Internals: the HTTP server

This section explains why the HTTP server behaves the way it does and what its limits cost. Use the focused pages when you need connection lifecycle, isolate handoff, identity, or comparison details.

HTTP internals

• Connections, limits, and protocol — accept, TLS, request bodies, timeouts, and protocol version.

• Handoff, shutdown, and draining — how many connections share an isolate and how shutdown completes safely.

• Identity and observability — client identity and what the server can report.

• Cookies and CSRF — why a cookie a browser would drop throws, how signed and sealed cookies are built, and how CSRF tokens are checked.

• Webhooks — why the scheme is Standard Webhooks, what is added to its reference library, and what is left out.

• HTTP internals compared — trade-offs against other runtimes.

The practical API is in the HTTP server guide; the public contract is in the HTTP API reference.