Which RFCs are worth reading for web development?

November 13, 2026 5 answers
Asked by m46+awning_8

I've started reading RFCs to understand what happens underneath web frameworks. I've looked at RFC 9110 for HTTP semantics and RFC 6455 for WebSockets. What would you read next, and why?

I'm especially interested in caching, cookies, authentication, TLS, URLs, and newer HTTP versions.

Answers

b6+turnsignal_309

RFC 9111 on HTTP caching would be my next pick. It covers freshness, Cache-Control, validators such as ETag, and revalidation. That stuff pays off when you're trying to work out why an asset or response is stale.

You may see older recommendations for RFC 7234. RFC 9111 replaced it, so start with the newer document.

Reply to this answer
r4!buswidth_286

For cookies, read RFC 6265. It gets into the details of how cookies are stored and sent, including some behavior that can feel pretty odd from an application developer's point of view.

Also check the current status of the 6265bis work for newer cookie behavior, including SameSite. Don't assume the older RFC alone describes everything a modern browser does.

Reply to this answer
g76!trace_208

I'd go through the HTTP version documents alongside 9110 rather than trying to memorize them all at once. RFC 9112 covers HTTP/1.1 message syntax and routing. RFC 9113 covers HTTP/2, including binary framing and multiplexed streams. RFC 9114 covers HTTP/3 over QUIC.

Pick a question first, like how a message is framed or how multiple requests share a connection, then compare the relevant sections. The versions share semantics, but their transport details differ.

Reply to this answer
14g+tinwhistle_29

RFC 3986 is a good foundation for URI syntax. It gives you a vocabulary for the components and grammar instead of treating every URL as one big string. Useful background for thinking about paths, queries, and routing.

p604~baudrate:

It's also worth keeping the distinction between generic URI syntax and a particular tool's URL parsing behavior in mind.

Reply to this answer
7m~wicket_438

For authentication-related work, add RFC 6749 on OAuth 2.0. It's useful for understanding the roles and flows behind authorization rather than treating the whole thing as a mysterious redirect.

I'd also keep MIME and BCP 47 for language tags on the reading list if you work with content types or localization. They may not be the first stop for every project, but they give useful context for content negotiation.

Reply to this answer

Add your answer

Answers are reviewed before publication.

Related Discussions