Understanding HTTP & HTTPS
Every time you visit a website, your browser and a web server exchange messages. Discover how that communication works and what HTTPS does to protect it.
What is HTTP?
HTTP stands for Hypertext Transfer Protocol. It defines how web clients and servers exchange requests and responses.
Sends an HTTP request
Processes the request
Returns content and a status code
HTTP commonly uses TCP port 80, although other ports and transport arrangements are possible.
What does your browser actually send?
When you open a website, your browser requests a resource. A simple HTTP request might look like this:
Host: cybercumbria.co.uk
Accept: text/html
GET is an HTTP method used to retrieve a resource. The Host header identifies the requested hostname.
Retrieve a resource.
Submit data for processing.
Create or replace a resource.
Request removal of a resource.
Understanding HTTP status codes.
Servers return status codes indicating the outcome of a request.
HTTP versus HTTPS.
HTTP
Ordinary HTTP does not encrypt its messages. Anyone able to intercept the traffic may be able to read or modify it.
Common port: TCP 80.
HTTPS
HTTPS protects HTTP communication using TLS, providing encryption, integrity and server authentication.
Common port: TCP 443.
Modern HTTP/3 uses QUIC over UDP rather than the traditional TCP transport.
What happens during a TLS connection?
Before exchanging protected HTTP messages, the browser and server establish a secure connection.
This is a simplified explanation of a typical modern TLS connection. The precise handshake depends on the negotiated protocol.
What does the browser padlock guarantee?
A valid HTTPS connection indicates that your connection to the authenticated website is encrypted and protected against undetected tampering.
Always check the actual domain name. Encryption protects the connection, not your judgment about the website you're visiting.
Extra protection for websites.
Web servers can send security-related HTTP headers that instruct browsers to apply additional protections.
These protections complement HTTPS but don't replace secure application development.
What can web server logs reveal?
HTTP access logs help analysts identify suspicious requests, scanning activity and unexpected responses.
"GET /.env HTTP/1.1" 403 153
This example shows a request for a potentially sensitive environment file. The server returned 403, indicating that the request was forbidden.
Inspect HTTP response headers.
From a terminal with curl installed:
curl -I https://cybercumbria.co.uk
The -I option requests response headers. Look for the HTTP status code, content type and security headers.
curl -IL http://cybercumbria.co.uk
The -L option follows redirects. This lets you examine the redirect from HTTP to HTTPS, if one is configured.
HTTPS protects the connection.
TLS protects that communication.
HTTPS combines them.
A secure connection is essential, but it doesn't automatically make a website or its content safe.
Understanding network packets.
Next we'll explore how data is divided into packets and travels across networks.