Web Developer Dictionary

Cache invalidation is the process of declaring cached data stale and removing or updating it. It is one of the hardest problems in programming: cached data can go "stale", but you do not always know when.StrategiesTTL (Time To Live) — the cache lives N seconds, then is automatically deleted. Simple, but data may be stale before TTL expiresEvent-based — on data change, explicitly delete or update the relevant cache. Precise, but more complex to implementWrite-through — write simultaneously to cache and DB. Always fresh cache at the cost of an extra writeCache-aside — read from cache; if absent, read from DB and cache the result. The most common strategyComplexityChallenges: cache stampede (many requests hitting the DB simultaneously after TTL expires), stale reads, and complex invalidation for related data.

Caching is storing the result of an expensive operation (SQL query, HTTP call, rendering) for reuse without recomputing it. Proper caching is one of the most effective ways to speed up an application without changing algorithms.Cache layersHTTP cache — browsers and proxies cache responses based on Cache-Control headersCDN — edge nodes cache static assets and even dynamic responsesApplication cache — Redis or Memcached store query results and computed dataOPcache — PHP caches compiled bytecodeDB query cache — some databases cache query results (removed in MySQL 8+)InvalidationThe hardest part of caching is deciding when data is stale. Two strategies: TTL (time to live) — simpler, but data may be outdated; event-based invalidation — more precise, but harder to implement.

Canary deployment is a strategy for gradually rolling out a new version: initially only a small percentage of traffic reaches the new version (1% → 5% → 10% → 100%). If metrics look good, the rollout continues. On problems — roll back without wide impact. Layout Load Balancer ├── v1 (95%) ── stable version └── v2 (5%) ── new "canary" version Benefits Real users test the new version on production traffic Problems are detected at 1% of traffic, not all of it Smooth cutover with no downtime Vs Blue-Green Blue-Green: traffic switches instantly (0% or 100%) Canary: gradually (1% → ... → 100%) Implementation Nginx upstream weights, Kubernetes traffic splitting, AWS CodeDeploy Canary, Istio.

The CAP theorem (Brewer's theorem) states that a distributed system cannot simultaneously guarantee all three properties — Consistency, Availability, and Partition Tolerance. When a network partition (P) occurs, a choice must be made between C and A.Three propertiesConsistency — every request receives the most recent result or an errorAvailability — every request receives a response (not necessarily the most recent data)Partition Tolerance — the system continues operating despite network failures between nodesIn practicePartition Tolerance is mandatory for any real distributed system — the network will always fail at some point. So the choice is: CP (MySQL, HBase, ZooKeeper) or AP (Cassandra, CouchDB, DynamoDB). MongoDB and Redis can be configured for either model.

CDN (Content Delivery Network) is a distributed network of servers around the world that serves static files from the node geographically closest to the user. A file stored on a server in Kyiv is delivered from a node in London for a British user — without transatlantic round-trip delays.What CDN cachesImages, CSS, JavaScript, fontsVideos and large downloadable filesStatic HTML pages (for JAMstack)BenefitsLower latency — physically closer to the userOrigin server offload — most requests are served by the CDNDDoS mitigation — the CDN absorbs attack traffic at edge nodesPopular optionsCloudflare (free tier available), AWS CloudFront, Fastly, BunnyCDN.

Chaos Engineering is the discipline of intentionally injecting failures into a system (killing services, adding latency, terminating processes) to verify resilience before failures occur in the real world. Netflix popularised it with Chaos Monkey. Principles Define the "steady state" — normal system behaviour (RPS, latency, error rate) Form a hypothesis: "if one Pod is killed, the system will keep running" Inject the failure in a controlled environment (start with staging) Compare the actual state with the hypothesis Typical experiments Kill one microservice Add 2 seconds of latency to an external API Simulate a full database failure Fill the disk to 95% Tools Chaos Monkey (Netflix), LitmusChaos (Kubernetes), Gremlin, AWS Fault Injection Simulator.

