HyperText Transfer Protocol (HTTP)

1. Overview and Design Principles

The HyperText Transfer Protocol (HTTP) (RFC 2616 / 7230) is the foundational request-response application protocol that powers the World Wide Web.

Key Architectural Traits:

Client-Server Model: A client (web browser) initiates a connection to an HTTP server and sends a request; the server processes the request and returns a response.
Underlying Transport: Operates over TCP Port 80 (Unencrypted HTTP) and TCP Port 443 (Encrypted HTTPS over TLS).
Stateless Protocol: The server retains zero memory (state) of previous requests from the same client. Each transaction is processed completely independently.
State Management via Cookies: To maintain shopping carts, login states, and user sessions, web servers use Cookies (Set-Cookie response header and Cookie request header).

2. HTTP Message Formats

HTTP messages are human-readable, plain ASCII text structures:

  HTTP REQUEST MESSAGE:
  GET /index.html HTTP/1.1
             <=== Request Line (Method, URI, Version)
  Host: www.example.com
                <=== Request Headers
  User-Agent: Mozilla/5.0

  Accept: text/html

  Connection: keep-alive

  
                                     <=== Mandatory Empty Line
  [ Optional Request Body (e.g. POST data) ]

  HTTP RESPONSE MESSAGE:
  HTTP/1.1 200 OK
                      <=== Status Line (Version, Code, Reason)
  Date: Mon, 22 Sep 2026 12:00:00 GMT
  <=== Response Headers
  Server: Apache/2.4.52

  Content-Type: text/html; charset=UTF-8

  Content-Length: 1254

  
                                     <=== Mandatory Empty Line
  <!DOCTYPE html><html>...</html>          <=== Entity Body (HTML / Image / JSON)

3. HTTP Methods and Idempotency

+-----------+-----------------------------------+-----------+-----------------+
| METHOD    | ACTION                            | SAFE?     | IDEMPOTENT?     |
+-----------+-----------------------------------+-----------+-----------------+
| **GET**   | Retrieve representation of data   | **Yes**   | **Yes**         |
| **POST**  | Submit data / create new resource | **No**    | **No**          |
| **PUT**   | Replace or create at exact URI    | **No**    | **Yes**         |
| **DELETE**| Delete resource at exact URI      | **No**    | **Yes**         |
| **HEAD**  | Same as GET, but returns headers only | **Yes** | **Yes**     |
| **OPTIONS**| Query supported methods by server| **Yes**   | **Yes**         |
+-----------+-----------------------------------+-----------+-----------------+

Safe Method: A method that does not alter server state (read-only: GET, HEAD).
Idempotent Method: Executing the request multiple times produces the exact same server state as executing it once (GET, PUT, DELETE).

4. HTTP Status Code Categories

Status codes are 3-digit integers returned by the server:

+-----------+-----------------------+-------------------------------------------------------------+
| CODE      | CATEGORY              | COMMON EXAMPLES                                             |
+-----------+-----------------------+-------------------------------------------------------------+
| **1xx**   | Informational         | 101 Switching Protocols (WebSockets upgrade)                |
| **2xx**   | **Success**           | **200 OK**, **201 Created**, **204 No Content**              |
| **3xx**   | **Redirection**       | **301 Moved Permanently**, **302 Found**, **304 Not Modified**|
| **4xx**   | **Client Error**      | **400 Bad Request**, **401 Unauthorized**, **403 Forbidden**, |
|           |                       | **404 Not Found**, **408 Request Timeout**                  |
| **5xx**   | **Server Error**      | **500 Internal Server Error**, **502 Bad Gateway**,         |
|           |                       | **503 Service Unavailable**, **504 Gateway Timeout**        |
+-----------+-----------------------+-------------------------------------------------------------+

5. Evolution: HTTP/1.0 vs. HTTP/1.1 vs. HTTP/2 vs. HTTP/3

  HTTP/1.0 (Non-Persistent):
  [TCP Handshake] ──> [GET /index.html] ──> [TCP Teardown]
  [TCP Handshake] ──> [GET /style.css]  ──> [TCP Teardown]
  (Wasteful: 2 RTTs per single embedded image!)

  HTTP/1.1 (Persistent with Keep-Alive):
  [TCP Handshake] ──> [GET /index.html] ──> [GET /style.css] ──> [GET /logo.png]
  (Reuses single TCP socket; suffers from Head-of-Line blocking!)

  HTTP/2 (Multiplexed Binary Streams over Single TCP):
  [ Streams 1, 2, 3 interleaved concurrently on a single connection! ]

  HTTP/3 (Multiplexed over QUIC / UDP):
  [ Zero Head-of-Line blocking; 0-RTT connection migration! ]

HTTP/1.0 (Non-Persistent): Every resource requires opening and closing a separate TCP connection. If a webpage contains 50 images, 50 full TCP handshakes are executed!
HTTP/1.1 (Persistent): Introduced Connection: keep-alive (default), keeping the TCP connection open for subsequent requests. Supports pipelining, but suffers from Application Head-of-Line Blocking (request #2 cannot complete until request #1 finishes).
HTTP/2: Replaces text with a Binary Framing Layer. Fully multiplexes multiple request/response streams concurrently over a single TCP connection, adds HPACK header compression, and supports Server Push.
HTTP/3: Built on QUIC over UDP (Port 443), eliminating TCP-level packet loss Head-of-Line blocking and enabling 0-RTT handshakes.

6. Key Exam Questions & Takeaways

Why is HTTP described as a stateless protocol? How is state maintained?
- HTTP servers do not retain information regarding past client transactions. State is maintained using HTTP Cookies and session tokens: the server sets a cookie in the response header (Set-Cookie), which the client sends back in all future request headers (Cookie).
Compare Non-Persistent and Persistent HTTP connections.
- Non-persistent HTTP (HTTP/1.0) creates and tears down a separate TCP connection for every single referenced web object, consuming $2\text{ RTTs}$ per object. Persistent HTTP (HTTP/1.1) reuses a single open TCP connection to fetch multiple objects sequentially.
What is the difference between HTTP/1.1 and HTTP/2?
- HTTP/1.1 uses text-based formatting and processes requests sequentially (suffering Head-of-Line blocking). HTTP/2 uses binary framing and multiplexes multiple independent request streams simultaneously over a single TCP connection without blocking.

HTTP