Handbooks / Computer Networks / Chapter 5

HTTP and TLS

7 pages · ~5 min✓ Reviewed

Builds on DNS.

Computer NetworksPage 1

HTTP Mental Model

1. Stateless request/response

  • Text-based: client sends one request, server returns one response
  • Server keeps no memory between requests
  • Stateless is why cookies and tokens exist

2. Message shape

RequestResponse
Start lineGET /path HTTP/1.1HTTP/1.1 200 OK
Nextheadersheaders
Thenblank lineblank line
Endoptional bodyoptional body
http
GET /users?id=7 HTTP/1.1
Host: example.com
Accept: application/json

a request with no body

3. URL and ports

  1. https://scheme
  2. example.comhost
  3. :443port
  4. /userspath
  5. ?id=7query
  6. #topfragment
  • Default ports: HTTP 80, HTTPS 443
Fragment

The #fragment is never sent to the server.

Computer NetworksPage 2

Methods and Status Codes

1. Methods

MethodUseIdempotent
GETreadsyes
POSTcreates or triggersno
PUTreplaces whole resourceyes
PATCHchanges partno
DELETEremovesyes
  • Safe (no state change): GET, HEAD, OPTIONS
  • Idempotent: repeating gives the same result
  • POST is neither safe nor idempotent

2. Status Codes

  1. 1xxinfo
  2. 2xxsuccess
  3. 3xxredirect
  4. 4xxclient
  5. 5xxserver
CodeMeaning
200OK
201Created
204No Content
301 / 302permanent / temporary redirect
304Not Modified

3. Errors

  • 400 bad request
  • 401 unauthenticated
  • 403 forbidden
  • 404 not found
  • 429 rate limited
  • 500 server bug
  • 502 bad gateway
  • 503 unavailable
  • 504 gateway timeout
401 vs 403

401 = who are you? 403 = you are known, but not allowed.

Computer NetworksPage 3

Headers and Cookies

1. Headers

RequestJob
Hostrequired in HTTP/1.1
User-Agentclient software
Acceptformats wanted
Authorization: Bearer <token>credentials
Content-Typebody format, application/json
ResponseJob
Content-Typebody format
Content-Lengthbody size
Locationredirect target (3xx)
Cache-Control: max-age=3600cache for 1 hour
ETagvalidator for revalidation
  1. ETagserver sends
  2. If-None-Matchclient revalidates
  3. 304reuse cached copy

2. Cookies

  • Server sends Set-Cookie; browser returns Cookie on every matching request
http
Set-Cookie: id=abc; HttpOnly; Secure; SameSite=Lax; Max-Age=3600
Cookie: id=abc
  • HttpOnly: hidden from JavaScript
  • Secure: HTTPS only
  • SameSite=Lax/Strict: limits cross-site sending, defends against CSRF
  • Max-Age / Expires: lifetime; Path / Domain: scope
Common mistakes

Session token in a cookie without HttpOnly + Secure + SameSite, or credentials in a URL query string.

Computer NetworksPage 4

HTTP/1.1 vs HTTP/2 vs HTTP/3

1. HTTP/1.1

  • Text protocol over TCP
  • One request at a time per connection: head-of-line blocking
  • Browsers open ~6 parallel connections per host
  • Keep-alive reuses a connection

2. HTTP/2 and HTTP/3

1.123
Runs onTCPTCPQUIC on UDP
Formattextbinary framesbinary frames
Requestsserialmultiplexedmultiplexed
HOL blockingper connectionTCP levelown stream only
  • HTTP/2: many streams on one connection, HPACK header compression
  • HTTP/3: TLS 1.3 built in, faster handshake, connection migration

3. Negotiation and Trade-off

  1. TLS handshakeALPN picks h2
  2. ResponseAlt-Svc: h3
  3. QUIC connectionHTTP/3 next
  • Semantics unchanged: methods, status codes, headers
  • 1.1 needs bundling and domain sharding for speed
  • HTTP/2 and HTTP/3 make both unnecessary
Remember

HTTP/2 stays stuck on TCP-level blocking; only HTTP/3 on QUIC isolates packet loss per stream.

Computer NetworksPage 5

HTTPS, TLS Handshake and Certificates

1. What HTTPS Gives

  • HTTPS = HTTP inside TLS, on port 443
  • Encryption: nobody on the path can read the data
  • Integrity: tampering is detected
  • Server authentication: you reach the real domain

2. TLS 1.3 Handshake

  1. ClientHelloversions, ciphers, key share
  2. ServerHello+ certificate + key share
  3. Derive keysboth sides
  4. Finisheddata flows
  • Takes 1 round trip
  • ECDHE key exchange sets up the session
  • AES-GCM or ChaCha20 then carries the data fast
  • Ephemeral keys give forward secrecy

3. Certificates

  • A certificate binds a domain name to a public key
  • A certificate authority (CA) signs it
Browser validates up to its root store
  1. 1Leafyour domain
  2. 2Intermediatesigns leaf
  3. 3Roottrusted store
CheckVerifies
Signature chaineach cert signed by the next, ends at a trusted root
Hostname (SAN)domain is listed in the SAN
Validity datestoday is inside the dates
RevocationOCSP or CRL says not revoked
Let's Encrypt

Issues free certificates valid 90 days, so automate renewal.

Computer NetworksPage 6

HTTP Cheat Sheet

1. curl essentials

  • -i shows response headers, -v shows the TLS handshake and headers
  • -L follows redirects, --http2 / --http3 pick the protocol
bash
curl -i URL
curl -X POST -H 'Content-Type: application/json' -d '{"a":1}' URL
curl -v URL
curl -L URL
curl --http2 URL   # or --http3

2. Methods and status

MethodMeaningIdempotent
GETreadyes
POSTcreateno
PUTreplaceyes
PATCHpartial updateno
DELETEremoveyes
  • 2xx ok, 3xx go elsewhere, 4xx your fault, 5xx server's fault
  • 401 = who are you? 403 = not allowed

3. Protocols, cookies, TLS

VersionTransportStyle
1.1TCPserial
2TCPmultiplexed
3QUIC / UDPmultiplexed
  • Cookie flags to always set: HttpOnly; Secure; SameSite=Lax
  • s_client shows the cert chain; failures: expired cert, hostname mismatch, missing intermediate, untrusted CA
bash
openssl s_client -connect host:443 -servername host
Computer NetworksPage 7

Check yourself

A user sends a valid token, but GET /admin fails. Is it 401 or 403?
  • 403: the server knows who you are, but you aren't allowed.
  • 401 means missing or invalid credentials.
Set-Cookie: sid=abc; Secure; SameSite=Lax. Can an injected script read it with document.cookie?
  • Yes: HttpOnly is missing.
  • Secure and SameSite don't hide a cookie from JavaScript.
One packet is lost on an HTTP/2 connection carrying 10 streams. What stalls?
  • All 10 streams: TCP delivers bytes in order, so everything waits for the retransmit.
  • HTTP/3 over QUIC stalls only the stream that lost the packet.
The same PUT is sent three times, then the same POST three times. What differs?
  • PUT is idempotent: the state after three calls equals the state after one.
  • POST may create three resources, so it is not safe to retry blindly.