CI/CD (Continuous Integration / Continuous Delivery) is the practice of automatically building, testing, and delivering code after every commit. The goal: shorten the time between writing code and it reaching production, catching problems as early as possible.CI — Continuous IntegrationEvery push triggers an automated pipeline: install dependencies, static analysis, unit tests, integration tests. If something breaks, the developer finds out immediately — not weeks later.CD — Continuous Delivery/DeploymentAfter a successful CI run, code is delivered to a server automatically or semi-automatically. Delivery — a human approves the deploy; Deployment — fully automatic.Popular toolsGitHub Actions — built into GitHub, free for public repositoriesGitLab CI — powerful, with runners on your own infrastructureJenkins — self-hosted, widely used in enterpriseCircleCI / Bitbucket Pipelines — cloud-based solutions

Circuit Breaker is a resilience pattern for distributed systems. It protects against cascading failures: if a downstream service goes down, it automatically "trips" and returns a fallback response instead of hanging.Three statesClosed (normal operation) — requests flow through. Failure counter increments on errorsOpen (breaker tripped) — requests are blocked; fallback is returned immediately. Set when failures exceed the thresholdHalf-Open (probing) — after a timeout, one test request is let through. If it succeeds → Closed; if not → back to OpenWhyWithout a circuit breaker: slow service A → threads in service B hang waiting → service B exhausts its thread pool → the entire cluster fails. The circuit breaker "disconnects" service A and lets the rest of the system continue operating.

Clean Architecture (Robert Martin) is a principle of organising code into concentric layers where inner layers know nothing about outer ones. Dependencies always point inward — from UI and DB toward business logic, never the other way.Layers (inner to outer)Entities — enterprise business rules. Depend on nothingUse Cases — application business rules. Depend only on EntitiesInterface Adapters — Controllers, Presenters, Gateways. Transform data formats between Use Cases and the outside worldFrameworks & Drivers — DB, Web, UI. The outermost layerThe dependency ruleCode in an inner layer never mentions anything from an outer one. Dependency is injected through an interface.Related conceptsHexagonal Architecture (Ports & Adapters), Onion Architecture — different names for the same idea: shield domain logic from infrastructure.

Clickjacking (UI Redress Attack) is an attack where an attacker overlays a transparent iframe of your site over their own page. The user thinks they are clicking a button on the malicious site, but is actually interacting with yours — confirming a transaction or changing settings. Defence X-Frame-Options — older header. DENY blocks all embedding; SAMEORIGIN allows only the same domain Content-Security-Policy: frame-ancestors — modern replacement. More flexible: allows specific domains // Nginx add_header X-Frame-Options "DENY"; add_header Content-Security-Policy "frame-ancestors 'none'"; // PHP header('X-Frame-Options: SAMEORIGIN'); header("Content-Security-Policy: frame-ancestors 'self' https://trusted.com"); Difference from CSRF CSRF forges an HTTP request. Clickjacking tricks the user into clicking a legitimate element themselves — it does not forge a request but manipulates the click.

A closure (anonymous function) is a nameless function that can be stored in a variable, passed as an argument, or returned from another function. Its key feature: it can "capture" variables from the enclosing scope.Where it is usedCallbacks in functions like array_map, usort, array_filterArrow functions (fn() =>) — capture outer variables automaticallyFunctional programming — higher-order functions, lazy evaluationEvent handlers and middleware chainsVariable capture$multiplier = 3; $fn = fn($x) => $x * $multiplier; // captured automatically $fn(5); // 15In regular closures, capture is explicit via use ($var). To capture by reference — use (&$var).

Cloud computing is the delivery of computing resources (servers, storage, databases, networking) over the internet on a pay-per-use basis. Instead of buying and maintaining your own hardware, you rent what you need from a provider.Service modelsIaaS (Infrastructure as a Service) — rent VMs, disks, networking. You manage the OS and middleware. AWS EC2, Google Compute EnginePaaS (Platform as a Service) — the provider manages infrastructure; you deploy code. Heroku, Google App Engine, RenderSaaS (Software as a Service) — a finished product accessed via a browser. Gmail, Slack, SalesforceBenefitsPay only for resources usedScale in minutesGlobal infrastructureNo capital expenditure on hardware

Code review is the process of another developer examining code before it is merged into the main branch. It catches bugs, spreads team knowledge, and maintains codebase quality. Research shows code review finds ~60% of defects early.What to checkCorrectness: does the code solve the task? Are there edge cases?Readability: is it easy to read and maintain?Security: SQL injection, XSS, data leaksPerformance: N+1, missing indexes, unnecessary queriesAdherence to the project's style and conventionsRules for a good reviewerComment on the code, not the author: "the function does X, but Y would be better" instead of "you did it wrong"Explain why, not just what to changeDistinguish blockers from suggestions: nit: — not critical

Command is a pattern that encapsulates a request as an object. The sender does not know who will execute the command or how — it simply calls execute(). This enables queuing, logging, and undoing commands. Participants Command — interface with an execute() method ConcreteCommand — implementation that knows the receiver and the action Invoker — stores and triggers commands Receiver — the object that performs the real work Example interface Command { public function execute(): void; public function undo(): void; } class SendEmailCommand implements Command { public function execute(): void { /* send */ } public function undo(): void { /* cancel */ } } class CommandBus { private array $history = []; public function dispatch(Command $cmd): void { $cmd->execute(); $this->history[] = $cmd; } } Where used CQRS (Command Bus), task queues, transaction script, undo/redo in editors.

