HTTP/HTTPS

HTTP (Hypertext Transfer Protocol) is the protocol used to fetch resources such as HTML pages, images, JSON, and other web content.

HTTPS is HTTP over TLS/SSL, meaning the HTTP traffic is encrypted and authenticated.

HTTPS protects data in transit from eavesdropping, tampering, and impersonation.

A URL (Uniform Resource Locator) is the address used to identify a web resource, such as https://example.com/page.

A URI (Uniform Resource Identifier) is a string that identifies a resource, and a URL is a type of URI.

A scheme is the protocol portion of a URL, such as http or https.

A host is the server name or IP address that receives the request, such as example.com.

A port is a communication endpoint, such as 80 for HTTP and 443 for HTTPS.

A path identifies a resource location on the server, such as /products/123.

A query string is the part of a URL after ? used to send parameters, such as ?page=2&sort=asc.

A fragment is the part after # and is mainly used by the client for page anchors, such as #section-2.

A client is the program or browser that sends an HTTP request.

A server is the program that receives the request and returns a response.

An HTTP request is a message sent by the client to the server asking for a resource or action.

An HTTP response is the server’s answer to the client’s request.

A status code tells the client the result of the request, such as 200 OK or 404 Not Found.

200 OK means the request succeeded.

201 Created means the request created a new resource.

204 No Content means the request succeeded but there is no response body.

301 Moved Permanently indicates the resource has permanently moved to another URL.

302 Found means the resource is temporarily at a different location.

304 Not Modified tells the client the cached version is still valid.

400 Bad Request means the request is malformed or invalid.

401 Unauthorized means authentication is required.

403 Forbidden means the client is authenticated but not allowed to access the resource.

404 Not Found means the resource does not exist.

405 Method Not Allowed means the HTTP method is not supported for that endpoint.

500 Internal Server Error indicates the server encountered an unexpected error.

503 Service Unavailable means the server is temporarily unable to handle the request.

An HTTP method defines the action to perform, such as GET, POST, PUT, DELETE, PATCH.

GET is used to retrieve a resource without changing the server state.

POST is used to submit data to create or process a resource.

PUT replaces or creates a resource at a known URI.

PATCH applies partial updates to a resource.

DELETE removes a resource.

HEAD requests the headers for a resource without fetching the body.

OPTIONS asks the server which methods are allowed for a resource.

TRACE echoes the request back to the client for debugging.

CONNECT establishes a tunnel, often used by proxies and HTTPS tunneling.

A request header contains metadata about the request, such as Host, User-Agent, Accept, and Authorization.

A response header contains metadata about the response, such as Content-Type, Server, Cache-Control, and Location.

The request body contains data sent to the server, such as JSON, form fields, or file content.

The response body contains the actual resource data sent back to the client.

An HTTP header is metadata sent as part of a request or response.

The Host header tells the server which virtual host is being requested.

The User-Agent header identifies the client software, such as a browser or API client.

The Accept header tells the server what content types the client supports.

Content-Type tells the client or server what kind of data is present in the body.

The Authorization header carries credentials such as tokens or basic auth credentials.

The Cookie header sends state from the client back to the server.

Set-Cookie is a response header used to create or update a browser cookie.

Caching stores copies of response data to reduce latency and server load.

Cache-Control is a response or request header that controls caching behavior.

ETag is a unique identifier for a resource version, used for conditional requests.

If-None-Match allows a client to ask the server for the resource only if it has changed.

Last-Modified is a header giving the last modification time of a resource.

If-Modified-Since allows the client to validate cached resources.

A browser cache stores HTTP responses locally to avoid repeated network requests.

A CDN (Content Delivery Network) caches content closer to users to improve delivery speed.

A reverse proxy sits in front of servers and forwards client requests to backend services.

A forward proxy handles requests on behalf of clients, often for filtering or caching.

HTTP is stateless, meaning each request is independent and does not inherently retain previous request state.

Because it is designed to be simple, scalable, and independent across requests.

A session is a way to maintain state across multiple HTTP requests, usually using cookies or tokens.

