Available inEnglishFrenchGermanHindiPortugueseRussianSpanish
HTTP and REST for Backend Interviews
Say why a status code, a header or a cookie flag behaves the way it does, and read a broken exchange back to its fault. For backend developers who have shipped REST APIs and never had to explain them out loud. Eighty-eight cards follow one request: the message, methods, status codes, caching, cookies and CORS, REST trade-offs, HTTP/2 and 3, and login tokens; vulnerability classes belong to the OWASP deck.
Slot B is the one header field every HTTP/1.1 request must carry. Name it and say what it does.
Host. It names the authority the request is aimed at, so one address can serve many sites.
— The request target omits the authority, so something else must supply it.
Source
RFC 9110 §7.2: a client MUST send a Host field in an HTTP/1.1 request, and a server MUST reject a request that lacks one with 400. Virtual hosting exists because of this single field. HTTP/2 and HTTP/3 replace it with the :authority pseudo-header, which carries exactly the same information.