HTTP (HyperText Transfer Protocol)
1. Definition and Characteristics
HTTP is the application-layer protocol of the WWW, used between a web client (browser) and a web server. Port 80 (HTTPS = 443).
| Characteristic | Meaning |
|---|---|
| Client–server | Browser issues a request; server returns a response |
| Stateless | Each request is independent — the server remembers nothing between requests (state is added via cookies, sessions, tokens) |
| Text-based (ASCII) | Human-readable headers (HTTP/1.x) |
| Flexible | Carries any media type via the Content-Type (MIME) header |
| Connection oriented | Runs over TCP (HTTP/1.1 default persistent connections); HTTP/3 uses QUIC/UDP |
| Media independent | Any data type can be sent as long as both sides know the format |
2. HTTP Message Structure
Request: Response:
METHOD /path HTTP/1.1 HTTP/1.1 200 OK
Header: value Server: Apache
Header: value Content-Type: text/html
(blank line) Content-Length: 512
[body] (blank line)
<html>...body...</html>
3. Request Methods
| Method | Purpose | Idempotent |
|---|---|---|
| GET | Retrieve a resource; parameters in URL | Yes |
| POST | Send data to be processed (form submit); body carries data | No |
| PUT | Upload/replace a resource at a URL | Yes |
| DELETE | Remove a resource | Yes |
| HEAD | Like GET but response has headers only (no body) | Yes |
| OPTIONS | Ask which methods/content-types are supported | Yes |
| TRACE / PATCH / CONNECT | Loopback diagnostics / partial update / tunnelling (HTTPS proxy) | — |
GET vs POST: GET appends data to the URL (bookmarkable, cacheable, length-limited, visible); POST sends data in the message body (secure-ish for sensitive data, no length limit, not cached).
4. Status Codes
| Class | Meaning | Examples |
|---|---|---|
| 1xx | Informational | 100 Continue |
| 2xx | Success | 200 OK, 201 Created, 204 No Content |
| 3xx | Redirection | 301 Moved Permanently, 302 Found, 304 Not Modified (cache) |
| 4xx | Client error | 400 Bad Request, 401 Unauthorized, 403 Forbidden, 404 Not Found |
| 5xx | Server error | 500 Internal Server Error, 502 Bad Gateway, 503 Service Unavailable |
5. Important Headers
| Header | Direction | Purpose |
|---|---|---|
Host |
Request | Names the virtual host (mandatory in 1.1) |
User-Agent |
Request | Browser/client identity |
Accept, Accept-Language |
Request | Content negotiation |
Cookie / Set-Cookie |
Both | Session state |
Referer |
Request | Previous page URL |
Content-Type, Content-Length |
Response/req | MIME type and body size |
Cache-Control, Expires, ETag, If-Modified-Since |
Both | Caching / conditional GET |
Location |
Response (3xx) | Redirect target |
Connection: keep-alive / close |
Both | Persistent connection control |
6. Persistent vs Non-persistent Connections
- Non-persistent (HTTP/1.0): one TCP connection per object → high latency (slow start each time).
- Persistent (HTTP/1.1 default): several objects over one connection; with pipelining, requests are sent back-to-back. HTTP/2 adds multiplexing over one connection; HTTP/3 uses QUIC (UDP) to avoid TCP head-of-line blocking.
7. Example Interaction
GET /index.html HTTP/1.1
Host: www.abc.com
User-Agent: Mozilla/5.0
Accept: text/html
Connection: keep-alive
HTTP/1.1 200 OK
Server: Apache
Content-Type: text/html; charset=UTF-8
Content-Length: 1024
Set-Cookie: sessionId=abc123; Path=/; HttpOnly
<html> ... </html>
Conditional request: client sends If-Modified-Since: <date>; server answers 304 Not Modified and the browser uses its cached copy — saving bandwidth.
8. HTTPS
HTTP over TLS/SSL (port 443): certificates authenticate the server, keys encrypt the traffic, integrity is protected. URLs become https://.
9. Exam Points
- Explain HTTP: characteristics, request/response format with an example — 10 marks (very frequent).
- Explain HTTP methods (GET, POST, PUT, DELETE, HEAD, OPTIONS) and status code classes — 7 marks.
- GET vs POST comparison — 5 marks (very frequent).
- Persistent vs non-persistent connections; HTTP/1.0 vs 1.1 — 5 marks.
- How does a stateless protocol maintain sessions? (cookies) — 3-5 marks.