Composer is the dependency manager for PHP. It resolves which packages are needed, downloads them, resolves version conflicts, and generates an autoloader. Nearly every modern PHP project starts with a composer.json.Key commandscomposer require vendor/package — add a packagecomposer install — install dependencies from composer.lockcomposer update — update dependencies and regenerate the lock filecomposer dump-autoload — regenerate the autoloadercomposer.json vs composer.lockcomposer.json — version ranges ("^2.0"). composer.lock — exact versions pinned at install time. The lock file ensures everyone on the team and CI servers use identical versions. Always commit composer.lock.

Concurrency and Parallelism are related but distinct concepts. Concurrency is about structure; parallelism is about execution. Rob Pike: "Concurrency is about dealing with lots of things at once; parallelism is about doing lots of things at once".The differenceConcurrency — multiple tasks make progress by switching between them. A single core can be concurrent via time-slicingParallelism — tasks execute literally at the same time on multiple cores/CPUsThreads, processes, coroutinesProcess — isolated memory space. Expensive to create and switchThread — shared memory, lighter than a process. Race conditions!Coroutine / Fiber — cooperative switching without OS involvement. Very lightweight (PHP Fibers, Go goroutines, Python async)PHPPHP is traditionally synchronous: one request = one process. For true parallelism — Swoole, ReactPHP, or horizontal scaling via PHP-FPM.

A connection pool is a set of pre-established database connections that are reused between requests. Opening a new DB connection is expensive (TCP handshake, authentication). The pool lets you grab a ready connection instead of creating a new one.How it worksOn startup, the application opens N connections. Each request takes a connection from the pool, uses it, and returns it. If all connections are busy, the request waits or receives a timeout error.Key parametersmin/max connections — minimum and maximum connections in the poolconnection timeout — how long to wait for a free connectionidle timeout — how long before an idle connection is closedPHP and persistent connectionsPHP-FPM + MySQL: each worker has its own pool. For centralised pooling across workers, use PgBouncer (PostgreSQL) or ProxySQL (MySQL).

A container registry is a storage service for Docker images — analogous to npm registry for JavaScript or Packagist for PHP. It stores versioned images that servers pull during deployment. How it is used # Build the image docker build -t myapp:1.2.0 . # Tag for the registry docker tag myapp:1.2.0 registry.example.com/myapp:1.2.0 # Push docker push registry.example.com/myapp:1.2.0 # On the server docker pull registry.example.com/myapp:1.2.0 docker run registry.example.com/myapp:1.2.0 Popular options Docker Hub — public, free for public images GitHub Container Registry (GHCR) — integrates with GitHub Actions AWS ECR, Google Artifact Registry — cloud-native, integrated with clusters Harbor — self-hosted, open-source Tags and versioning latest is dangerous in production: each pull may fetch a different image. Always pin to a specific tag or SHA digest.

Content-Type is an HTTP header that tells the recipient the format of the message body. A MIME type (Multipurpose Internet Mail Extensions) is a standard for identifying content type in the format type/subtype. Common MIME types application/json — JSON data (REST API) application/x-www-form-urlencoded — HTML form data multipart/form-data — form with file uploads text/html; charset=utf-8 — HTML page text/plain — plain text image/png, image/webp, image/svg+xml application/pdf application/octet-stream — binary data (generic download) Usage // Server response header('Content-Type: application/json; charset=utf-8'); echo json_encode($data); // File download header('Content-Type: application/pdf'); header('Content-Disposition: attachment; filename="invoice.pdf"'); readfile($path); Accept header The client specifies which types it accepts: Accept: application/json, text/html. The server may return different formats accordingly (Content Negotiation).

