Computer Networks

HTTP

The application protocol of the web: methods, status codes, headers, and now HTTP/2 and /3.

Level: beginner

What is it?

HTTP is a stateless application protocol. A client sends a request line, headers, and optional body; a server replies with a status, headers, and optional body. Versions: 1.0, 1.1 (persistent connections, pipelining), 2 (binary, multiplexed streams), 3 (over QUIC/UDP).

Why does it matter?

Browsers, APIs, scrapers, health checks — if it speaks to a web service, it speaks HTTP. Caching, auth, and content negotiation are all headers you have to get right.

Mental model

A letter with a verb and a path, plus sticky notes (headers). The connection that carries the letter is TCP (or QUIC). HTTP itself does not remember you; cookies and tokens do.

How it works

  • Methods: GET (safe, idempotent), HEAD, POST, PUT (idempotent), PATCH, DELETE (idempotent), OPTIONS.
  • Status classes: 1xx informational, 2xx success, 3xx redirect, 4xx client, 5xx server.
  • Headers are the control plane: Cache-Control, Authorization, Content-Type, CORS, cookies.
  • HTTP/1.1 is text. HTTP/2 is framed and multiplexed. HTTP/3 moves the transport to QUIC.
  • Stateless protocol, stateful applications — sessions live in cookies, tokens, or servers.

Steps

  • Resolve the host (DNS).
  • TCP connect (and TLS if https).
  • Send: GET /path HTTP/1.1 plus Host and other headers.
  • Read status and headers; decode the body (content-length or chunked).
  • Reuse the connection (keep-alive) or close.

Code example: A minimal request and response

GET /hello HTTP/1.1
Host: example.com
Accept: text/plain

HTTP/1.1 200 OK
Content-Type: text/plain
Content-Length: 5

hello

Real-world usage

  • Browsers
  • REST/JSON APIs
  • Webhooks and health checks

Common mistakes

  • Using GET for state changes (they get cached, prefetched, logged).
  • Treating status 200 as the only success; 201/204 exist for a reason.
  • Putting secrets in query strings — they land in logs and Referer.

Interview questions

Idempotent vs safe?

Safe methods do not change server state (GET, HEAD). Idempotent methods can be retried with the same effect (GET, PUT, DELETE). POST is neither.

What does Host exist for?

Name-based virtual hosting: many names, one IP. HTTP/1.1 made Host required.

HTTP/2 vs 1.1 in one sentence.

HTTP/2 multiplexes concurrent streams over one TCP connection with binary frames, killing head-of-line blocking at the HTTP layer (not at TCP).

Prerequisites

Related concepts

Continue learning

Browse the full computer science library