Answers

The network and the web

Everything between one machine asking and another answering, including the part that makes it private and the part that draws the page.

1. Where should a session ID be stored so JavaScript can't read it?Store it in an HttpOnly cookie set by the server; that is the only browser storage JavaScript running on the page cannot read.
2. What does it mean for an API method to be safe?A safe method is one that changes nothing on the server when it is called, so a caller may repeat it freely and a cache or a crawler may use it without anything being altered.
3. Does signing out actually invalidate my token on the server?No. Signing out clears your browser's copy of the token, but the server keeps accepting that token until it expires.
4. Why does the TLS handshake take so many round trips before any data is sent?It is not one key exchange. The handshake agrees a secret, proves the server's identity and checks for tampering, and modern TLS fits those into one round trip; a fresh connection still needs three before the page starts.
5. If a website has HTTPS, can someone on the same Wi-Fi read my password?No. HTTPS encrypts the form contents and cookies, so someone on the same Wi-Fi cannot read the password itself; they can still see the site, timing and packet sizes.
6. Why does a DNS lookup sometimes have to ask several servers before it gets an answer?Because when no cache already holds the address, the resolver has to ask one server at a time down the hierarchy, and each reply only tells it who to ask next.
7. How can another site make a request as me if it can't read my cookies?A foreign page does not need to read your cookie. It makes your browser send a request to the site that owns the cookie, and the browser attaches the cookie automatically.
8. Why does opening a connection take three messages instead of two?Three messages are needed because the server must also learn that its own reply arrived; the third message is that proof, not a formality.
9. How can two computers agree on a secret key when anyone can listen?Each computer sends a scrambled number made from a private number; the shared key is made by scrambling the other computer's number with one's own private number, and a listener cannot unscramble it.
10. What's wrong with naming an API endpoint after an action like /getUser?Naming an endpoint after an action bakes one operation into its address, so every new operation needs a new endpoint and the thing being acted on never gets a stable name.
11. Why isn't a password plus a security question really two-factor authentication?A security question is another thing you know, so it is the same kind of proof as a password, not a second kind.
12. How does a man-in-the-middle attack still work if the key exchange is secure?A key exchange proves only that you share a secret with whoever answered. An attacker on the path answers you themselves and opens a second exchange to the real server, so both halves look secure.
13. How do I design an error response that a client can actually handle?Give every failure a fixed code a program can branch on and say plainly whether trying again could help, then put the human explanation last.
14. What's the difference between safe and idempotent in HTTP methods?Safe means the call changes nothing; idempotent means repeating the call leaves the same result, even if the first call changed something.
15. Why do I need an idempotency key if my operation is already idempotent?You need the key because repeating an operation safely still leaves the caller unsure what happened, and the key returns the first answer.
16. What does a CDN actually change about my request?A CDN puts a machine near the reader that answers the request itself, so your origin often never sees it and the address it logs is not the reader's.
17. Does HTTPS hide the domain name of the site I'm visiting from my ISP?Usually not: the site's name is sent in readable form twice, once when your computer looks up its address and once when the secure connection opens.
18. Why does a <script> tag stop the rest of the page from being parsed?A script tag stops the parser because the script can change the page being built, so the browser must fetch and run it before it knows what comes next.
19. Why is animating width so much slower than animating transform?Animating width is slower because each change forces layout and repaint, while a transform on a promoted element skips both and only reassembles the frame.
20. Why does a download start slow and then speed up?The sender starts with about fourteen kilobytes in flight and doubles that each round trip until something is lost, so the opening round trips measure the path rather than move data.

The other subjects