HTTP and HTTPS

What HTTP is

HTTP (HyperText Transfer Protocol) is the protocol that web browsers and web servers use to talk to each other. It follows the client and server model from the first lesson: the browser sends a request, and the server sends back a response.

Every page, image, stylesheet and script on a website is fetched by its own request. One page can easily take dozens of them.

An HTTP request

When you open a page, your browser sends a plain text message like this one:

GET /index.html HTTP/1.1
Host: www.example.com
User-Agent: Mozilla/5.0
Accept: text/html

• The first line says what you want: the method (GET), the path (/index.html) and the protocol version.
• The following lines are headers, extra details such as which website you want and which browser you use.

The common methods are:

• GET fetches something
• POST sends data to the server, for example a submitted form
• PUT replaces something
• DELETE removes something

An HTTP response

The server answers with a status line, headers and then the content itself:

HTTP/1.1 200 OK
Content-Type: text/html
Content-Length: 1256

<html> ... the page ... </html>

The three-digit status code in the first line tells you how the request went. The first digit gives the family:

• 2xx: success (200 OK)
• 3xx: redirect (301 Moved Permanently)
• 4xx: the request has a problem (404 Not Found, 403 Forbidden)
• 5xx: the server has a problem (500 Internal Server Error)

When a site shows "404", that is simply the status code for "I could not find that page".

Status codes you will see often

• 200 OK: everything worked and here is the page.
• 301 Moved Permanently: the page has a new address. Follow the new link.
• 302 Found: a temporary redirect.
• 400 Bad Request: the server could not understand the request.
• 401 Unauthorized: you need to log in first.
• 403 Forbidden: the server knows who you are, but you are not allowed to see this.
• 404 Not Found: there is nothing at that address.
• 500 Internal Server Error: the server's code failed.
• 502 Bad Gateway: a server in the middle got a bad reply from another server.
• 503 Service Unavailable: the server is overloaded or down for maintenance.

The first digit tells you where to look. A 4 means to check the request. A 5 means the server owner has work to do.

The problem with plain HTTP

HTTP sends everything as readable text. Anyone who can see the traffic on the way, for example another person on the same public WiFi, can read the pages you open, the forms you submit and the passwords you type. They could also change the content before it reaches you.

That is why websites that handle logins, payments or any personal data must use HTTPS.

Cookies: how a site remembers you

HTTP has no memory. Every request stands alone, so the server does not automatically know that two requests came from the same person.

The fix is a cookie: a small piece of text that the server gives your browser, for example after you log in. The browser sends it back with each later request to that site, and the server uses it to recognise you.

HTTP/1.1 200 OK
Set-Cookie: session=abc123; Secure; HttpOnly

Anyone who steals your session cookie can act as you, which is one more reason to use HTTPS. The Secure flag makes the browser send the cookie only over an encrypted connection, and HttpOnly keeps page scripts from reading it.

HTTPS and TLS

HTTPS is HTTP sent through an encrypted connection created by TLS (Transport Layer Security). It gives you three things:

• Encryption: anyone watching the traffic sees only scrambled data.
• Authentication: you can verify that you are connected to the real site and not an impostor.
• Integrity: nobody can change the data on the way without it being detected.

HTTP uses port 80 and HTTPS uses port 443. The padlock in the address bar means your browser has set up a TLS connection.

What happens when HTTPS starts

Before any page is sent, the browser and the server run a short TLS handshake. In simple terms:

1. The browser says hello and lists the encryption methods it supports.
2. The server picks one and sends its certificate.
3. The browser checks the certificate, as described on the next card.
4. Both sides use the exchanged information to calculate the same secret key. An eavesdropper who records the whole exchange still cannot work out that key.
5. From then on, all traffic is encrypted with that key.

Step 4 relies on mathematics that lets two parties agree on a secret over a public connection. The whole handshake takes a fraction of a second, so you only see the padlock.

Certificates: proof of identity

A website proves who it is with a certificate, a digital document signed by a trusted Certificate Authority (CA) such as Let's Encrypt. Your browser has a built-in list of CAs it trusts, and it checks that the certificate:

• matches the name of the site,
• has not expired,
• was signed by a CA it trusts.

If any check fails, the browser shows a warning page. Do not click through it without a good reason.

See it yourself

curl -I https://example.com        # show only the response headers
curl -v https://example.com        # show the whole conversation

The first command prints the status line and headers, for example HTTP/2 200. The second also shows the TLS handshake and the certificate details.

You can watch it in the browser as well. Press F12, open the Network tab and reload the page. Every request your browser makes is listed there with its method and status code.