What is HTTP?#

HTTP (HyperText Transfer Protocol) is the application-layer protocol for the web. It’s a request-response protocol — a client sends a request, a server returns a response.

sequenceDiagram
    participant C as Client
    participant S as Server
    
    C->>S: GET /api/users HTTP/1.1
    S->>C: HTTP/1.1 200 OK + body

HTTP Request Structure#

GET /api/users?page=1 HTTP/1.1       ← Request line
Host: api.example.com                 ← Headers
Authorization: Bearer eyJhbG...
Accept: application/json
                                      ← Empty line (end of headers)
                                      ← Body (for POST/PUT)

HTTP Methods#

Idempotent: Multiple identical requests have the same effect as one. Safe: Doesn’t modify server state.

HTTP Response Structure#

HTTP/1.1 200 OK                       ← Status line
Content-Type: application/json        ← Headers
Cache-Control: max-age=3600
Content-Length: 1234
                                      ← Empty line
{"users": [...]}                      ← Body

Status Codes#

Important Distinctions#

Headers#

Common Request Headers#

Common Response Headers#

HTTPS and TLS#

HTTPS = HTTP over TLS. Provides:

• Encryption — data can’t be read in transit
• Integrity — data can’t be modified in transit
• Authentication — server proves its identity via certificate

TLS Handshake (Simplified)#

sequenceDiagram
    participant C as Client
    participant S as Server
    
    C->>S: ClientHello (TLS version, cipher suites)
    S->>C: ServerHello + Certificate + Key Exchange
    Note over C: Verify certificate chain
    C->>S: Key Exchange + ChangeCipherSpec + Finished
    S->>C: ChangeCipherSpec + Finished
    Note over C,S: Symmetric encryption begins

Certificate Chain#

Root CA (trusted by OS/browser)
  └── Intermediate CA
        └── Server Certificate (example.com)

The client verifies the chain up to a trusted root CA.

HTTP Versions#

HTTP/2 Key Improvement#

Multiple requests share one TCP connection via streams — eliminates the need for multiple connections:

HTTP/1.1: 6 parallel connections needed
  Conn 1: GET /style.css
  Conn 2: GET /script.js
  Conn 3: GET /image.png
  ...

HTTP/2: 1 connection, multiplexed
  Stream 1: GET /style.css
  Stream 2: GET /script.js
  Stream 3: GET /image.png
  (all interleaved on same connection)

Caching#

Cache-Control Header#

Cache-Control: public, max-age=3600        # CDN + browser cache for 1h
Cache-Control: private, max-age=600        # Browser only, 10 min
Cache-Control: no-cache                    # Must revalidate before using
Cache-Control: no-store                    # Never cache (sensitive data)

Conditional Requests#

sequenceDiagram
    participant C as Client
    participant S as Server
    
    C->>S: GET /data (first request)
    S->>C: 200 OK + ETag: "abc123"
    
    Note over C: Later...
    C->>S: GET /data + If-None-Match: "abc123"
    S->>C: 304 Not Modified (use cached version)

CORS (Cross-Origin Resource Sharing)#

Browsers block requests from one origin to another unless the server explicitly allows it:

sequenceDiagram
    participant B as Browser (app.example.com)
    participant S as API (api.other.com)
    
    B->>S: OPTIONS /data (preflight)
    S->>B: Access-Control-Allow-Origin: app.example.com
    B->>S: GET /data (actual request)
    S->>B: 200 OK + data

Key Takeaways#

1. HTTP is stateless — each request is independent (cookies/tokens add state)
2. Know your status codes — 2xx success, 4xx client error, 5xx server error
3. HTTPS is mandatory — TLS provides encryption + integrity + authentication
4. HTTP/2 multiplexes — one connection, many parallel requests
5. Cache-Control determines caching behavior — critical for performance
6. CORS is a browser security mechanism — servers must opt in