Lesson 5 of 7

HTTP & HTTPS

HTTP is a simple text conversation of requests and responses, and HTTPS wraps it in TLS encryption. You'll learn , , headers and what the padlock actually means.

Bash
curl -v https://example.com/ 2>&1 | grep -E '^[<>]'
# > GET / HTTP/2            <- the request line
# > host: example.com       <- headers: metadata
# > user-agent: curl/8.4
# >
# < HTTP/2 200              <- status
# < content-type: text/html
# < cache-control: max-age=3600
# <
# (then the HTML body)

# Methods — the verb of the request:
#   GET     read (no body, cacheable)
#   POST    create / submit
#   PUT     replace          PATCH   modify
#   DELETE  remove

# Status codes:
#   2xx success | 3xx redirect | 4xx client error | 5xx server error
#   200 OK, 301 moved, 304 not modified, 401 unauthenticated,
#   403 forbidden, 404 not found, 429 slow down, 500 crashed

HTTP is stateless: each request stands alone, and the server remembers nothing between them. Cookies bolt on — the server says -Cookie once, the browser attaches it to every later request, and that's how logins persist. Headers carry everything else: content types, rules, compression, auth tokens.

Text
HTTPS = HTTP inside a TLS tunnel. The handshake:

 1. Client: "I speak these ciphers, here's a random value"
 2. Server: "chosen cipher + my CERTIFICATE"
 3. Client checks the certificate:
      - signed by a trusted Certificate Authority?
      - actually for THIS domain? not expired?
 4. Key exchange -> both sides derive a shared secret
    (never transmitted — math does it: ECDHE)
 5. Everything after is encrypted with that secret

The padlock means: nobody between you and the server
can read or alter the traffic, and the server proved
its identity. It does NOT mean the site is honest.

Common question

Does HTTPS only matter for pages with passwords?

HTTP is a request-response protocol: a method, a path, headers and an optional body go out; a status code, headers and a body come back. It is readable text, which makes it easy to debug and also means anything along the way can read it. HTTPS wraps the same protocol in TLS, adding privacy, integrity and proof of the server's identity.

Know the pieces you will use every day: the methods and what they , the status classes (2xx success, 3xx , 4xx your mistake, 5xx theirs), the headers that control caching and content type, and the fact that TLS protects the connection and nothing beyond it.

Source: Browsers now mark plain HTTP pages as "Not secure", and features like service workers and geolocation only work over HTTPS.

Common mix-ups

Each of these sounds reasonable. Think about why it is wrong, then open the explanation.

  • A page with no login has nothing worth encrypting.

  • HTTPS makes a site secure.

  • HTTPS is slow because of the encryption.

Finished reading?Mark it done to track your progress.

Tip: use the ← and → keys to move between lessons.