HTTP
the HyperText Transfer ProtocolHTTP is the request-and-response language of the web. A client asks for a resource with a method and a path, the server answers with a status code, headers and a body, and each exchange stands on its own — simple, text-based, and everywhere.
HTTP is a request and a response — the client asks, the server answers, one exchange at a time.
Open the HTTP lab →
One request, one response—in plain text. Then watch a single page turn out to need four of them, and a revisit that sends no page at all.
How it works
A method and path go up, a status code and body come back. The server keeps no memory of the request once it’s answered.
What HTTP does, step by step
The browser resolves the name via DNS and opens a TCP connection — wrapped in TLS for HTTPS.
A method (GET, POST…), a path and headers — optionally a body for data being submitted.
A status code (200, 404, 500…), headers describing the content, and the body itself.
The connection is kept alive for more requests, or closed. State is carried by cookies and tokens, not HTTP itself.
In cybersecurity
Plain HTTP is readable and forgeable in transit, and its flexibility makes the app above it the web’s biggest attack surface.
Plain HTTP is sniffable and modifiable en route — TLS makes it HTTPS.
Unsanitised parameters and bodies feed SQL injection and cross-site scripting.
Stealing a cookie steals the session — mark cookies Secure and HttpOnly.
HSTS, CSP and CORS headers harden a site against whole classes of attack.
Disagreements over request boundaries let attackers sneak requests past proxies.
Because requests carry cookies automatically, forged cross-site requests need tokens to stop.