Http on Commentary of Takao

Speeding Up assets Loading using DNS-Prefetch and Preconnect

Wed, 15 Apr 2026 00:00:00 +0900

Introduction

Every external resource — fonts, scripts, images, API endpoints — requires a network connection. The overhead of DNS resolution, TCP handshake, and TLS negotiation can add hundreds of milliseconds to page load time. Resource hints like dns-prefetch and preconnect let you tell the browser to perform these steps in advance, before the resource is actually needed.

The Cost of Connection

Establishing an HTTPS connection involves multiple round trips:

Step	Latency (approx.)
DNS lookup	20-120 ms
TCP handshake	1 RTT
TLS negotiation	2 RTT
Total	3+ RTT

On a 3G connection (300ms RTT), that’s nearly 1 second of overhead before any data is transferred. Resource hints eliminate most of this.

How CORS Works and Fixing Access Block Errors

Mon, 15 Dec 2025 00:00:00 +0900

Introduction

CORS (Cross-Origin Resource Sharing) is a browser security mechanism that controls how web pages from one origin can request resources from a different origin. When a frontend at https://app.example.com tries to fetch data from https://api.example.org, the browser enforces a same-origin policy by default. CORS provides a controlled way to relax this policy through HTTP headers. This article explains the complete CORS flow, preflight requests, and how to fix common access-block errors.

Secure Cookie Configuration: A Complete Web Developer Guide

Mon, 09 Dec 2024 00:00:00 +0900

Cookies remain one of the most frequently misconfigured security controls on the web. A single missing attribute can expose your application to session hijacking, CSRF, or cross-site information leakage. Modern browsers have pushed stricter defaults, but understanding each attribute and combining them correctly is essential for defense-in-depth.

The core security attributes are Secure, HttpOnly, SameSite, and the __Host- / __Secure- prefixes. Each serves a distinct purpose, and they work best when combined.