #  - security: website make decision (not user) to trust content by browsing it
                                  #  - cannot see in devtools network tab, but can see "prerender" using chrome://net-internals/#prerender

EARLY HINTS ==>                   #Status code 103 (Early Hints):
                                  #  - partial response, with only headers that will *probably* be in final response
                                  #     - not about headers that will probably *not* be in final response
                                  #  - goal is to hint at headers before even knowing status code
                                  #  - informational status code, i.e.:
                                  #     - emitted before final response
                                  #     - can be emitted several times, in which case successive 103s can omit headers
                                  #       present in previous ones
                                  #  - often used for prefetching Link [S]


                                             /=+===============================+=\
                                            /  :                               :  \
                                            )==:          MONITORING           :==(
                                            \  :_______________________________:  /
                                             \=+===============================+=/


SERVER TIMING ==>                 #Server-Timing: NAME[;PROP=VAL],... [S]
                                  #PROP can be:
                                  #  - dur NUM (in ms)
                                  #  - desc "STR"
                                  #  - anything else
                                  #Indicates timing of server events to client.
                                  #Can be accessed:
                                  #  - In devtools
                                  #  - With DOM PerformanceServerTiming


                                             /=+===============================+=\
                                            /  :                               :  \
                                            )==:           BODY SIZE           :==(
                                            \  :_______________________________:  /
                                             \=+===============================+=/


COMPRESSION ==>                   #How:
                                  #  - client:
                                  #     - Accept-Encoding: COMPRESSION_ALGO[;q=NUM],... [C] (see content negotiation)
                                  #     - COMPRESSION_ALGO:
                                  #        - standard:
                                  #           - "*": any
                                  #           - "identity" (none)
                                  #           - "compress":
                                  #              - worst compression, older
                                  #              - older: not supported anymore
                                  #           - "deflate":
                                  #              - DEFLATE/INFLATE algorithm
                                  #              - inconsistent support: either without a wrapper format (IE) or with zlib wrapper format (other browsers)
                                  #           - "gzip":
                                  #              - DEFLATE/INFLATE algorithm, with gzip wrapper format
                                  #           - "exi":
                                  #              - better compression than DEFLATE, for XML files
                                  #              - w3c standard but no browser support
                                  #           - "br" (Brotli):
                                  #              - best compression. Same decompression speed as DEFLATE but slower at compressing.
                                  #              - browser support: Firefox, Chrome, Opera, Safari
                                  #        - not standard:
                                  #           - "bzip2"
                                  #              - better compression than DEFLATE but slower
                                  #              - browser support: Firefox only with specific build flag
                                  #           - "lzma":
                                  #              - better compression than DEFLATE but slower
                                  #              - better compression than bzip2, but slower, faster at decompressing but slower at compressing
                                  #              - browser support: Opera
                                  #           - "xz":
                                  #              - LZMA2
                                  #              - browser support: Firefox only with specific build flag
                                  #           - "sdch":
                                  #              - based on VCDIFF
                                  #              - does not seem really maintained anymore
                                  #              - browser support: Opera, Chrome
                                  #        - server should offer in order: br, [sdch,] lzma, gzip, identity
                                  #  - server:
                                  #     - Content-Encoding: COMPRESSION_ALGO,... [S] or 406 (see content negotiation)
                                  #        - can also use Transfer-Encoding: COMPRESSION_ALGO [S]: more proper but less support, and forbidden by HTTP/2
                                  #     - Accept-Encoding: COMPRESSION_ALGO,... [S]: which one could have been possible
                                  #Server should cache compression
                                  #Can also use compression on request body by reusing same headers, but inverse, although
                                  #it is less commonly implemented.

BIG BODY ==>                      #Request:
                                  #  - Chunked transfer encoding, not sending END_STREAM flag (see body unknown size)
                                  #  - sending header before sending body:
                                  #     - client: Expect: "100-continue" [C], no request body
                                  #     - server:
                                  #        - 100 (Continue): client should continue with request body (no response body)
                                  #        - 3|4|5**: client should not continue with request body
                                  #        - 417 (Expectation Failed) if Expect [C] not supported
                                  #     - client (if 100): request body
                                  #Response:
                                  #  - Chunked transfer encoding, not sending END_STREAM flag (see body unknown size)
                                  #  - request specific ranges (byte serving): see byte serving

