HTTPS
HTTP over TLS. Confidentiality, integrity, and (usually) server authentication.
Level: beginner
What is it?
HTTPS carries HTTP messages over a TLS-protected connection, commonly using TCP and TLS 1.3 or 1.2, or QUIC/TLS for HTTP/3. TLS authenticates the server using certificates and protects application data against network observation and modification when configured correctly.
Why does it matter?
HTTPS protects credentials, session cookies, API requests, and page content over untrusted networks. It does not guarantee that a website is honest, that the browser is malware-free, or that a compromised server keeps its own data safe.
Mental model
TLS establishes cryptographic keys and verifies the server's identity against a certificate and requested hostname. HTTP then travels inside the protected channel, rather than as readable application bytes on the network.
How it works
- A certificate chain links the server certificate to a trust anchor in the client trust store.
- Hostname validation and certificate validity dates matter; encryption without correct identity checks can protect a connection to the wrong party.
- TLS provides confidentiality and integrity for data in transit and authenticates the server in ordinary web usage.
- HTTP status codes and API semantics remain application-layer concerns; TLS does not make a broken API correct.
- Secure cookie flags, HSTS, authorization, and input validation solve different problems and complement HTTPS.
Steps
- The browser resolves the hostname and connects to the server.
- The client and server negotiate TLS parameters and validate certificates.
- They establish traffic keys and protect subsequent records.
- The browser sends the HTTP request inside the protected channel and checks the response.
Real-world usage
- Protecting logins, cookies, and API traffic.
- Explaining certificates, trust chains, and browser security warnings.
- Distinguishing transport security from application authorization.
Common mistakes
- Assuming the padlock proves a business is legitimate.
- Ignoring certificate hostname errors or telling users to bypass them.
- Treating HTTPS as a replacement for access control or secure application code.
Interview questions
What security properties does HTTPS provide?
TLS can provide confidentiality and integrity in transit and normally authenticates the server name through certificate validation.
Does HTTPS prevent SQL injection?
No. It protects data in transit; SQL injection must be prevented by safe query construction, typically parameterized queries, and appropriate database permissions.