Session 1.3 – HTTP and HTTPS Protocols

Module 1: Introduction to Web Design | Duration: 1 hr

Learning Objectives

By the end of this session, students will be able to:

Understand the HTTP protocol and its role in web communication
Identify and explain different HTTP methods (GET, POST, PUT, DELETE, etc.)
Interpret HTTP status codes and their meanings
Understand HTTPS and SSL/TLS encryption
Compare HTTP and HTTPS protocols
Recognize the importance of secure web communication

Introduction to HTTP Protocols

HTTP (HyperText Transfer Protocol) is the foundation of data communication on the World Wide Web. It defines how messages are formatted and transmitted between web browsers and servers.

Key Concept

HTTP is a stateless, application-layer protocol that follows a request-response model. Each transaction is independent, with no built-in memory of previous interactions.

HTTP Protocol

HTTP was invented by Tim Berners-Lee in 1989 along with HTML and URLs. It operates on top of TCP/IP and typically uses port 80.

                                    HTTP Characteristics
                                    Stateless: No memory of previous requests
Text-based: Human-readable format
Port 80: Default communication port
Request-Response: Client initiates, server responds

                                

                                    HTTP Versions
                                    HTTP/0.9 (1991): Original version, GET only
HTTP/1.0 (1996): Added headers, methods
HTTP/1.1 (1997): Persistent connections
HTTP/2 (2015): Binary, multiplexing
HTTP/3 (2022): QUIC protocol

                                

HTTP Request Structure

GET /index.html HTTP/1.1
Host: www.example.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
Accept: text/html,application/xhtml+xml
Accept-Language: en-US,en;q=0.9
Connection: keep-alive

[Optional Request Body]

HTTP Response Structure

HTTP/1.1 200 OK
Date: Mon, 13 Nov 2024 10:00:00 GMT
Server: Apache/2.4.41
Content-Type: text/html; charset=UTF-8
Content-Length: 1234
Connection: keep-alive

<html>
  <body>
    <h1>Welcome!</h1>
  </body>
</html>

HTTP Methods

HTTP defines several request methods (also called HTTP verbs) to indicate the desired action:

GET

Purpose: Retrieve data from the server

Characteristics: Safe, idempotent, cacheable

                                        GET /api/users/123 HTTP/1.1

                                        Host: example.com

POST

Purpose: Submit data to create a resource

Characteristics: Not safe, not idempotent

                                        POST /api/users HTTP/1.1

                                        Content-Type: application/json

                                        {"name": "John"}

PUT

Purpose: Update an existing resource

Characteristics: Not safe, idempotent

                                        PUT /api/users/123 HTTP/1.1

                                        Content-Type: application/json

                                        {"name": "Jane"}

DELETE

Purpose: Remove a resource

Characteristics: Not safe, idempotent

                                        DELETE /api/users/123 HTTP/1.1

                                        Host: example.com

PATCH

Purpose: Partial update of a resource

Characteristics: Not safe, not necessarily idempotent

                                        PATCH /api/users/123 HTTP/1.1

                                        Content-Type: application/json

                                        {"email": "new@example.com"}

HEAD

Purpose: Get headers without body

Characteristics: Safe, idempotent, like GET without body

                                        HEAD /api/users/123 HTTP/1.1

                                        Host: example.com

Key Terms

Safe: Does not modify server state (read-only)
Idempotent: Multiple identical requests have the same effect as a single request
Cacheable: Response can be stored and reused

HTTP Status Codes

Status codes indicate the result of an HTTP request. They are grouped into five classes:

1xx - Informational

100 Continue: Server has received request headers
101 Switching Protocols: Switching to WebSocket, HTTP/2

2xx - Success

200 OK: Request succeeded
201 Created: Resource successfully created
204 No Content: Success but no content to return

3xx - Redirection

301 Moved Permanently: Resource has new permanent URL
302 Found: Temporary redirect
304 Not Modified: Cached version is still valid

4xx - Client Error

400 Bad Request: Invalid syntax or request
401 Unauthorized: Authentication required
403 Forbidden: Server refuses to fulfill request
404 Not Found: Resource does not exist
405 Method Not Allowed: HTTP method not supported

5xx - Server Error

500 Internal Server Error: Generic server error
502 Bad Gateway: Invalid response from upstream server
503 Service Unavailable: Server temporarily unavailable
504 Gateway Timeout: Upstream server timeout

HTTPS Protocol

HTTPS (HTTP Secure) is the encrypted version of HTTP. It uses SSL/TLS to secure communication between client and server.

HTTPS Features

Encryption: Data encrypted during transmission
Authentication: Verifies server identity
Data Integrity: Prevents data tampering
Port 443: Default secure port
SSL/TLS: Cryptographic protocols

SSL/TLS Certificates

Digital certificates issued by Certificate Authorities (CA)
Contains public key and server identity
Browsers verify certificate validity
Green padlock icon indicates secure connection
Required for modern web applications

HTTPS Handshake Process

Client Hello: Client sends supported SSL/TLS versions and cipher suites
Server Hello: Server selects protocol version and cipher suite
Certificate: Server sends its SSL certificate
Verification: Client verifies certificate with CA
Key Exchange: Client and server establish session keys
Encrypted Communication: Data encrypted with session keys

HTTP vs HTTPS Comparison

Aspect	HTTP	HTTPS
Security	Not secure, data in plain text	Secure, encrypted communication
Port	80	443
Protocol	Operates at Application Layer	Operates at Transport Layer (SSL/TLS)
URL Scheme	http://	https://
Certificate	Not required	SSL certificate required
SEO Ranking	Lower priority	Higher priority (Google preference)
Performance	Slightly faster (no encryption overhead)	Minimal overhead with modern hardware
Use Case	Public information, no sensitive data	Login, payments, personal data

Why HTTPS Matters

User Privacy: Protects sensitive information from eavesdropping
Data Integrity: Prevents man-in-the-middle attacks
Trust: Users trust sites with padlock icon
SEO Benefits: Google prioritizes HTTPS sites
Browser Warnings: Modern browsers flag HTTP sites as "Not Secure"
Compliance: Required by PCI DSS, GDPR, and other regulations

Session Summary

Key Points

HTTP is a stateless, text-based protocol for web communication on port 80
HTTP methods (GET, POST, PUT, DELETE, etc.) define operations on resources
Status codes indicate request outcomes: 2xx (success), 3xx (redirect), 4xx (client error), 5xx (server error)
HTTPS adds encryption via SSL/TLS for secure communication on port 443
HTTPS provides encryption, authentication, and data integrity
Modern web applications should use HTTPS for security, trust, and SEO benefits

Next Session Preview

In the next session, we will explore HTML Fundamentals and Tags, learning how to structure web content using the HyperText Markup Language.

Previous Session Course Home Next Session