Application Protocols

AMQP (Advanced Message Queuing Protocol) is an open standard for message-oriented middleware. Publishers send messages to exchanges; exchanges route messages to queues based on routing rules; consumers receive messages from queues. AMQP decouples producers and consumers. RabbitMQ implements AMQP 0-9-1. AMQP 1.0 is the ISO/IEC standard (2014) with a different wire format adopted by Azure Service Bus, Apache Qpid, and ActiveMQ Artemis.

Cross-Origin Resource Sharing (CORS) is a W3C mechanism that allows web pages to make requests to a different origin than the one that served the page. Browsers enforce the Same-Origin Policy (SOP) which blocks cross-origin fetch requests by default. CORS allows servers to opt into cross-origin access by including specific HTTP response headers. CORS is defined in the W3C Fetch Living Standard §3.2 and is the most frequently encountered HTTP security mechanism in web development.

GraphQL Federation is an architecture for composing multiple independent GraphQL services (subgraphs) into a single unified GraphQL API (supergraph). Each team owns and deploys their subgraph independently. A composition step merges all subgraph schemas into a supergraph schema. A router (gateway) receives client queries, plans which subgraphs to query, and assembles the response. Federation 2 (Apollo) is the most widely deployed implementation, also supported by WunderGraph Cosmo, The Guild / Hive, and Netflix DGS.

GraphQL is a query language for APIs and a runtime for executing those queries. Clients specify exactly what data they need in a single request. A strongly-typed schema defines every field and relationship. Originally created at Facebook in 2012, open-sourced in 2015, and now governed by the GraphQL Foundation under the Linux Foundation.

gRPC-Web is an adaptation of the gRPC protocol for browser-based clients. Native gRPC requires HTTP/2 trailers, which browsers cannot send or access via the Fetch API or XMLHttpRequest. gRPC-Web solves this by encoding gRPC trailers as a special trailing data frame with the MSB set (flag byte 0x80 for uncompressed, 0x81 for compressed). A proxy (Envoy grpc-web filter, an in-process gRPC-Web interceptor, or Connect) translates between gRPC-Web and native gRPC on the server side. The Connect protocol (2022, Buf) is a newer alternative that eliminates the proxy requirement.

JSON Web Token (JWT) is a compact, URL-safe method for representing claims between two parties, defined by RFC 7519. A JWT is a Base64URL-encoded JSON header and payload separated by dots, followed by a cryptographic signature. JWTs are self-contained – the recipient can verify them without calling the issuer. They are the standard token format for OAuth 2.0 access tokens and OpenID Connect ID Tokens.

Apache Kafka is a distributed event streaming platform built around an immutable, append-only commit log. Producers append records to topic partitions; consumers read records by tracking their offset position. Unlike traditional message queues, Kafka retains records for a configurable period – consumers can replay history, rewind, and build new derived views from existing events. Kafka handles millions of events per second at LinkedIn, Uber, Airbnb, and most large-scale data architectures.

MIME (Multipurpose Internet Mail Extensions) types, also called media types or content types, identify the format of a file or data stream. Defined by RFC 2045-2046 and maintained by IANA, MIME types are used in HTTP Content-Type and Accept headers, email attachments, file system associations, and API contracts. Every web developer encounters MIME types daily when building APIs, handling file uploads, or configuring web servers.

MQTT (Message Queuing Telemetry Transport) is a lightweight publish-subscribe messaging protocol designed for constrained devices and unreliable networks. An MQTT broker decouples publishers from subscribers – publishers send messages to topics, subscribers receive them without direct connection to publishers. MQTT is the dominant protocol for IoT device communication and is an OASIS standard.

OAuth 2.0 is an authorization framework (RFC 6749) that enables third-party applications to obtain limited access to a user's resources without exposing credentials. Instead of sharing username/password, a user grants an application an access token with specific scopes. OAuth 2.0 defines four grant types for different client types and use cases. It is the foundation for API authorization across every major platform – Google, GitHub, Stripe, Salesforce.

OpenID Connect (OIDC) 1.0 is an identity layer built on top of OAuth 2.0. Where OAuth 2.0 answers 'what can this token access?', OIDC answers 'who is the user?'. OIDC adds an ID Token (a signed JWT) containing user identity claims to the standard OAuth 2.0 token response. Every major identity provider uses OIDC: Google, Apple, Microsoft, GitHub, Auth0, Okta.

OTLP (OpenTelemetry Protocol) is the standard data delivery protocol for OpenTelemetry telemetry: traces, metrics, logs, and profiles. It defines how SDKs export telemetry to collectors and backends. OTLP runs over gRPC (OTLP/gRPC) or HTTP/1.1 and HTTP/2 (OTLP/HTTP) using Protobuf encoding or JSON. OTLP is implemented by every major observability backend (Jaeger, Prometheus, Grafana Tempo, Datadog, Honeycomb, New Relic, AWS X-Ray, Google Cloud Trace).

RESP (Redis Serialization Protocol) is the wire protocol used for communication between Redis clients and servers. RESP2 has been the standard since Redis 2.0. RESP3, designed by Salvatore Sanfilippo, was introduced as opt-in in Redis 6.0 and adds rich type semantics: maps, sets, doubles, booleans, nulls, verbatim strings, big numbers, and a push type for server-initiated out-of-band data. Clients activate RESP3 by sending the HELLO 3 command at connection startup.

REST (Representational State Transfer) is an architectural style for distributed hypermedia systems defined by Roy Fielding in his 2000 doctoral dissertation. REST uses HTTP as transport and treats every piece of data as a resource identified by a URL. Clients interact with resources via standard HTTP methods (GET, POST, PUT, PATCH, DELETE). REST is the dominant API style – 92% of organizations use REST APIs as of 2025.

SOAP (Simple Object Access Protocol) is a W3C protocol for exchanging structured information in web services using XML. A SOAP message is an XML envelope containing a mandatory Body (the actual payload) and an optional Header (metadata, auth, routing). WSDL (Web Services Description Language) describes the service contract. SOAP dominated enterprise integration from 2000–2010 and remains widely used in banking, insurance, government, healthcare (HL7/FHIR), and legacy ERP systems.

tRPC (TypeScript Remote Procedure Call) is a TypeScript-first framework for building end-to-end typesafe APIs without code generation or schema files. The API router is defined in TypeScript on the server; the client imports the router type and gets full TypeScript inference for all procedures, inputs, and outputs. tRPC v11 is the current version, heavily used in the Next.js, Remix, and React ecosystem via the T3 Stack.

Web Authentication (WebAuthn) is a W3C Recommendation (Level 2, April 2021) that enables passwordless authentication and multi-factor authentication in web browsers using public-key cryptography. Users authenticate with a hardware security key, platform authenticator (Touch ID, Face ID, Windows Hello), or passkey stored in a password manager. WebAuthn is the browser half of the FIDO2 standard – CTAP2 defines how the browser communicates with the authenticator device.