A cookie is a small piece of client-side state stored by the browser and sent with future requests.

Cookies allow the server to remember preferences, login state, and session information.

Session management is the technique for associating a user or client with a stateful session.

A token is a credential or identifier used to authenticate or authorize requests, often in headers or cookies.

A bearer token is a token that grants access to whoever possesses it, so it must be protected.

Basic Auth sends a username and password encoded as base64 inside the Authorization header.

It is not very secure unless used over HTTPS and is weaker than modern token-based auth.

A REST API is a web API that uses HTTP methods and resources to perform operations.

An endpoint is a URL or path exposed by a service.

API versioning allows multiple versions of an API to coexist as the system evolves.

JSON is a common data format used in HTTP request and response bodies.

XML is another structured document format often used in older APIs.

Content negotiation lets client and server agree on the best representation format, such as JSON vs XML.

Accept-Encoding tells the server what compression formats the client supports, such as gzip or br.

gzip is a common compression format used to reduce HTTP payload size.

TLS (Transport Layer Security) provides encryption, integrity, and authentication for network traffic.

Because it protects HTTP data during transmission.

A certificate is a digitally signed document used to prove identity in TLS.

A certificate authority (CA) issues and signs digital certificates.

Certificate validation confirms that a presented server certificate is trusted and matches the domain.

A self-signed certificate is signed by itself rather than by a trusted authority.

A certificate chain is the sequence of certificates used to establish trust to a root CA.

The TLS handshake is the negotiation that establishes encrypted communication between client and server.

SNI is an extension that allows a client to specify the hostname it wants to connect to during the TLS handshake.

It allows multiple HTTPS sites to share the same IP address and certificate selection.

HSTS (HTTP Strict Transport Security) tells browsers to always use HTTPS for a domain.

It prevents downgrade attacks and makes HTTPS enforcement more reliable.

A redirect tells the browser to fetch another URL, usually using 3xx status codes.

A relative URL is a path relative to the current resource, such as /login.

An absolute URL includes the full scheme, host, and path, such as https://example.com/login.

A web browser is a client that renders HTML and makes HTTP requests to web servers.

A web server processes HTTP requests and returns resources or data.

A reverse proxy accepts traffic and forwards it to one or more application servers.

CORS (Cross-Origin Resource Sharing) controls which websites can access a resource from another origin.

Same-Origin Policy restricts scripts from reading data across origins unless allowed by CORS.

An origin is the scheme, host, and port combination, such as https://app.example.com.

A preflight request is an OPTIONS request sent before a cross-origin request to check allowed methods and headers.

A non-simple request is a cross-origin request that uses custom headers, credentials, or non-standard methods.

Cookies are subject to origin restrictions and often require credentials mode to be explicitly enabled.

To protect users and prevent unauthorized cross-site data access.

Session fixation is when an attacker forces a user to use a known session ID to gain unauthorized access.

Because credentials and session tokens must not be exposed across the network.

CSRF (Cross-Site Request Forgery) tricks a user’s browser into sending a request to a trusted site.

XSS (Cross-Site Scripting) injects malicious scripts into a website or application.

HTTP alone does not prevent injection; security must be handled in the application and content policies.

A same-site cookie restricts cross-site sending of cookies, reducing CSRF risk.

The Secure flag ensures cookies are only sent over HTTPS.

HttpOnly prevents JavaScript from reading a cookie, reducing XSS impact.

HTTPS encrypts the transport layer using TLS, while HTTP does not.

It ensures clients consistently use encryption and reduces accidental insecure access.

HTTP/1.1 is the widely used HTTP version with features like persistent connections and pipelining.

HTTP/2 improves performance with multiplexing, binary framing, header compression, and server push.

HTTP/3 uses QUIC instead of TCP and offers better multiplexing and lower latency.

It avoids head-of-line blocking and reduces header overhead by multiplexing many streams over one connection.

Multiplexing allows many requests and responses to share one TCP connection.

Header compression reduces the size of repeated HTTP headers to save bandwidth and latency.

