Boundary Conditions Even if your server is well-behaved, other clients and servers aren't You can't assume that the request flow will occur in a certain way Errors can happen at any time Incorrect data can be anywhere .. in essence, extreme paranoia is required