# Chapter 5: The Web's Contract — HTTP, Headers, Cookies, and the Browser as a Runtime

> From *The Confident Learner: Tech and Domain Fundamentals for the AI Era* by Dharanova Pioneer, a free online book.
> Web page: https://elephantbamboo.com/chapters/5 · Licence: CC BY-SA 4.0 (https://creativecommons.org/licenses/by-sa/4.0/)

**What this chapter covers:** HTTP methods, status codes and headers, cookies and sessions, HTTPS, and the browser as a runtime, told through one very bad Tuesday.

*The opening of the chapter follows. The full chapter is free to read with a Google sign-in at the web page above.*

---

## The worst Tuesday of Anjali's career

Anjali had been at the EdTech startup in Pune for four months when the worst Tuesday of her career happened. The company was launching a new course-purchase flow on the morning of a major marketing campaign. Instagram ads were running. A WhatsApp blast had gone out to the company's existing users. An email had reached eighty thousand students an hour before the launch.

The flow worked in testing. It worked on staging. The moment it went live at nine in the morning, the support team started getting messages from users who said they had been charged twice for the same course. Not all users. About one in twenty. By ten, there were over forty such complaints.

Anjali was the on-call engineer. She spent two hours staring at her own code, looking for race conditions, accidental double-clicks, frontend bugs. The code was fine. She could not reproduce the bug on her own machine.

By noon, a senior engineer in the next room asked one question. *"What HTTP method is the purchase request using?"* She looked. GET. The senior closed his eyes for a moment, partly at the bug and partly at the realisation that this had made it through code review and a launch checklist without anyone catching it. Then he said, very calmly, "Some users have flaky connections. Browsers and intermediate networks are allowed to retry GET requests automatically. Some users got their purchase retried mid-purchase. Change it to POST. Add an idempotency key. Deploy now. We'll talk about the review later."