The Language of the Web

The Hypertext Transfer Protocol (HTTP) is a Layer 7 (Application Layer) protocol that dictates how messages are formatted and transmitted, and what actions web servers and browsers should take in response to various commands.

HTTP is fundamentally a Request-Response protocol. A client (browser) sends a request, and a server returns a response. It is also a stateless protocol—the server retains no memory of past requests. (State is managed artificially via Cookies).

The HTTP Request

An HTTP request contains: 1. Method: The action to perform. - GET: Retrieve a resource. (Safe, Idempotent). - POST: Submit data to create a new resource. (Not Idempotent). - PUT: Update a resource completely. (Idempotent). - PATCH: Update a resource partially. - DELETE: Remove a resource. 2. URI / Path: The resource being targeted (e.g., /users/123). 3. Headers: Metadata (e.g., User-Agent, Authorization, Accept-Encoding). 4. Body: Only present in POST/PUT/PATCH. Contains the actual data (JSON, form data).

HTTP Status Codes

The server's response begins with a 3-digit status code. - 1xx (Informational): Request received, continuing process. - 2xx (Success): The action was successfully received and accepted (e.g., 200 OK, 201 Created). - 3xx (Redirection): Further action must be taken (e.g., 301 Moved Permanently, 302 Found). - 4xx (Client Error): The request contains bad syntax or cannot be fulfilled (e.g., 400 Bad Request, 401 Unauthorized, 404 Not Found). - 5xx (Server Error): The server failed to fulfill an apparently valid request (e.g., 500 Internal Server Error, 502 Bad Gateway).

Important Headers

  • Host: Which site the client wants (one IP can host thousands of sites).
  • User-Agent: The client's identity string.
  • Accept / Accept-Encoding: What content types and compressions the client supports.
  • Authorization: Credentials (often a Bearer token).
  • Set-Cookie (response): Instructs the client to store a cookie.
  • Cache-Control / ETag: Caching directives and validators.

Idempotency

A request is idempotent if repeating it produces the same server state as issuing it once. GET, PUT, and DELETE are idempotent; POST is not. This matters enormously for retries: you can safely retry a failed GET or PUT, but retrying a POST can create duplicate orders or duplicate payments. Design APIs with idempotency keys for unsafe operations.

HTTPS (HTTP Secure)

HTTP transmits all data in plaintext. Anyone sniffing the network can read your passwords. HTTPS simply layers HTTP on top of TLS (Transport Layer Security). Before any HTTP data is sent, a cryptographic handshake occurs, establishing a symmetric encryption key. All subsequent HTTP headers and bodies are encrypted.

HTTP/2 and HTTP/3

  • HTTP/1.1: Opened a new TCP connection for every single asset (image, css, js). Extremely slow. Later added "Keep-Alive" to reuse connections, but still suffered from Head-of-Line blocking.
  • HTTP/2: Introduced Multiplexing over a single TCP connection. The server can send multiple streams of data concurrently. Also introduced Header Compression (HPACK).
  • HTTP/3: Replaces TCP entirely with QUIC (built on UDP) to achieve zero round-trip handshakes and eliminate TCP-level head-of-line blocking on lossy mobile networks.