A keep-alive connection reuses the same TCP connection for multiple HTTP requests.

Connection reuse reduces the overhead of opening new TCP connections for every request.

Pipelining allows multiple HTTP requests to be sent without waiting for each response, though it is limited in HTTP/1.1.

Head-of-line blocking occurs when one slow response blocks others in the same connection.

Connection coalescing combines multiple network flows or connections to reduce setup costs.

The TCP handshake is the three-step process used before data exchange begins: SYN, SYN-ACK, ACK.

HTTP runs on top of TCP, which provides reliable ordered delivery of bytes.

It adds TLS negotiation, certificate validation, and crypto overhead.

It is the process of validating the server cert through intermediate and root certificates.

OCSP (Online Certificate Status Protocol) checks whether a certificate has been revoked.

OCSP stapling allows the server to provide certificate revocation status during the TLS handshake.

Certificate pinning binds a client to a specific certificate or public key to reduce MITM risk.

Certificate rotation is the process of issuing and deploying a new certificate before the old one expires.

A wildcard certificate covers multiple subdomains under a single domain, such as *.example.com.

A SAN certificate includes multiple subject alternative names, allowing many domains in one cert.

A redirect loop happens when a series of redirects repeatedly sends the client back and forth.

A canonical URL is the preferred URL for a resource to avoid duplicates and SEO issues.

Cache validation checks whether a cached response is still fresh or stale.

It allows a stale resource to be served while an updated copy is revalidated in the background.

It allows stale content to be returned when the backend fails.

The Vary header tells caches that the response varies by request headers such as Accept-Encoding or User-Agent.

A conditional request asks the server to respond only if the resource has changed, saving bandwidth.

206 Partial Content is used when a client requests only part of a resource, such as a range.

The Range header asks the server to return a byte range of the resource.

Accept-Language tells the server which human language the client prefers.

Content encoding describes how the representation body is encoded, such as gzip.

Transfer-Encoding defines how the message body is framed, such as chunked encoding.

Chunked encoding splits the body into chunks so the server can stream it without knowing the full size ahead of time.

A payload is the data being carried in the request or response body.

A queue holds incoming HTTP requests or outgoing responses waiting for processing or delivery.

A load balancer distributes HTTP requests across multiple application instances.

Compression reduces payload size, improving latency and bandwidth consumption.

Server push sends resources proactively to the client before it asks for them.

It can waste bandwidth if the client never uses the pushed assets.

A character set defines how text bytes are mapped to characters, such as UTF-8.

Content-Language tells the client which language the content is written in.

A web API contract defines the expected endpoints, data formats, methods, and status codes.

An idempotent request produces the same result when repeated, such as GET or DELETE in many patterns.

A safe method is one that does not modify server state, such as GET and HEAD.

A non-idempotent method may have side effects, such as POST or PATCH.

Rate limiting restricts how often a client can call an API or endpoint.

It prevents abuse, service degradation, and resource exhaustion.

Retry-After tells clients how long to wait before retrying a request after a server-side condition.

Concurrency refers to multiple requests being processed at the same time by the client or server.

Long polling keeps a request open until new data becomes available, then returns it.

WebSocket is a protocol that provides continuous bidirectional communication with a persistent TCP socket.

HTTP is request/response-based; WebSocket is full-duplex and stateful.

HTTP upgrade allows a client to switch protocols, such as from HTTP to WebSocket.

A proxy protocol adds metadata about the original client connection to requests forwarded through a proxy.

A connection limit defines how many simultaneous connections a server or load balancer will handle.

Certificate transparency logs public certificates so browsers and clients can detect malicious or unintended issuance.

An OCSP responder answers certificate revocation checks for certificate validation.

H2C is HTTP/2 without TLS, used in trusted internal environments.

HTTP/3 uses QUIC to reduce connection setup latency and improve recovery under packet loss.

TLS is the encryption mechanism; HTTPS is HTTP transported using TLS.

Session resumption reuses a previous TLS handshake state to reduce handshake overhead.

A proof of domain ownership is a mechanism used during certificate issuance to confirm the requester controls the domain.

