The HTTP protocol
The request-and-response language between browser and server: methods, headers and status codes.
- Track
- Basics
- Estimated time
- 20 min
- Level
- Beginner
Before this lesson
Once the browser has reached the server, the two talk in HTTP. Almost every web vulnerability is, in the end, an HTTP message shaped in a way the server did not expect — so reading HTTP is the single most useful skill in web security.
Request and response
Every exchange is one request and one response. The request is plain text you can read and write by hand:
GET /about HTTP/1.1
Host: example.com
User-Agent: ExampleBrowser/1.0The first line names the The action the request wants: GET to read, POST to send data, and others like PUT and DELETE. and the path. The lines after it are Name: value pairs that carry extra information, such as the host, the cookies, or the kind of content being sent.. A POST request adds a body after a blank line — this is where a login form sends your username and password.
Status codes
The server answers with a status code — a three-digit number that says what happened:
| Range | Meaning | Example |
|---|---|---|
| 2xx | Success | 200 OK |
| 3xx | Redirect | 302 Found |
| 4xx | Your request was wrong | 404 Not Found, 403 Forbidden |
| 5xx | The server failed | 500 Internal Server Error |
State and cookies
HTTP has no memory: each request stands alone. To know you are logged in, the server sends a cookie in its response, and the browser sends it back on every later request. That one header is what proves who you are — which is exactly why so many attacks target it.
Labs
The labs for this lesson are in preparation.