HTTP vs HTTPS
| Point | HTTP | HTTPS |
| Security | Plain text; can be read or altered in transit | Encrypted with TLS/SSL |
| Port | 80 | 443 |
| Certificate | Not needed | Server proves identity with a CA-signed certificate |
| Integrity | None | Tampering is detected |
| Use | Non-sensitive content | Logins, banking, payments, everything today |
HTTP request–response cycle
- The browser resolves the domain name to an IP address via DNS.
- It opens a TCP connection to the server (plus a TLS handshake for HTTPS).
- It sends a request: method + URL + headers (+ body), e.g. GET /index.html HTTP/1.1, Host: example.com.
- The server processes it and sends a response: status code + headers + body, e.g. HTTP/1.1 200 OK with the HTML.
- The browser renders the page; the connection is kept alive or closed. HTTP is stateless, so cookies or tokens carry the session.
Common status codes: 200 OK, 201 Created, 301 Moved, 400 Bad Request, 401 Unauthorized, 403 Forbidden, 404 Not Found, 500 Internal Server Error.
Common methods
- GET — retrieve a resource (no body; safe, idempotent).
- POST — create a resource / submit data.
- PUT — replace a resource entirely (idempotent).
- PATCH — partially update a resource.
- DELETE — remove a resource.
- HEAD (headers only) and OPTIONS (allowed methods, CORS pre-flight).
— rhs