Episode 1 — Fundamentals / 1.4 — Understanding HTTP and HTTPS

1.4 — Understanding HTTP & HTTPS: Quick Revision

Compact cheat sheet. Print-friendly.

How to use this material (instructions)

  1. Skim in one pass before interviews or exams.
  2. If anything is fuzzy — jump to the matching file: README.md → 1.4.a…1.4.g.
  3. Drills — 1.4-Exercise-Questions.md.
  4. Polished answers — 1.4-Interview-Questions.md.

HTTP versions (30-second version)

VerTransport (typical)Big idea
1.1TCPKeep-alive, Host header, text headers
2TCPMultiplex streams, HPACK, binary framing
3QUIC/UDPFaster handshakes, stream independence vs TCP HOL

Status codes (must know)

CodeMeaning
200OK
201Created
204No content
301Permanent redirect
304Not modified (cache)
400Bad request
401Unauthorized (authn)
403Forbidden (authz)
404Not found
429Rate limited
500Server error
502Bad gateway
503Unavailable

HTTP vs HTTPS

HTTPHTTPS
EncryptionNoTLS
Port80443
Tamper riskHighMitigated
IdentityWeakServer certs + PKI

TLS gives: confidentiality + integrity + (server) authentication.

TLS / SSL naming

  • Say TLS, not SSL (SSL deprecated/insecure).
  • TLS 1.3 = modern best practice.
  • Cert = binds public key ↔ names (SAN), signed by CA chain.

Proxies

TypeSits nearPurpose
ForwardClient / orgegress control, filtering, anonymity patterns
ReverseServer edgeTLS termination, LB, cache, WAF

CDN edge behaves like a reverse proxy + cache globally.

VPN (one diagram in words)

You → encrypted tunnel → VPN server → internet (sites see VPN IP).

  • Does not replace HTTPS to websites (different hop).
  • Watch for DNS leaks / misconfigurations.

One-liner distinctions

TermOne-liner
HTTPSHTTP bytes inside a TLS tunnel
SNITLS extension indicating hostname (privacy nuance historically)
HSTSBrowser policy forcing HTTPS for a domain
mTLSBoth sides present client+server certs (less common on public web)

← Back to 1.4 — Understanding HTTP & HTTPS (README)