HTTP protocol

The basic model

A client sends a request; a server sends one response. A browser is a client, but so are mobile apps, command-line tools and other servers. A resource might be an HTML document, image, API result or an action rather than a literal file.

HTTP is an application-layer protocol. HTTP/1.1 and HTTP/2 normally use TCP; HTTP/3 uses QUIC over UDP. HTTPS means HTTP is carried inside TLS, adding encryption, integrity and server authentication.

HTTP itself is stateless: each request contains the information needed to understand it. Applications create continuity with cookies, authorisation tokens, URLs and server-side sessions.

Anatomy of a URL

• Scheme chooses the protocol and security expectations: usually https.
• Host identifies the service and is resolved through DNS.
• Port identifies the receiving service; omitted defaults are 443 for HTTPS and 80 for HTTP.
• Path identifies a resource within that service.
• Query supplies parameters. Its format is application-defined.
• Fragment selects something within the returned representation. The browser uses it; it is not sent in an HTTP request.

Reserved or unsafe characters are percent-encoded as their bytes—for example a space is commonly represented as %20.

Requests and responses

In HTTP/1.1 a message is readable text headers followed, when present, by a body. The empty line separates headers from the body.

HTTP/2 and HTTP/3 encode the same concepts as binary frames rather than lines of text. The method, target, status, headers and body still have equivalent meaning.

Methods: what the client wants

Safe means the method is intended only to read. Idempotent means repeating the same request has the same intended effect as sending it once. A server can still log a GET, and two identical PUT responses need not be byte-for-byte identical.

Status codes: what happened

The first digit groups the result. The exact code is more useful than the broad class.

A 4xx does not necessarily mean buggy client software; it means the request cannot be fulfilled as sent. A 502 or 504 usually comes from a gateway or proxy speaking to another server.

Headers, representations and bodies

Headers carry metadata and control information. They are case-insensitive by name. A body carries the selected representation or submitted data.

Content negotiation lets one URL have different representations—for example JSON versus HTML or English versus French. The response’s Content-Type says what was actually chosen.

Cookies, sessions and state

A server creates a cookie with Set-Cookie. The browser stores it and sends it in later matching requests using the Cookie header. Often the value is an opaque session identifier; the meaningful session data remains on the server.

• Secure restricts sending to secure connections.
• HttpOnly prevents page JavaScript from reading the cookie, reducing some theft risk.
• SameSite controls cross-site sending and helps defend against CSRF.
• Domain and Path define where it applies.
• Max-Age or Expires makes it persistent; otherwise it is a session cookie.

Cookies are not automatically private values: unless protected appropriately, they travel with every matching request and can be changed by the client. Servers must validate them, use TLS, and protect sensitive session identifiers.

HTTP caching

Caching avoids transferring a representation again when a stored copy is fresh or still valid. Browsers, shared proxies and CDNs can all cache, subject to directives.

• Cache-Control: max-age=300 says the response is fresh for 300 seconds.
• private allows a private browser cache but not a shared cache; no-store asks caches not to store it.
• An ETag is a validator. The client sends If-None-Match; the server can answer 304 Not Modified with no representation body.
• Last-Modified and If-Modified-Since offer a time-based validator.

“No cache” is ambiguous in conversation. In HTTP, no-cache permits storage but requires revalidation before reuse; no-store prohibits storage.

HTTP/1.1, HTTP/2 and HTTP/3

HTTP/2 does not make TCP packet loss disappear: all streams share one ordered TCP byte stream. QUIC implements stream-level ordering, encryption and transport together, which is why HTTP/3 can isolate that delay. The HTTP meaning—methods, status codes, fields and resources—largely stays the same.