The Request-Response Cycle
Every interaction you have with the web starts with a request. When you type a URL into your browser, a DNS lookup translates the domain name into an IP address, and a TCP connection is established with the server at that address.
HTTP/1.1 introduced persistent connections, allowing multiple requests over a single TCP session. HTTP/2 went further with multiplexing — many concurrent streams over one connection — eliminating the head-of-line blocking that plagued HTTP/1.1.
HTTP/3, built on QUIC, moves to UDP and resolves transport-layer head-of-line blocking entirely. Each stream is independent: a lost packet stalls only that stream, not the entire connection. On mobile networks with high packet loss, this can halve page load times.
Caching: the Browser's Memory
Cache-Control, ETag, and Last-Modified headers let the server tell the browser what to store and for how long. A well-tuned caching strategy means most assets never need to be re-fetched: a fingerprinted bundle like app.abc12345.js carries max-age=31536000, immutable, making it permanently cacheable in practice.
Service workers intercept every fetch and can serve cached responses even offline. They sit between the browser and the network, acting as a programmable proxy with access to the Cache Storage API. This is how progressive web apps offer offline functionality without native code.
Security: TLS, CSP, and Beyond
Transport Layer Security encrypts traffic between client and server. Modern configurations use TLS 1.3, which reduces the handshake from two round trips to one, and supports 0-RTT resumption for returning visitors — though 0-RTT trades replay-attack safety for speed, so it is disabled for mutating requests.
Content Security Policy restricts what resources a page may load, providing a declarative defense against XSS. A strict CSP — script-src 'nonce-{random}' — means injected scripts without the correct nonce are blocked by the browser regardless of how they got there.
Beyond transport security, the Permissions Policy header restricts which browser features (camera, microphone, geolocation) an iframe may request. Combined with COEP and COOP headers, it enables cross-origin isolation: a prerequisite for SharedArrayBuffer and high-resolution timers.
The web's security model is layered, and each header is a separate line of defense. No single mechanism is sufficient, but together they make exploitation of a single vulnerability insufficient to fully compromise a browsing context.