HTTP headers for the responsible developer
summary
Headers actually change behavior: HSTS with preload forces HTTPS and skips slow redirects, CSP with report-only CSP lets broken sites be found before blocking, and HTTP Archive shows 6% adoption of CSP today. Brotli + gzip yields big wins—example CSS goes 100k→15k→10k—and Brotli support is green. Use cache-control immutable for fingerprinted assets, send Vary when responses depend on Accept headers, and combine client hints, Save-Data and feature-policy to serve cheaper, safer, respectful pages.
AI-written summary · about
chapters (18)
- 0:00Intro
- 0:11My journey on the web
- 1:38The web connects people
- 3:21We should be building for everybody
- 3:58The challenge of building a "good" website
- 6:20The web is a scary place
- 12:31Upgrade HTTP requests
- 17:08How many pages use CSP?
- 18:20The web is crucial for people.
- 22:35Brotli tends to compress better with the same speed
- 22:49You don't have to do it on the fly...
- 24:23Serve a tailored version via server/service worker
- 25:39Let's use the platform and make these features more visible
- 28:04The web is with us every day
- 30:05This is great to speed up critical resources
- 30:22Don't annoy the user (aka. the AMP reaction)
- 32:33What happened to the most annoying one?
- 34:58Building for the web is very hard Me
related talks
23mHTTP headers for the responsible developer
40mHTTP Headers for the Responsible Developer
30mHTTP headers for the responsible developer
46mHeaders for Hackers
31mHTTP Security Headers: A Technology History Through Scar Tissue
59mHTTP Security Headers You Need To Have On Your Web Apps
45mHeaders for hackers
30mHeaders for Hackers