HTTP is the language browsers, apps and servers speak. It's a simple request and response: the client asks, the server answers.
The request
GET /cart HTTP/1.1
Host: shop.example.com
Authorization: Bearer abc123
Accept: application/json
- A method: what you want to do (
GET). - A path: what you want to do it to (
/cart). - Headers: extra information, like who you are and what format you want.
- Sometimes a body: data you're sending, like a new address in JSON.
The response
HTTP/1.1 200 OK
Content-Type: application/json
Cache-Control: max-age=60
{"items": 3, "total": 42.50}
A status code, headers, and usually a body.
Methods and status codes
| Method | Meaning | OK to retry (idempotent)? |
|---|---|---|
GET | Read something | Yes |
POST | Create something, or "do this action" | Not by default |
PUT | Replace something at this path | Yes |
PATCH | Change part of something | Not always |
DELETE | Remove something | Yes |
Idempotent means doing it twice has the same effect as doing it once. That matters when a
network call times out: you can retry a PUT without harm, but retrying a POST /payments might
charge someone twice. (HTTP also has a stricter word, safe, for methods that change nothing at
all, like GET. PUT and DELETE are idempotent but not safe.)
Status codes come in families: 2xx success (200 OK, 201 Created), 3xx go elsewhere
(301 Moved Permanently), 4xx the client did something wrong (400 Bad Request,
401 Unauthorized, 403 Forbidden, 404 Not Found, 429 Too Many Requests), 5xx the server
failed (500 Internal Server Error, 503 Service Unavailable).
HTTP is stateless: each request stands alone, and the server doesn't remember the last one. Things like "logged in" are carried in every request, usually as a cookie or a token. That's what lets any of your servers handle any request.
HTTPS
HTTPS is HTTP inside an encrypted TLS connection. It gives you:
- Privacy: nobody on the café Wi-Fi can read your password.
- Integrity: nobody can change the page on the way.
- Identity: the server proves, with a certificate signed by a trusted authority, that it
really is
shop.example.com.
Setting up TLS costs an extra round trip or so when connecting, so connections are kept open and reused. Today every site should use HTTPS; browsers warn users about plain HTTP.
Key idea: HTTP is a stateless request (method, path, headers, body) and response (status, headers, body). Know which methods are safe to retry and what each status family means. HTTPS adds encryption, integrity and server identity.