HTTP

**Quick judgment:** This skill encodes solid, production-grade HTTP best practices, especially around redirects, caching, conditional requests, CORS, and security headers. It is well-suited for API and backend work where protocol correctness matters. **Strengths:** - Emphasizes correct use of status codes, redirects (307/308 vs 301/302), and error semantics (409 vs 412). - Provides nuanced caching and validation patterns (Cache-Control combinations, ETag/If-None-Match, If-Match for optimistic locking). - Promotes robust client behavior (idempotent retries, exponential backoff with jitter, respecting Retry-After, sensible timeouts). - Encourages key security protections (HSTS, CSP, clickjacking and MIME-sniffing defenses) and non-leaky error handling. **Risks / Limitations:** - Opinionated guidance may be misapplied if users don’t understand implications (e.g., aggressive HSTS with includeSubDomains, long max-age caching for content that actually changes). - Focuses on HTTP fundamentals and common production scenarios but doesn’t cover every specialized protocol feature or all deployment edge cases. **Recommended scenarios:** - Designing or refactoring HTTP APIs and backend services where correctness, cache behavior, and security headers are important. - Configuring gateways/load balancers/CDNs for safe redirects, caching, and partial content. - Building robust HTTP clients that handle retries, errors, and CORS correctly in web or service-to-service environments.