HTTP & HTTPS

[!NOTE] This module explores the core principles of HTTP & HTTPS, deriving solutions from first principles and hardware constraints to build world-class, production-ready expertise.

1. What is HTTP?

HyperText Transfer Protocol (HTTP) is the foundational language of the web. It operates as a Stateless protocol, meaning the server retains no memory of past interactions. Every request must carry all the necessary context to be understood.

Imagine walking into a coffee shop with a severe case of amnesia. Every time you approach the barista, you can’t just say “I’ll have another.” You must explicitly state: “I am Jules. I want a large black coffee. Here is my money.” That is HTTP. Every single request is an isolated, complete transaction.

Anatomy of an HTTP Request

Before a server can respond, the client must format a precise string of text.

Raw HTTP Request
GET /index.html HTTP/1.1
Host: www.example.com
User-Agent: Mozilla/5.0 (Macintosh)
Accept: text/html
Accept-Language: en-US,en;q=0.5
Connection: keep-alive
  1. Request Line: [METHOD] [PATH] [PROTOCOL]. The core command.
  2. Headers: Key-value pairs providing metadata (like User-Agent to identify the browser).
  3. Body: Optional payload (empty in a GET, but contains form data or JSON in a POST).

Anatomy of an HTTP Response

The server processes the request and returns a similarly structured string.

Raw HTTP Response
HTTP/1.1 200 OK
Date: Mon, 23 May 2005 22:38:34 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 155
Server: Apache/2.4.1 (Unix)

<html>
<body>
  <h1>Hello, World!</h1>
</body>
</html>
  1. Status Line: [PROTOCOL] [STATUS_CODE] [STATUS_MESSAGE].
  2. Headers: Server metadata, including the crucial Content-Type.
  3. Body: The actual requested resource (HTML, image data, JSON).

The Request/Response Cycle

  1. Request: Client (Browser) sends a command: GET /index.html HTTP/1.1.
  2. Response: Server replies with data: 200 OK + HTML content.

Common HTTP Methods

  • GET: Retrieve a resource.
  • POST: Submit data to be processed (e.g., a form).
  • PUT: Replace a resource.
  • DELETE: Remove a resource.

Status Codes

  • 2xx (Success): 200 OK, 201 Created.
  • 3xx (Redirection): 301 Moved Permanently, 304 Not Modified.
  • 4xx (Client Error): 404 Not Found, 403 Forbidden.
  • 5xx (Server Error): 500 Internal Server Error, 503 Service Unavailable.

2. HTTPS (The ‘S’ is for Secure)

HTTPS is HTTP over TLS (Transport Layer Security).

Feature HTTP HTTPS
Port 80 443
Encryption None (Plaintext) Encypted (SSL/TLS)
Integrity Data can be tampered Tamper-proof
Trust No verification Verified by Certificates

3. How HTTPS Works (The TLS Handshake)

To establish a secure connection, the client and server must perform a complex cryptographic dance known as the TLS Handshake before any HTTP data is sent.

1. Client Hello
The browser says: "I want to connect securely. Here is a list of encryption algorithms (Cipher Suites) I support, and a random string of bytes."
2. Server Hello & Certificate
The server replies: "Let's use AES-256-GCM. Here is my Public Key, wrapped in an SSL Certificate signed by a trusted Authority (CA) to prove I am who I say I am."
3. Key Exchange
The client verifies the certificate, generates a 'Pre-master Secret', encrypts it with the server's Public Key, and sends it over. Only the server's Private Key can decrypt this.
4. Symmetric Session
Both sides now use the Pre-master Secret to mathematically derive the exact same **Symmetric Session Key**. All future HTTP traffic is encrypted rapidly using this single shared key.

4. Interactive: Status Code Simulator

Experience how the server responds to different client scenarios.

🌍
Client
↔
???
Waiting for request...

5. Evolution of HTTP

The web has grown heavier, demanding more efficient protocols.

  • HTTP/1.1 (1997): The baseline. Introduced Connection: keep-alive to reuse TCP connections, but suffered from Head-of-Line (HoL) Blocking—if one request gets stuck, all subsequent requests in the queue are blocked.
  • HTTP/2 (2015): Introduced Multiplexing. It breaks requests and responses into binary frames and interleaves them over a single TCP connection, solving HTTP-level HoL blocking.
  • HTTP/3 / QUIC (2022): Replaces TCP entirely with UDP. By handling connection establishment and encryption (TLS 1.3) at the protocol layer, it enables 0-RTT (Zero Round Trip Time) handshakes. It solves TCP-level HoL blocking, making it highly resilient for mobile users switching between networks (e.g., Wi-Fi to Cellular).