Thymian

What is the Semantic Gap?

It happens when two systems interpret the same HTTP message differently.

It can start as interoperability trouble, but also become security-relevant.

thymian.dev/introduction/h…

Last week, we talked about the QUERY method. A successful QUERY response can include both Location and Content-Location:

Location = rerun the query.
Content-Location = retrieve that exact result snapshot.

rfc-editor.org/info/rfc10008
#HTTP #API #Backend

Ever used POST for a read-only search because the query was too big for the URL?

New RFC 10008, just released, defines HTTP QUERY: request content with safe/idempotent semantics.

rfc-editor.org/info/rfc10008

HTTP status codes are API behavior, not labels.

202 means accepted, not done.
303 points clients to another resource.
422 means valid syntax, invalid meaning.

Clients, caches, gateways, SDKs, and agents read these semantics.

Your API's 403 is leaking information.

It tells attackers the resource exists.

RFC 9110 says you can return 404 instead — by design, not as a hack.

thymian.dev/introduction/h…