The Letter Exchange Analogy
Sending a letter:
- Envelope: Address (URL), postage (headers)
- Letter inside: Your message (body)
- Reply: Confirmation or response
HTTP is a standardized way to send letters (requests) and receive replies (responses) on the web.
What Is HTTP?
HTTP = HyperText Transfer Protocol
The language of the web.
Client asks, server answers.
Every web page, API call, image load...
All use HTTP.
Request and Response
Request (Client → Server)
GET /products/123
Host: api.example.com
Accept: application/json
Authorization: <credentials>
Response (Server → Client)
200 OK
Content-Type: application/json
Content-Length: 50
{"id": 123, "name": "Widget", "price": 10}
Request Components
Method (What to Do)
| Method | Purpose | Idempotent | Read-only |
|---|---|---|---|
| GET | Retrieve data | Yes | Yes |
| POST | Create data | No | No |
| PUT | Replace data | Yes | No |
| PATCH | Update data | No | No |
| DELETE | Remove data | Yes | No |
| HEAD | Headers (no body) | Yes | Yes |
| OPTIONS | Capabilities | Yes | Yes |
URL (Where)
https://api.example.com/users/123?include=posts
Protocol: https
Host: api.example.com
Path: /users/123
Query: ?include=posts
Headers (Metadata)
Host: Which server
Accept: What format I want
Content-Type: What format I'm sending
Authorization: Who I am
User-Agent: What browser/client
Body (Data)
For POST, PUT, PATCH requests.
Contains the data you're sending.
{
"name": "New Product",
"price": 30
}
Response Components
Status Line
200 OK
Status Code: 200
Reason: OK
Status Codes
| Range | Category | Examples |
|---|---|---|
| 1xx | Informational | 100 Continue |
| 2xx | Success | 200 OK, 201 Created |
| 3xx | Redirect | 301 Moved, 304 Not Modified |
| 4xx | Client Error | 400 Bad Request, 404 Not Found |
| 5xx | Server Error | 500 Internal Error, 503 Unavailable |
Common Status Codes
200 OK - Request succeeded
201 Created - Resource created
204 No Content - Success, no body
301 Moved - Permanent redirect
304 Not Modified - Use cache
400 Bad Request - Invalid request
401 Unauthorized - Need authentication
403 Forbidden - Not allowed
404 Not Found - Doesn't exist
500 Server Error - Something broke
503 Unavailable - Server overloaded
HTTP Versions
Early HTTP (Simple Connections)
One request per connection.
Connection closed after response.
Slow for multiple resources.
Persistent Connections (Less Reconnecting)
Keep-alive connections.
Multiple requests per connection.
Very common on the web.
HTTP/2
Binary protocol (faster).
Multiplexing (multiple requests simultaneously).
Header compression.
Server push.
HTTP/3
Uses QUIC (UDP-based).
Faster connections.
Better for unreliable networks.
Newer option (support varies).
Stateless Protocol
HTTP doesn't automatically remember you.
Request 1: "Who am I?" - I don't know yet
Request 2: "Who am I?" - I still don't know unless you tell me again
Each request is independent.
How to maintain sessions?
Cookies, tokens, sessions
Client sends ID with each request
Headers Deep Dive
Request Headers
Accept: application/json
"I want JSON response"
Content-Type: application/json
"I'm sending JSON"
Authorization: <credentials>
"Here's my auth credentials"
Cache-Control: no-cache
"Don't use cached version"
Response Headers
Content-Type: application/json
"This is JSON"
Content-Length: 1234
"Body is 1234 bytes"
Cache-Control: max-age=3600
"Cache for 1 hour"
Set-Cookie: session=abc123
"Store this cookie"
Caching
Reduce repeated requests.
Cache-Control: max-age=<seconds>
Cache for some duration
ETag: "abc123"
Version identifier
If-None-Match: "abc123"
"Do you have newer version?"
304 Not Modified
"Use your cached version"
HTTP vs HTTPS
HTTP: Data is not encrypted by default.
HTTPS: Data is encrypted with TLS.
Use HTTPS for:
- Login pages
- Payments
- Personal data
- Most production sites
Common Mistakes
1. Wrong Method
âś— GET /delete-user/123
âś“ DELETE /users/123
Method should match action.
2. Ignoring Status Codes
âś— 200 OK for every response, errors in body
âś“ Use proper status codes
404 for not found
400 for bad request
500 for server error
3. Not Setting Content-Type
Server returns JSON.
No Content-Type header.
Client doesn't know how to parse.
Set Content-Type.
FAQ
Q: HTTP vs REST?
HTTP is the protocol. REST is an architectural style that uses HTTP.
Q: Why do I see HTTP and HTTPS?
HTTP is unsecured. HTTPS is HTTP over TLS (encrypted). Use HTTPS.
Q: What is a request body vs query string?
Query string: Data in URL (?key=value) Body: Data in request body (for POST, PUT)
Q: Are cookies part of HTTP?
Yes! Set-Cookie and Cookie headers are part of HTTP.
Summary
HTTP is the protocol that powers web communication through structured requests and responses.
Key Takeaways:
- Request/response pattern
- Methods define actions (GET, POST, etc.)
- Status codes tell outcomes
- Headers carry metadata
- Stateless - each request independent
- Newer HTTP versions can improve performance
- HTTPS adds security
HTTP is a language every web developer should know.
Leave a Comment
Comments (0)
Be the first to comment on this concept.
Comments are approved automatically.