Reference · 42 terms
Glossary
Every short form used across the series. Inside a lesson, hover or tap any dotted term to see the same entry in place.
Network
- bfcacheBack/forward cache
- The browser keeps a whole page in memory, with its JavaScript state. When you press Back or Forward, the page appears again at once.Lesson 0 →
- CDNContent Delivery Network
- Servers around the world that keep copies of your files. Users get files from a nearby server, so it is faster and your own server has less work.Lesson 5 →
- DNSDomain Name System
- The internet's phone book. It turns a name like react.dev into an IP address (the number of a server). Answers are saved for a set time (the TTL).Lesson 0 →
- HSTSHTTP Strict Transport Security
- A header that tells the browser: always use HTTPS for this site. The browser then never sends the first request in plain, unsafe form.Lesson 0 →
- QUICQUIC
- A newer way to send data, used by HTTP/3. It joins the connection hello and the encryption hello into one. One lost packet does not stop the others.Lesson 0 →
- RTTRound-trip time
- How long a message takes to reach the server and come back. Every hello costs at least one RTT, so a far-away server feels slower.Lesson 0 →
- TCPTransmission Control Protocol
- A reliable way to send data in order. HTTP/1.1 and HTTP/2 use it. Opening a connection takes a short hello exchange that costs one round trip.Lesson 0 →
- TLSTransport Layer Security
- The encryption behind HTTPS. The browser checks the server's certificate (its ID card). Then both sides agree on a secret key.Lesson 0 →
- TTLTime to live
- How long a saved DNS answer may be used before the browser must ask again.Lesson 0 →
HTTP
- CORSCross-Origin Resource Sharing
- A set of headers where a server says which other sites may read its answers. Only browsers enforce it. It does not protect the server like a firewall.Lesson 4 →
- ETagEntity tag
- A fingerprint of a response. The browser sends it back in If-None-Match. If nothing changed, the server replies 304 Not Modified and skips the body.Lesson 5 →
- idempotentIdempotent
- Doing it once or many times gives the same result, so a retry is safe. PUT and DELETE are idempotent. POST is not.Lesson 6 →
- OriginOrigin
- Scheme + host + port together (for example https://site.com:443). Two URLs are the same origin only if all three match.Lesson 4 →
- preflightCORS preflight
- A small OPTIONS request the browser sends first. It asks: is this cross-site request with this method or these headers allowed?Lesson 4 →
- TTFBTime to First Byte
- Time from sending the request to receiving the first byte of the answer. It includes network time and the server's work.Lesson 0 →
Storage and auth
- BFFBackend for Frontend
- A server you own between the browser and other APIs. It keeps the tokens, so the browser only holds a session cookie.Lesson 3 →
- HttpOnlyHttpOnly cookie attribute
- A cookie setting that hides the cookie from JavaScript. An XSS attack cannot read it, but it can still use the logged-in session.Lesson 1 →
- IndexedDBIndexedDB
- A database inside the browser for large or structured data. It does not block the page, and workers can use it too.Lesson 1 →
- JWKSJSON Web Key Set
- A public list of keys. Services use it to check tokens that were signed with a secret key.Lesson 2 →
- JWTJSON Web Token
- A signed token with three parts: header.payload.signature. Anyone who has it can read it. The signature shows that nobody changed it.Lesson 2 →
- refresh tokenRefresh token
- A long-lived token used only to get a new short-lived access token. Best practice is to replace it each time it is used.Lesson 2 →
- SameSiteSameSite cookie attribute
- A cookie setting (Strict, Lax or None) that says if the cookie is sent on requests from other sites. It is the main built-in defence against CSRF.Lesson 1 →
Security
- clickjackingClickjacking
- An attacker shows your site invisibly inside their page, so users click your buttons by mistake. The frame-ancestors setting stops it.Lesson 7 →
- CSPContent Security Policy
- A response header that lists which sources of scripts, styles and frames are allowed. It is a safety net if escaping fails.Lesson 7 →
- CSRFCross-Site Request Forgery
- Another site makes the user's browser send a request to your site. The browser adds the user's cookies by itself.Lesson 3 →
- nonceNonce
- A random one-time value made for each response. It marks which inline scripts the CSP allows.Lesson 7 →
- SRISubresource Integrity
- A hash added to a script or style tag. The browser refuses the file if its content does not match the hash.Lesson 7 →
- XSSCross-Site Scripting
- An attacker makes their JavaScript run on your site. That code can read stored data and act as the user.Lesson 3 →
Rendering and performance
- CLSCumulative Layout Shift
- A score for how much the page content jumps around by surprise. Good is 0.1 or less.Lesson 9 →
- CrUXChrome UX Report
- Google's data from real users' browsers. PageSpeed Insights and Search Console use it.Lesson 9 →
- CSSOMCSS Object Model
- The browser's tree of styles. The browser waits for it before it paints, so CSS can block the first paint.Lesson 0 →
- DOMDocument Object Model
- The tree of elements the browser builds from your HTML. JavaScript reads and changes the page through it.Lesson 0 →
- FCPFirst Contentful Paint
- The time when the first text or image shows on screen.Lesson 0 →
- FIDFirst Input Delay
- The old speed metric. It measured only the wait before the first click was handled. INP replaced it.Lesson 9 →
- hydrationHydration
- React runs again in the browser on HTML that the server made. It adds the click handlers. Before it finishes, buttons look ready but do nothing.Lesson 0 →
- INPInteraction to Next Paint
- How long the page takes to show a reaction to clicks, taps and key presses, over the whole visit. Good is 200 ms or less. It replaced FID in 2024.Lesson 9 →
- layout thrashingLayout thrashing
- Reading layout and writing styles again and again in a loop. The browser must redo the layout on every turn.Lesson 8 →
- LCPLargest Contentful Paint
- The time when the largest visible item (often the main image or heading) is painted. Good is 2.5 seconds or less.Lesson 9 →
- long taskLong task
- A task that blocks the main thread for more than 50 ms. Clicks and painting must wait.Lesson 8 →
- reflowReflow (layout)
- The browser works out the size and place of elements again. It is costly. Changing width, height or margin causes it.Lesson 8 →
- RUMReal User Monitoring
- Measuring speed in the browsers of real visitors, not only in a lab test.Lesson 9 →
- TBTTotal Blocking Time
- A lab number: the total time long tasks blocked the main thread. Lighthouse uses it as a stand-in for INP.Lesson 9 →