BYTE SERVING ==>                  #Init:
                                  #  - server:
                                  #      200 (OK)
                                  #      Accept-Ranges: VAL [S]:
                                  #        - bytes
                                  #        - none (def)
                                  #        - any other UNIT: will require different Range [C] and Content-Range [S] values
                                  #      Empty response body
                                  #Each range:
                                  #  - client:
                                  #     - only GET
                                  #     - Range: bytes=RANGE,... [C]
                                  #        - RANGE: NUM-[NUM2] or -NUM (last bytes)
                                  #     - If-Range: ETAG|MDATE [C] (optional)
                                  #        - like If-Match|If-Unmodified-Since, except if fails, should ignore Range [C]
                                  #        - goal: only retrieve each range if "instance" remains the same (otherwise would be corrupted)
                                  #  - server:
                                  #     - success:
                                  #        - 206 (Partial Content)
                                  #        - caching:
                                  #           - ETAG|MDATE:
                                  #              - designates the "instance", not "entity", i.e.:
                                  #                 - whole resource not RANGE
                                  #                 - must be same as first 200 (OK) response
                                  #           - ETAG must be strong
                                  #        - Accept-Ranges: VAL [S]
                                  #        - only one RANGE was requested:
                                  #            Content-Range: bytes NUM-NUM2/TOTAL [S]
                                  #              - TOTAL can be * if unknown
                                  #        - several RANGEs were requested:
                                  #            Content-Type: "multipart/byteranges; boundary=STR" [S], with body:
                                  #              STR
                                  #              [Content-Type: TYPE]
                                  #              Content-Range: bytes NUM-NUM2/TOTAL
                                  #              content as is
                                  #              STR
                                  #              ...
                                  #              STR--
                                  #     - failure:
                                  #         416 (Requested Range Not Satisfiable)
                                  #         Content-Range: bytes */TOTAL [S]

PARTIAL BODY ==>                  #Request:
                                  #  - PATCH method (see PATCH)
                                  #Response:
                                  #  - HEAD method (see HEAD)
                                  #  - Prefer: return=minimal [C]:
                                  #     - like HEAD but can be done on other HTTP methods, and can include request body
                                  #  - Prefer: return=representation [C]:
                                  #     - should return only what has been changed by request, not full resource
                                  #     - should also include Content-Location [S] to full resource

EMPTY BODY ==>                    #E.g. DELETE, If-Unmodified-Since [C], If-Match [C]
                                  #Status code:
                                  #  - 204 (No Content):
                                  #     - client has latest representation, i.e. does not need to refresh resource with a new GET
                                  #     - e.g. browsers will not reload after a <form> POST
                                  #  - 205 (Reset Content):
                                  #     - resource went back to representation before modification, i.e. should reset resource to previous state
                                  #     - not implemented by browsers


                                             /=+===============================+=\
                                            /  :                               :  \
                                            )==:             TASKS             :==(
                                            \  :_______________________________:  /
                                             \=+===============================+=/


ASYNC ==>                         #202 (Accepted):
                                  #  - async processing
                                  #  - client can timeout
                                  #  - should include link to monitor processing status, e.g. using Content-Location [S]
                                  #Prefer: respond-async [C]:
                                  #  - should process async (if takes too long) and return 202
                                  #Prefer: wait=NUM [C]
                                  #  - should not wait more than NUM seconds to process async
                                  #  - can be combined with Prefer: respond-async [C]

STREAM PRIORITIZATION ==>         #(HTTP/2)
                                  #  - receiver is not constrained to respect it
                                  #  - fields/flags on HEADERS|PRIORITY frame. Must set PRIORITY flag
                                  #  - priority: Weight field 1-256 (def: 16): how much resources server should allocate
                                  #  - dependency:
                                  #     - Parent stream ID field (def: 0, i.e. none): current stream must only start once stream ID is done
                                  #     - Exclusive field: make siblings become children of current stream


                                             /=+===============================+=\
                                            /  :                               :  \
                                            )==:            ERRORS             :==(
                                            \  :_______________________________:  /
                                             \=+===============================+=/


LOAD ==>                          #  - throttle:
                                  #     - 429 (Too Many Requests):
                                  #     - (HTTP/2) ENHANCE_YOUR_CALM (0xb) error code
                                  #  - 503 (Service Unavailable): client cannot connect to server
                                  #  - any may include Retry-After [S]
                                  #  - every request can be accompanied with following non-standard headers:
                                  #     - X-RateLimit-Limit: NUM [S]: number of requests available for time period
                                  #     - X-RateLimit-Remaining: NUM [S]: number of requests left for time period
                                  #     - X-RateLimit-Reset: NUM [S]: number of seconds left in time period

TIMEOUT ==>                       #Request:
                                  #  - 408 (Request Timeout): client timeout. Connection should be closed.
                                  #Request|response:
                                  #  - (HTTP/2) SETTINGS_TIMEOUT (0x4) error code: SETTINGS timeout



               
   DEVELOPMENT  
               



                                             /=+===============================+=\
                                            /  :                               :  \
                                            )==:         DOCUMENTATION         :==(
                                            \  :_______________________________:  /
                                             \=+===============================+=/