Contract testing is a type of testing that verifies the agreement between API consumers and providers. Instead of running both services simultaneously, each side verifies the contract independently. The problem it solves In a microservices architecture, service A expects service B to return a field user_id, but B renamed it to userId. Integration tests do not always catch such changes in time. Consumer-Driven Contract Testing The consumer (A) records expectations in a "contract" (pact file) The contract is published to a Pact Broker The provider (B) automatically verifies that it meets the contract If B changes its API — the test fails before deployment Tools Pact — the most popular framework. Supports PHP, Node, Java, Go and others. Pact Broker — centralised contract storage.

A cookie is a small piece of data the server sends to the browser in a Set-Cookie header, which the browser automatically returns on every subsequent request to the same domain. This lets stateless HTTP "remember" the user.Cookie attributesHttpOnly — JavaScript cannot read the cookie. Protects against XSS theftSecure — transmitted over HTTPS onlySameSite=Lax/Strict — restricts cross-site sending. Protects against CSRFExpires / Max-Age — time to live; without it the cookie is session-scoped (deleted when the browser closes)Domain / Path — which URLs the cookie is sent toCookie vs localStoragelocalStorage is larger (5–10 MB vs 4 KB) and accessible only from JavaScript. Cookies are sent to the server automatically and can be HttpOnly (inaccessible to JS). HttpOnly cookies are safer for sessions and tokens.

CORS (Cross-Origin Resource Sharing) is a browser mechanism that allows or blocks JavaScript on one domain from making requests to another. The browser checks the server's response headers and decides whether client-side code may access the data.How it worksFor "non-simple" requests (POST with JSON, custom headers) the browser first sends a preflight request using the OPTIONS method. The server returns headers allowing or blocking the request. If allowed — the browser sends the actual request.Key headersAccess-Control-Allow-Origin — domain(s) permitted access (* or a specific domain)Access-Control-Allow-Methods — allowed HTTP methodsAccess-Control-Allow-Headers — allowed request headersAccess-Control-Allow-Credentials — whether cookies may be sent with the requestServer-side configurationCORS headers are set by the server — through middleware, Nginx/Apache configuration, or directly in code. A "blocked by CORS policy" error is always resolved on the server side, not the client.

CQRS (Command Query Responsibility Segregation) is a pattern that separates read and write models. Commands change state; Queries read it. They use different models and sometimes different data stores.WhyReads and writes have different requirements: queries involve complex JOINs and aggregations; commands require transactional integrity. Separating them allows each to be optimised independently.Simple CQRSOne database, but separate classes: CreateOrderCommand and OrderSummaryQuery. Minimal complexity, but already provides structure.Full CQRS with Event SourcingThe write side stores events (Event Store); the read side builds denormalised projections suited for reading. High complexity, but full audit trail and the ability to "replay" state.CaveatCQRS adds complexity. Justified in complex domains with different read/write loads. Unnecessary for CRUD applications.

The Critical Rendering Path (CRP) is the sequence of steps a browser takes from receiving HTML to painting the first pixels on screen. Optimising the CRP directly affects LCP and Time to First Paint. Steps Load HTML → build DOM Load CSS → build CSSOM DOM + CSSOM → Render Tree Layout (reflow) — calculate sizes and positions Paint — draw pixels Render-blocking resources CSS and synchronous JS block Render Tree construction. The browser paints nothing until they finish loading. Optimisations Critical CSS inline in <head> — above-the-fold styles load without a round-trip <link rel="stylesheet" media="print"> — non-critical CSS does not block rendering <script defer> or async — JS does not block HTML parsing <link rel="preload"> — load critical resources earlier

Cron is the Unix/Linux task scheduler that runs commands on a schedule. Configuration is stored in a crontab — a table of entries such as "every minute", "at 3:00 every Sunday", and so on.Crontab syntax# min hour day month weekday command 0 3 * * * /usr/bin/php /app/backup.php # every day at 3:00 */15 * * * * curl https://api.example.com/ping # every 15 minFive fields: minutes (0–59), hours (0–23), day of month (1–31), month (1–12), day of week (0–7, where 0 and 7 are Sunday). * means "any value"; */N means "every N".PitfallsCron runs in a minimal environment — environment variables may be absent. Use full paths to commandsIf a job takes longer than its interval, parallel instances will start. Use lock files or flockLog output: command >> /var/log/job.log 2>&1