ALPN (Application-Layer Protocol Negotiation) allows a TLS client and server to negotiate protocol versions such as HTTP/1.1, HTTP/2, or HTTP/3.

CDN edge logic decides how to route, cache, or rewrite requests close to users.

An origin server is the original source server for the content, behind caches and proxies.

An API gateway is a layer that handles routing, authentication, rate limiting, and transformation of API traffic.

Microservices communicate over HTTP or HTTPS for modularity, interoperability, and standardization.

A health check endpoint confirms whether a service is running and ready to receive requests.

A readiness endpoint tells a load balancer or orchestrator whether the service is ready to receive traffic.

A liveness endpoint tells whether an application is alive and not stuck or deadlocked.

A service mesh often uses HTTP proxying and sidecars to manage traffic, security, and observability between services.

Because most distributed systems rely on HTTP, and tracing, metrics, and logs need good HTTP context.

Request tracing correlates a single HTTP request across multiple services and components.

A correlation ID links multiple log entries and spans to the same HTTP request.

Latency measures delay; throughput measures how much data is processed per unit of time.

A performance bottleneck is the component or resource that limits throughput or increases latency.

Because clients rely on status codes and headers to react correctly to failures and retries.

Idempotency ensures that repeating a request doesn’t create duplicate side effects beyond the first call.

Retries help handle transient network issues or service overloads safely.

Backoff is a strategy of delaying retries to reduce pressure on failing services.

Timeouts prevent clients and servers from hanging indefinitely and causing cascading failures.

Cache invalidation removes or refreshes stale entries after content changes.

A stale resource is a cached item that is older than the latest server version.

Last-mile performance refers to the final hop between the network and the user or client system.

HTTP defines how web requests and responses work; HTTPS adds encryption and trust so the web can be used securely and reliably at scale.

HTTP semantics defines the meaning of methods, status codes, headers, and resource representation, independent of transport.

Serialization is the conversion of structured data into bytes for transmission, such as JSON or XML.

Deserialization is the reverse process of reading structured data from a byte stream.

It is lightweight, easy to read, and widely supported across languages and tools.

Schema validation ensures that request or response payloads match the expected structure and constraints.

Contract testing verifies that two systems agree on the HTTP API contract before integration.

Common strategies include URL versioning, header-based versioning, and content negotiation.

Because clients and servers evolve independently and must remain compatible.

A resource-oriented API exposes domain resources and manipulates them through standard HTTP semantics.

An event-driven API pushes updates or notifications, often with SSE or WebSockets instead of polling.

SSE (Server-Sent Events) sends HTTP updates from the server to the client over a single long-lived connection.

Long polling keeps an HTTP request open until new data arrives, then closes and reopens.

A streaming response sends data progressively as it becomes available.

Streaming helps handle large data sets, real-time updates, and low-latency APIs.

Connection pool saturation occurs when too many clients compete for limited server connections.

Performance profiling analyzes timing, throughput, connection reuse, and bottlenecks across the request lifecycle.

It reduces handshake overhead on repeated connections and improves latency.

Forward secrecy means that past session keys remain safe even if long-term keys are later compromised.

It limits the impact of future key compromise on prior encrypted communications.

ECDHE is an ephemeral key exchange method commonly used in modern TLS to provide forward secrecy.

mTLS (mutual TLS) verifies both the client and the server certificates during the handshake.

It offers stronger identity assurance for service-to-service communication.

It reduces downgrade and MITM risk but increases operational complexity and can cause outages when keys rotate incorrectly.

It includes HTTPS only, HSTS, secure cookies, strong TLS, headers like Content-Security-Policy, and trusted certificate chains.

CSP (Content Security Policy) restricts script execution and resource loading to reduce XSS risk.

X-Frame-Options prevents clickjacking by denying or restricting framing of a page.

Referrer-Policy controls how much referrer information is sent across origins.

Expect-CT tells browsers to expect certificate transparency and enforce it for the site.

It logs CSP violations without enforcing them, useful for testing changes in production.

