INHow the Internet Works · Lesson 5 of 7

HTTP & HTTPS

Above all the plumbing sits a plain-text conversation: 'GET /page' — '200 OK, here you go'. HTTP is simple enough to speak by hand, and TLS wraps the whole exchange in encryption.

Bash

curl -v https://example.com/ 2>&1 | grep -E '^[<>]'
# > GET / HTTP/2            <- the request line
# > host: example.com       <- headers: metadata
# > user-agent: curl/8.4
# >
# < HTTP/2 200              <- status
# < content-type: text/html
# < cache-control: max-age=3600
# <
# (then the HTML body)

# Methods — the verb of the request:
#   GET     read (no body, cacheable)
#   POST    create / submit
#   PUT     replace          PATCH   modify
#   DELETE  remove

# Status codes:
#   2xx yes | 3xx go elsewhere | 4xx your fault | 5xx my fault
#   200 OK, 301 moved, 304 not modified, 401 unauthenticated,
#   403 forbidden, 404 not found, 429 slow down, 500 crashed

HTTP is stateless: each request stands alone, and the server remembers nothing between them. Cookies bolt memory on — the server says Set-Cookie once, the browser attaches it to every later request, and that's how logins persist. Headers carry everything else: content types, cache rules, compression, auth tokens.

Text

HTTPS = HTTP inside a TLS tunnel. The handshake:

 1. Client: "I speak these ciphers, here's a random value"
 2. Server: "chosen cipher + my CERTIFICATE"
 3. Client checks the certificate:
      - signed by a trusted Certificate Authority?
      - actually for THIS domain? not expired?
 4. Key exchange -> both sides derive a shared secret
    (never transmitted — math does it: ECDHE)
 5. Everything after is encrypted with that secret

The padlock means: nobody between you and the server
can read or alter the traffic, and the server proved
its identity. It does NOT mean the site is honest.

✦ Tip
Certificates are free (Let's Encrypt) and automated now — there is no excuse for plain HTTP. For developers: 'mixed content' errors mean an HTTPS page loading an http:// asset, and CORS errors aren't network failures — they're the browser enforcing cross-origin rules the server must opt out of via headers.