.tip

Jun 16, 2026 · one of the small things

Put the API version in the path

A version in a header is invisible in logs, in browser dev tools, in curl by default and in every link anyone pastes into a ticket. /v2/orders is visible in all of them.

GET /v1/orders   → old shape, kept alive with a sunset date
GET /v2/orders   → new shape

Send a Deprecation and Sunset header on the old one, with a date, so clients get a machine-readable warning.

httpapi-design

~/tips/today — 2026-09-04

~cat tips/today

Session cookies: HttpOnly, Secure, SameSite=Lax

securityhttp

Three attributes, each closing a class of attack. HttpOnly keeps scripts from reading it. Secure keeps it off plain HTTP. SameSite=Lax stops it being sent on cross-site POSTs, which is most CSRF.

Set-Cookie: session=...; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=1209600

Strict breaks arriving from an external link while logged in. Lax is the default worth keeping.

↵ open y yesterday l ls /tips

esc close