If you set a cookie like this: Set-Cookie: name=value then the cookie will only apply to the request domain, and will only be sent for requests to the exact same domain, not any other subdomains. (See What is a host only cookie?) Two different domains (e.g. example.com and subdomain.example.com, or sub1.example.com and sub2.example.com) can only … Read more
No. The HTML 5 spec mentions: The method and formmethod content attributes are enumerated attributes with the following keywords and states: The keyword get, mapping to the state GET, indicating the HTTP GET method. The GET method should only request and retrieve data and should have no other effect. The keyword post, mapping to the … Read more
Let’s take a look at what happens when you select a file and submit your form (I’ve truncated the headers for brevity): POST /upload?upload_progress_id=12344 HTTP/1.1 Host: localhost:3000 Content-Length: 1325 Origin: http://localhost:3000 … other headers … Content-Type: multipart/form-data; boundary=—-WebKitFormBoundaryePkpFF7tjBAqx29L ——WebKitFormBoundaryePkpFF7tjBAqx29L Content-Disposition: form-data; name=”MAX_FILE_SIZE” 100000 ——WebKitFormBoundaryePkpFF7tjBAqx29L Content-Disposition: form-data; name=”uploadedfile”; filename=”hello.o” Content-Type: application/x-object … contents of file goes … Read more
I had this same question, and found some info in my searches (your question came up as one of the results). Here’s what I determined… There are two sides to the Cache-Control header. One side is where it can be sent by the web server (aka. “origin server”). The other side is where it can … Read more
Header names are not case sensitive. From RFC 2616 – “Hypertext Transfer Protocol — HTTP/1.1”, Section 4.2, “Message Headers”: Each header field consists of a name followed by a colon (“:”) and the field value. Field names are case-insensitive. The updating RFC 7230 does not list any changes from RFC 2616 at this part.
The spec does not explicitly forbid or discourage it, so I would tend to say it is allowed. Microsoft sees it the same way (I can hear murmuring in the audience), they state in the MSDN article about the DELETE Method of ADO.NET Data Services Framework: If a DELETE request includes an entity body, the … Read more
For input validation failure: 400 Bad Request + your optional description. This is suggested in the book “RESTful Web Services”. For double submit: 409 Conflict Update June 2014 The relevant specification used to be RFC2616, which gave the use of 400 (Bad Request) rather narrowly as The request could not be understood by the server … Read more
HTTP PUT: PUT puts a file or resource at a specific URI, and exactly at that URI. If there’s already a file or resource at that URI, PUT replaces that file or resource. If there is no file or resource there, PUT creates one. PUT is idempotent, but paradoxically PUT responses are not cacheable. HTTP … Read more
The recommendation is was to start their name with “X-“. E.g. X-Forwarded-For, X-Requested-With. This is also mentioned in a.o. section 5 of RFC 2047. Update 1: On June 2011, the first IETF draft was posted to deprecate the recommendation of using the “X-” prefix for non-standard headers. The reason is that when non-standard headers prefixed … Read more
TL;DR Summary; if you have binary (non-alphanumeric) data (or a significantly sized payload) to transmit, use multipart/form-data. Otherwise, use application/x-www-form-urlencoded. The MIME types you mention are the two Content-Type headers for HTTP POST requests that user-agents (browsers) must support. The purpose of both of those types of requests is to send a list of name/value … Read more