HTTP in a Hostile World
summary
Explains concrete HTTP fixes: generate a 128‑bit UUID token per action and persist it with a unique DB index to enforce idempotence; record real traffic with Charles and test against Square’s MockWebServer; make assets immutable by versioned URLs and a year‑long cache (max‑age=31536000); use TLS everywhere and limit trust with certificate pinning; adopt OkHttp/Retrofit or gRPC, move heavy bytes to CDNs, and prepare for Envoy and HTTP/3/QUIC for better worst‑case latency.
AI-written summary · about
chapters (32)
- 0:00Start
- 0:59HTTP?
- 4:34HTTP in a Hostile World?
- 6:01What Triggers Repeats?
- 6:27Implementing Idempotence: Identify Intention
- 8:27API Contract v. 1
- 9:42Middleboxes!
- 10:42Designing HTTP APIs
- 11:06Status Codes
- 13:29REST: Retrofit
- 15:08Images: Coll
- 15:18Testing: MockWebServer
- 18:10Debugging: Charles Proxy
- 18:33Redundancy!
- 19:37Connectivity is a Lie
- 20:43Request Avoidance
- 22:01Precise Caching
- 22:15Good-Enough Caching
- 23:20Compression
- 23:46CDNs
- 25:33Granularity
- 27:23Data is Dangerous
- 29:42Other People's Secrets?
- 31:57TLS: Necessary
- 32:16TLS: Not Sufficient
- 34:40Defending against Nation-State Attacks
- 35:13TLS Evolution
- 36:44Objection
- 37:07Defending Against Whitebox Attackers
- 37:51Envoy
- 39:06HTTP/3
- 43:02OkHttp
related talks
39mHTTP headers for the responsible developer
31mHTTP Security Headers: A Technology History Through Scar Tissue
40mHTTP Headers for the Responsible Developer
50mCommon API security pitfalls
40mWhirlwind tour through the HTTP2 spec
32mREST security essentials
43mHTTP Can Do That?!
45mHTTP Desync Attacks: Smashing Into The Cell Next Door