DOCUMENTATION ==>                 #OPTIONS:
                                  #  - safe HTTP method
                                  #  - retrieve communication options
                                  #  - use cases:
                                  #     - server functionalities|features
                                  #     - document specific resource, e.g. accepted HTTP methods, parameters, description, example, etc.
                                  #  - URI: can use * to mean "any resource"
                                  #  - request body: none
                                  #  - response headers|body:
                                  #     - communication options
                                  #        - accepted HTTP methods: can use Allow [S] and Accept-Patch [S] (see HTTP methods)


                                             /=+===============================+=\
                                            /  :                               :  \
                                            )==:           DEBUGGING           :==(
                                            \  :_______________________________:  /
                                             \=+===============================+=/


DEBUGGING ==>                     #TRACE:
                                  #  - safe HTTP method
                                  #  - echoes request
                                  #  - use cases: see changes introduced by servers|proxies
                                  #  - body:
                                  #     - request: none
                                  #     - response: not specified, but Content-Type "message/http"
                                  #Pages:
                                  #  - HTTP: about:networking#http (Firefox)
                                  #  - HTTP/2: about:net-internals#http2 (Chrome)



               
   UNSUPPORTED  
               



POLYFILLS ==>                     #
UPDATING ==>                      #
STAGES ==>                        #
UNSUPPORTED BROWSERS ==>          #
PARTIAL SUPPORT ==>               #See HTML doc

FULLY SUPPORTED ==>               #Main ones:
                                  #  - HTTP/2: 7540
                                  #  - HTTP/1.1: 7230, 7231
                                  #  - HTTP/1.0: 1945
                                  #  - misc HTTP status codes: 6585
                                  #Protocol/format:
                                  #  - syntax:
                                  #     - VAR*=UTF-8''VAL: 5987, https://greenbytes.de/tech/webdav/draft-reschke-rfc5987bis-latest.html
                                  #Errors:
                                  #  - generic:
                                  #     - 5** response body: 7807
                                  #  - specific:
                                  #     - 451 status code: 7725
                                  #Content:
                                  #  - semantics:
                                  #     - HTTP methods: 7237
                                  #     - Safe [S]: 2310
                                  #     - PATCH: 5789, 7396
                                  #  - content processing:
                                  #     - Prefer [C]: 7240
                                  #  - content negotiation:
                                  #     - transparent: 2295
                                  #     - RVSA: 2296
                                  #     - Accept-Encoding [C]: 7694
                                  #  - memento: 7089
                                  #  - links:
                                  #     - 308 status code: 7538
                                  #     - Alt-* [S]: 7838
                                  #     - Link [S]:
                                  #        - 8288, 6903, 2068#section-19.6.1.2
                                  #        - https://tools.ietf.org/html/draft-snell-link-method-12
                                  #        - https://www.w3.org/Protocols/HTTP/Methods/Link.html
                                  #     - SourceMap [S]: Source Map Revision 3 Proposal
                                  #State/context:
                                  #  - session:
                                  #     - cookies:
                                  #        - syntax: 6265
                                  #        - usage: 2964
                                  #  - tracking:
                                  #     - DNT: w3c
                                  #Communication:
                                  #  - browser:
                                  #     - Content-disposition: 6266
                                  #  - proxies:
                                  #     - Forwarded [C]: 7239
                                  #     - usage recommendation: 3143, 3205
                                  #  - concurrency:
                                  #     - long polling: 6202
                                  #Security:
                                  #  - integrity:
                                  #     - Digest [S]: 3230
                                  #Efficiency:
                                  #  - caching:
                                  #     - unconditional: 5861, 7234
                                  #     - conditional: 7232
                                  #     - Surrogate-*: w3c "edge-arch"
                                  #     - delta encoding: 3229
                                  #     - immutable: 8246
                                  #  - prefetching:
                                  #     - resource hints: w3c
                                  #  - body size:
                                  #     - Range [C]: 7233
                                  #  - compression:
                                  #     - Brotli: 7932

FULLY|PARTIALLY UNSUPPORTED ==>   #Follows, by category.


PROTOCOL/FORMATS ==>          IE11#HTTP/2 (IE11 below Windows 10, Safari below OSX 10.11)

CONTENT ==>                   IE11#Safe [S]
                              IE11#Memento
                              IE11#Alternate services, ORIGIN frame

COMMUNICATION ==>            $IE11#Server-Sent Events

SECURITY ==>                  IE11#Digest [S]

EFFICIENCY ==>                IE11#Cache-Control: immutable [S]
                              IE11#Delta encoding
                             S10.0#Resource hints
                              IE11#103 (Early Hints): 8297
                              IE11#Compression: exi, bzip2, lzma, xz, sdch, br