Post

HTTP

Posted Updated
By Sebastien neyt 1 min read

HTTP

Hypertext Transfer Protocol is an application layer protocol used for transmitting hypermedia documents, such as HTML. It follows a client-server model where the client submits an HTTP request, and the server responds with an HTTP response. It is also stateless, so each request is independent and has no knowledge of what came before it.

HTTP key concepts

URL (uniform resource locator): An HTTP URL is used to find a resource on the web.

HTTP Request: Contains a request method (e.g. GET, POST, PUT, DELETE), URI, protocol version, request headers and optionally a body.

HTTP Response: Contains a status line, response header fields, and optionally a body.

HTTP Methods:

  • GET: Request a specific resource
  • POST: Submits data to be processed by the resource.
  • PUT: Updates an existing resource.
  • DELETE: Deletes a specific resource.
  • HEAD: Similar to GET but without the response body.
  • OPTIONS: Returns the HTTP methods that the server supports for the specified URL.
  • PATCH: Applies partial modifications to a resource.

Status Codes: Indicate the result of the HTTP request. Some common ones include:

  • 200 OK: Request was successful.
  • 404 Not Found: The server could not find the requested resource.
  • 500 Internal Server Error: The server encountered an error and could not complete the request.
  • Headers: Provide additional information about the request or the response. Here are some common ones.

General Headers

  • Connection: Control options for the current connection (e.g., keep-alive, close).
  • Content-Length: The size of the response body in bytes.
  • Content-Type: The media type of the body of the request (used with POST and PUT requests).

Request Headers

  • Accept: Media type(s) that is/are acceptable for the response.
  • Cookie: HTTP cookies previously sent by the server.
  • Host: The domain name of the server (for virtual hosting), and the TCP port number on which the server is listening.

Response Headers

  • Set-Cookie: An HTTP cookie.
  • WWW-Authenticate Defines the authentication method that should be used to access a resource.

Things to look out for

  • Is there a session cookie that gives away the underlying technology?
    • ASPSESSIONID (.NET)
    • PHPSESSIONID (PHP)
    • JSESSIONID (Java)
  • Is there a X-Powered-By header?
WEB, FUNDAMENTALS
HTTP
This post is licensed under CC BY 4.0 by the author.