CSRF (Cross-Site Request Forgery) is an attack that tricks an authenticated user's browser into sending a forged request to a server on their behalf. The browser automatically includes cookies — so the server considers the request legitimate.How it happensThe victim is logged into bank.com. They open a malicious page with a hidden <form> that auto-submits a POST to bank.com/transfer. The browser attaches the bank's cookie — and the transfer goes through.DefenceCSRF token — the server generates a unique, unpredictable token and embeds it in a hidden form field (<input type="hidden" name="_token" value="...">). On submission, the server compares the token against the one stored in the sessionSameSite cookie — the SameSite=Lax/Strict attribute prevents the browser from sending cookies in cross-site requests. The most effective modern defenceStateless APIs using Bearer tokens in headers are not vulnerable to CSRF

CSS Custom Properties (variables) are values stored in CSS and available to the entire document. Declared with --name, accessed via var(--name). The foundation of design systems and theming. Syntax /* Declare in :root — global scope */ :root { --color-primary: #c05c08; --spacing-md: 16px; --radius: 8px; } /* Usage */ .btn { background: var(--color-primary); padding: var(--spacing-md); border-radius: var(--radius); } /* Fallback */ color: var(--text-color, #333); Dynamic change via JS document.documentElement.style .setProperty('--color-primary', '#0066cc'); Vs Sass/Less variables Sass/Less variables are compiled at build time — static. CSS custom properties live in the browser — dynamic, inherited through the DOM, changeable by JS and media queries.

CSS Grid is a two-dimensional layout system in CSS. It lets you place elements across rows and columns simultaneously. Ideal for complex page layouts, card grids, and any two-dimensional structure. Basics .grid { display: grid; grid-template-columns: 1fr 1fr 1fr; /* 3 equal columns */ grid-template-columns: repeat(3, 1fr); /* same thing */ grid-template-columns: 200px 1fr 2fr; /* mixed units */ gap: 20px; /* gutters */ } /* Element spanning 2 columns */ .featured { grid-column: span 2; } Auto-fill vs Auto-fit /* As many cards as fit (min 250px each) */ grid-template-columns: repeat(auto-fill, minmax(250px, 1fr)); Named Areas .page { grid-template-areas: "header header" "sidebar main" "footer footer"; } header { grid-area: header; }

Specificity is the algorithm by which the browser decides which CSS rule "wins" when there is a conflict. Higher specificity = the rule is applied. Specificity score Three groups: (A, B, C) A — inline styles (style="..."): 1,0,0 B — ID selectors (#main): 0,1,0 each C — class, pseudo-class, attribute (.btn, :hover, [type]): 0,0,1 each Tags and pseudo-elements (div, ::before): 0,0,1, counted separately Examples #nav .item a:hover → (0,1,2) /* ID + class + pseudo-class */ .btn.btn-primary → (0,0,2) button → (0,0,1) /* The first rule wins */ !important !important overrides any specificity. Avoid it — makes CSS unpredictable. Only justified for utilities (.hidden { display: none !important; }). Order when specificity is equal The rule declared later in the CSS wins.

CSV (Comma-Separated Values) is a text format for tabular data: each line is a record, values separated by commas (or semicolons). The simplest data exchange format between Excel, databases, and applications. Format id,name,email,created_at 1,Alice,alice@example.com,2025-01-15 2,Bob,"Doe, Bob",2025-02-20 Values containing commas or quotes are wrapped in double quotes. Quotes inside a value are doubled: "". PHP // Reading $file = fopen('users.csv', 'r'); while (($row = fgetcsv($file)) !== false) { [$id, $name, $email] = $row; } fclose($file); // Writing $file = fopen('export.csv', 'w'); fputcsv($file, ['id', 'name', 'email']); // header fputcsv($file, [1, 'Alice', 'alice@example.com']); fclose($file); Pitfalls Encoding: Excel opens files in Windows-1252 by default, not UTF-8. Add a BOM (\xEF\xBB\xBF) at the start of the file for Excel to display Cyrillic correctly.

Currying is a functional programming technique: transforming a function with N arguments into a sequence of functions each taking one argument. Enables partial application and the creation of specialised functions. The idea // Regular function add(2, 3) → 5 // Curried add(2)(3) → 5 // Partially applied addTwo = add(2) addTwo(3) → 5 addTwo(10) → 12 PHP example $multiply = fn($a) => fn($b) => $a * $b; $double = $multiply(2); $triple = $multiply(3); echo $double(5); // 10 echo $triple(5); // 15 // Pipeline $result = array_map($double, [1, 2, 3, 4]); // [2, 4, 6, 8] Practical value Currying is rarely used directly in PHP, but the concept of partial application is useful for building pipelines, configuring functions, and callbacks. In JavaScript and Haskell it is far more widespread.