Client fingerprinting uses attributes like User-Agent, TLS configuration, and headers to identify the client.

TLS fingerprinting identifies client implementations or versions based on handshake characteristics.

QUIC is a transport protocol designed to reduce latency and improve reliability over the internet.

Because QUIC handles packet loss more gracefully than TCP-based transports.

0-RTT allows some requests to start without waiting for a full handshake when a prior connection exists.

Because deployment, middlebox compatibility, and maturity vary across infrastructure and clients.

A middlebox is a network component like a firewall, proxy, or traffic shaper that can alter or block traffic.

They can affect protocol negotiation, performance, security, and compatibility.

Protocol downgrading occurs when a client or server falls back to an older, less secure protocol version.

It forces browsers to use HTTPS, preventing insecure fallback to HTTP on new visits.

Preloading is where a browser ships a list of HSTS domains to enforce HTTPS before the first request is even made.

Request smuggling tricks a server or proxy into interpreting a request differently than the backend does.

HTTP desync occurs when request or response framing is interpreted inconsistently by components in the chain.

Header injection is when untrusted input is used to craft malicious HTTP headers.

Response splitting sends malicious headers or line breaks to cause multiple responses or cache poisoning.

A proxy confusion attack causes a proxy or gateway to send a request to the wrong upstream target.

HTTP security testing validates TLS configuration, headers, cookies, auth, and version support.

Because stolen or misused cookies can grant access to a user session.

Token theft occurs when an API token is leaked, intercepted, or stolen from a client or log.

It is when a bearer token is exposed in logs, URLs, or insecure storage and can be reused by an attacker.

JWT (JSON Web Token) is a compact token format used to represent claims and identity information.

Claims are key/value pieces of token data, such as sub, exp, scope, or role.

It is portable, compact, and widely supported across services and clients.

Expiration limits how long a token remains valid before it must be refreshed or reissued.

Refresh token rotation replaces a refresh token after use to reduce theft risk.

OAuth2 is an authorization framework used to delegate access without exposing user credentials.

OpenID Connect is a layer built on OAuth2 for user authentication and identity claims.

Authentication answers “who are you?” Authorization answers “what are you allowed to do?”

A signed request includes cryptographic proof of authenticity so the server can verify the sender.

API gateways often validate tokens, enforce policy, and route requests based on identity or roles.

A trust boundary is a transition where identity or security assumptions change, such as from public internet to internal service.

It defines how internal services authenticate and authorize each other over HTTP and HTTPS.

It includes certificate issuance, rotation, deployment, and revocation for service identities.

HTTP observability includes logs, metrics, traces, and structured request metadata for diagnosis and monitoring.

APM (Application Performance Monitoring) tracks HTTP latency, errors, throughput, and dependency health.

It correlates a user request across multiple services and systems using HTTP metadata and trace propagation headers.

Tracing headers such as traceparent and baggage propagate context across service boundaries.

A correlation ID links related requests and logs across service calls and infrastructure layers.

Because the request path is distributed and may span multiple services, networks, and data stores.

Headers like Authorization, Cookie, and X-Forwarded-For can leak sensitive data if mishandled or logged insecurely.

Request normalization standardizes or transforms incoming HTTP requests before they are processed.

A proxy header attack occurs when untrusted clients set headers such as X-Forwarded-For or Host in a way that bypasses security or routing logic.

Because clients can manipulate them if the server trusts them without validation.

Absolute URL parsing is the conversion of a full URL into host, path, scheme, and port information.

Domain fronting is a technique that hides the intended backend host behind a trusted CDN host and is often restricted for security reasons.

HTTP/2 prioritization allows the client to signal which streams are important, improving resource loading.

A stream dependency defines which HTTP/2 stream a stream depends on for priority.

Flow control limits how much data one endpoint can send before receiving feedback.

QUIC allows a connection to continue across network changes, such as IP or port changes.

Balancing performance, security, compatibility, and ease of operation across browsers, proxies, and distributed services.

To provide a reliable, standardized, secure, and efficient way for systems and users to exchange data across networks and the web.