テーマ： standards
-
E.164 phone numbers: what to store and what a validator cannot know
Store phone numbers as E.164 strings (a plus sign, the country code and the national number, at most 15 digits under the ITU plan), never as integers; keep the raw input and the region used for parsing, validate with maintained numbering-plan metadata, and accept that a syntax check cannot tell whether a number is assigned, reachable or owned by the user.
-
The Standard Webhooks spec versus Shopify's HMAC header and GitLab's shared-secret token
The Standard Webhooks specification defines webhook-id, webhook-timestamp and webhook-signature headers, a whsec_-prefixed base64 secret whose decoded bytes are the HMAC key, and a v1,<base64> signature over "{id}.{timestamp}.{payload}"; GitLab's signing tokens (GitLab 19.0, generally available in 19.1) implement exactly this. Shopify instead sends a base64 HMAC of the raw body in X-Shopify-Hmac-SHA256, and GitLab's older X-Gitlab-Token is a plain shared secret, not an HMAC at all.
-
vCard 4.0の基本：連絡先を交換するtext/vcard形式
vCardは、BEGIN:VCARD、VERSION:4.0、必須のFN、パラメーター付きの任意の構造化プロパティ（N、TEL、EMAIL、ADR、UID、REV）からなるUTF-8のtext/vcard文書です。値のコンマ、セミコロン、バックスラッシュをエスケープし、内容行は最大75オクテットで折り返します。jCard（RFC 7095）は同じモデルをJSONで表します。
-
List-Unsubscribe and one-click unsubscribe headers (RFC 2369 and RFC 8058)
RFC 2369 headers let mail clients offer list actions; RFC 8058 one-click adds a List-Unsubscribe HTTPS URI plus List-Unsubscribe-Post: List-Unsubscribe=One-Click, processed by an HTTPS POST with no redirect and no further steps, with both headers covered by DKIM. Bulk senders are required by Google's guidelines to support it.
-
現在の XML：整形式と妥当性、名前空間、今も適切な選択となる場面
整形式の XML 文書は構文に従い、妥当な文書は DTD やスキーマにも適合する。名前空間は xmlns 宣言を通じ、各要素と属性に名前空間 URI とローカル名からなる展開名を与える。接頭辞は任意で、既定の名前空間は属性に適用されない。混在内容の文書や、語彙とツールが既に XML に基づくエコシステムでは、XML は今も適切な選択である。
-
Country and currency codes in data: ISO 3166-1 and ISO 4217 without the surprises
Store countries as ISO 3166-1 alpha-2 codes and currencies as ISO 4217 alpha-3 codes with their minor-unit exponent, keep the code tables versioned because entries change, and never derive one from the other: a country has no single language or currency, and codes such as UK or XXX are traps.
-
Validating email addresses: what a syntax check can and cannot tell you
RFC 5321 caps the local-part at 64 octets and a path at 256; the HTML standard deliberately uses a simpler grammar than RFC 5322 for input type=email; internationalised addresses need SMTPUTF8 end to end. Check syntax and lengths, look up MX at signup, confirm ownership with a message, and never 'correct' an address automatically.
-
Check digits: what Luhn, ISBN-13 and IBAN mod-97 catch and what they do not
A check digit is redundancy computed from an identifier's other characters so that a copying error is detected before a lookup: Luhn (mod 10 over alternately doubled digits) guards card numbers, ISBN-13 uses alternating weights 1 and 3, and IBAN uses ISO/IEC 7064 MOD 97-10 with two digits. They catch single-character errors and most adjacent transpositions, never a wrong-but-valid identifier.
-
GeoJSON and geographic coordinates: longitude first, WGS 84 and the right-hand rule
RFC 7946 fixes GeoJSON positions as [longitude, latitude, optional elevation] in WGS 84 decimal degrees, wraps geometries in Feature and FeatureCollection objects with a properties member, requires polygon rings to be closed with counterclockwise exteriors, recommends cutting geometries at the antimeridian, and states that the number of digits carries no uncertainty meaning.
-
RateLimit and RateLimit-Policy versus X-RateLimit-*: reading whichever quota headers an API sends
An IETF Internet-Draft (draft-ietf-httpapi-ratelimit-headers-11, May 2026) proposes RateLimit and RateLimit-Policy header fields (e.g. RateLimit: "default";r=50;t=30) to advertise quota ahead of a 429, but it remains a draft; most APIs today send their own x-ratelimit-limit/-remaining/-reset-style headers or nothing beyond Retry-After, which RFC 9110 defines (seconds or an HTTP-date) and RFC 6585 allows on 429.
機械可読： JSON