HTTP & HTTPS

What is HTTP?

HTTP (HyperText Transfer Protocol) is an application-layer protocol that serves as the foundation of data communication for the World Wide Web. When you visit a website, your web browser acting as a client sends HTTP requests to a web server. The server processes the request and sends back HTTP responses containing resources like HTML files, CSS stylesheets, JavaScript files, images, and API data.

HTTP is a **stateless protocol**, meaning the server does not retain user session state between consecutive requests. To build interactive websites that remember logins or shopping carts, developers use technologies like cookies, sessions, and browser local storage to maintain state on top of the stateless HTTP foundation.

Anatomy of HTTP Requests and Responses

HTTP messages are sent as plain text (in HTTP/1.1) or binary frames (in HTTP/2 and HTTP/3) divided into structured blocks:

1. The HTTP Request

An HTTP request contains three main components:

• Request Line: Defines the **HTTP Method** (action), the Target URL Path (resource), and the protocol version (e.g., GET /index.html HTTP/1.1).
  *Common Methods:*
  • `GET` — Retrieve data from a server.
  • `POST` — Send data to a server to create a new resource (e.g., login, form submit).
  • `PUT` — Upload data to update an existing resource.
  • `DELETE` — Request deletion of a resource.
• Request Headers: Metadata containing information about the request (e.g., `User-Agent` identifying browser type, `Accept-Language`, and `Cookie` tokens).
• Request Body: Optional data payload sent to the server (primarily used with `POST` and `PUT` methods to transmit JSON objects or form data).

2. The HTTP Response

An HTTP response is sent by the server back to the client:

• Status Line: Contains the protocol version and a numerical **Status Code** representing the outcome of the request (e.g., HTTP/1.1 200 OK).
• Response Headers: Metadata about the response (e.g., `Content-Type: text/html`, `Server` type, `Cache-Control` rules, and `Set-Cookie` headers).
• Response Body: The actual data payload returned to the client (such as HTML code, image bytes, or JSON data).

Understanding HTTP Status Codes

HTTP status codes are divided into five categories based on the first digit. Knowing these codes is essential for debugging web applications:

• 1xx (Informational) — The request was received, and the process is continuing.
• 2xx (Success) — The request was successfully received, understood, and accepted.
  • `200 OK` — Standard success code.
  • `201 Created` — Request succeeded and a new resource was created.
• 3xx (Redirection) — Further action needs to be taken by the client to complete the request.
  • `301 Moved Permanently` — The resource has been assigned a new permanent URL. Subsequent requests redirect automatically.
  • `302 Found (Temporary Redirect)` — The resource is temporarily located at a different URL.
• 4xx (Client Error) — The request contains bad syntax or cannot be fulfilled due to client-side issues.
  • `400 Bad Request` — The server cannot understand the request due to malformed syntax.
  • `401 Unauthorized` — The request requires user authentication.
  • `403 Forbidden` — The server understands the request but refuses to authorize access.
  • `404 Not Found` — The server cannot find the requested resource path.
• 5xx (Server Error) — The server failed to fulfill an apparently valid request.
  • `500 Internal Server Error` — A generic error message when the server encounters an unexpected condition.
  • `503 Service Unavailable` — The server is overloaded or down for maintenance.

What is HTTPS? (The Security Layer)

Under standard HTTP, all data is sent in **plaintext**. If an attacker intercepts the packets (e.g., on a public Wi-Fi network), they can read passwords, session cookies, and credit card numbers. To secure this traffic, the industry created **HTTPS (HTTP Secure)**.

HTTPS encrypts all request and response traffic using **SSL/TLS (Secure Sockets Layer / Transport Layer Security)**. HTTPS uses port **443** (instead of standard HTTP port 80). The encryption process relies on a hybrid cryptographic system:

1. Asymmetric Handshake: The client connects to the server and requests its SSL/TLS certificate. The client verifies the certificate against built-in trusted Certificate Authorities (CAs). Once verified, the client and server use the server's public key to securely exchange a dynamically generated symmetric "session key."
2. Symmetric Encryption: Once the session key is exchanged, the client and server switch to fast symmetric encryption to scramble all webpage traffic during the session, preventing interception.

HTTP Evolution: HTTP/1.1 vs. HTTP/2 vs. HTTP/3

Web protocol standards have evolved to reduce latency, decrease loading times, and improve mobile connectivity:

Aspect	HTTP/1.1	HTTP/2	HTTP/3
Transport Protocol	TCP.	TCP.	**QUIC** (Runs on top of **UDP**).
Data Format	Plain Text.	Binary Frames.	Binary Frames.
Multiplexing	None; requests must wait (Head-of-Line Blocking).	Yes; sends multiple files over a single TCP connection.	Yes; multiplexing natively handled by QUIC.
Packet Loss Impact	Halts all requests on connection.	Halts all streams on TCP packet loss (TCP HOL blocking).	Only the lost stream is halted; other streams continue uninterrupted.
Encryption	Optional (HTTP vs. HTTPS).	Optional, but browsers mandate HTTPS in practice.	**Mandatory**; encryption (TLS 1.3) built directly into QUIC.

Frequently Asked Questions (FAQ)

❓ What is the difference between HTTP and HTTPS?

HTTP transmits data in unencrypted plaintext over port 80, making it vulnerable to sniffing attacks. HTTPS encrypts all data using SSL/TLS over port 443, protecting user credentials, financial transactions, and privacy. Modern search engines and browsers penalize websites that fail to use HTTPS.

❓ What is the difference between a 301 and a 302 redirect?

A **301 redirect** is permanent. It tells search engine crawlers that the page has moved forever, prompting them to pass search ranking equity (link juice) to the new URL. A **302 redirect** is temporary. Search engines continue index tracking on the original URL because it is expected to return in the future.

❓ What is a cookie in HTTP?

An HTTP cookie is a small piece of data sent by a web server and stored locally by your browser. Whenever you make a new request to that same server, your browser automatically attaches the cookie to the request headers. This allows servers to track state, remember user settings, log you in automatically, or track you across sites for advertising purposes.

❓ How does HTTP/3 improve mobile network browsing?

HTTP/3 uses the **QUIC protocol** running over UDP, which supports **Connection Migration**. In traditional TCP-based connections, if you switch from office Wi-Fi to cellular data, your IP address changes, forcing the TCP connection to disconnect and restart. Under QUIC, connections are tracked using a unique Connection ID rather than IP addresses, allowing your downloads or video streams to continue seamlessly without reconnecting.

What's Next?

Advance your network protocol studies:

• Learn how DNS resolves domain names before HTTP requests in DNS Explained.
• Explore how cryptography keys secure HTTPS connections in Cryptography & Encryption.
• Learn subnetting calculations and IP ranges in IP Addressing & Subnetting.
• Study the physical boundary devices in Topologies & Hardware.