Resources vs Representations: the Identity Layer

Identity And Bytes

A resource is the object identified by a URI. A representation is the byte sequence returned for that resource.

These concepts connect, but they are not interchangeable. One URI can identify a resource while different requests receive different representations.

Security bugs appear when components treat one observed byte sequence as the resource itself. Cache, WAF, and origin can then disagree about what they hold.

One URI, Many Representations

A URI provides stable identity across requests. The returned representation can vary according to request-specific selection.

For example, repeated requests to one URI may produce different bytes. Each response still refers to the same resource, even when its representation changes.

The key question is therefore precise: which resource is addressed, and which representation was selected for this request?

Selection Happens Per Request

Representation selection occurs when a request is processed. The request context can lead the system to return one byte sequence rather than another.

This means a response body cannot, by itself, define resource identity. It records one selected representation at one point in processing.

Treating those bytes as permanent identity erases the distinction between the URI and the response chosen for that request.

The Conflation Bug

Conflation occurs when a component equates a resource with one representation’s raw bytes.

That shortcut seems convenient: compare the bytes, label the object, and continue. It fails when another request selects different bytes for the same URI.

The result is a boundary error. Different components may believe they possess the same object while actually holding different representations.

The same URI can pass through components that hold different raw bytes while each component treats its own bytes as the object.

Cache Identity Drift

A cache may store a representation under a URI-derived identity. The origin may later select different bytes for that same URI.

If the cache treats its stored bytes as the resource itself, it can answer with an earlier representation while the origin reasons about another one.

The important discrepancy is not merely stale content. It is disagreement about whether identity belongs to the resource or its selected bytes.

WAF Sees Different Bytes

A WAF may inspect one representation while the origin evaluates another representation for the same URI.

If the WAF classifies raw bytes as the resource, its decision can become detached from the origin’s identity model. The two layers then appear synchronized because they reference one URI.

Precise analysis compares the bytes each layer received, selected, or stored, rather than assuming URI equality proves object equality.

Origin State And Representation

The origin maintains the resource state and selects a representation for each request. Its internal decision can therefore differ from the bytes observed upstream.

A state-machine analysis should track transitions using the resource identity, then separately record the selected representation.

Collapsing both into one value hides parser or processing discrepancies. A later component may replay, cache, or inspect bytes under an identity the origin never assigned to them.

A Precise Analysis Method

For every request, record the URI as resource identity and record the returned raw bytes as its representation.

Then compare what the cache, WAF, and origin each believe the URI identifies. Do not infer shared identity from matching labels or from one observed response.

Ask three questions: which resource was addressed, which representation was selected, and which component stored or evaluated those bytes? This separates state from encoding.

Identity-layer reference

For an HTTP request, the returned byte sequence is the resource itself rather than a representation of that resource.

• True
• False

Answer: False

Incorrect. The URI identifies the resource; the returned bytes are one representation selected for that request. Treating bytes as identity creates the resource–representation conflation bug.

For a request to /profile, the URI supplies the _____, while the returned byte sequence is the _____.

Answer: For a request to /profile, the URI supplies the resource identity, while the returned byte sequence is the representation.

The URI answers which resource is addressed. The returned byte sequence records which representation was selected during processing of that request; it does not replace the resource identity.

A server returns Content-Type: application/json with bytes {"role":"user"} for /account on one request and {"role":"admin"} for /account on another. What is the most precise interpretation?

• The two responses identify different resources because their bytes differ
• The same resource produced two representations selected for different requests
• The second response permanently changes the resource identity
• The URI identifies whichever byte sequence was returned first

Answer: The same resource produced two representations selected for different requests

Both responses address the resource identified by /account, but each request selected a different representation. The differing bytes do not, by themselves, establish different resource identities.