How HTTP works: requests, methods, status codes and HTTPS

Basics

Introduction to HTTP

Gain a deep understanding of how the web communicates with our detailed HTTP guide. Explore the fundamentals of requests, responses, and the inner workings of web protocols.

HTTP (HyperText Transfer Protocol) is the foundation of data communication on the web. It defines how messages are formatted and transmitted between clients (like browsers) and servers.

Real-world Analogy

Think of HTTP like ordering food at a restaurant:

You (client) make a request (order) to the waiter
The waiter (HTTP protocol) delivers your request to the kitchen (server)
The kitchen prepares your food (processes the request)
The waiter brings back your meal (server response)

Client

Sends requests (e.g., browser, mobile app)

Example: Your web browser requesting a Facebook page

Mobile Example:

When you open Twitter on your phone, the app sends HTTP requests to load your feed

Server

Responds with requested resources (HTML, JSON, images, etc.)

Example: YouTube's servers sending video data

Cloud Example:

When you watch Netflix, their cloud servers stream content via HTTP responses

A real exchange

// Real-world HTTP Exchange (Loading Amazon product page)
GET /products/B08N5KWB9H HTTP/1.1
Host: www.amazon.com
Accept: text/html

// Server responds with:
HTTP/1.1 200 OK
Content-Type: text/html
<!DOCTYPE html>
<html>
  <head><title>Amazon Echo Dot</title></head>
  <body>...</body>
</html>

This is what happens behind the scenes when you view a product on Amazon

HTTP Parameters

HTTP parameters are used to send data from the client to the server. They are typically key-value pairs and vary by how they are transmitted in the HTTP request.

Query Parameters

Appended to the URL after a ?
Multiple parameters separated by &
Commonly used in GET requests
Data is visible in the URL

GET /search?query=shoes&page=2

Real-world use: E-commerce sites filtering products

Body Parameters

Sent in the body of the request (not in URL)
Used mostly with POST, PUT, PATCH
More secure for sensitive data
Can be JSON, Form data, or XML

POST /register HTTP/1.1
Content-Type: application/json

{
  "name": "John Doe",
  "email": "[email protected]",
  "password": "secret123"
}

Path Parameters

Part of the URL path, not after ?
Used to identify specific resources
Often used in RESTful APIs

GET /user/101

API Use Case: PUT /products/23

HTTP Messages

HTTP communication consists of two types of messages: requests (from client) and responses (from server). Each message contains a start line, headers, and an optional body.

HTTP Request

Request Line

GET /index.html HTTP/1.1

Method + URL + HTTP version

Headers

Host: example.com
User-Agent: Mozilla/5.0
Accept: text/html

Key-value metadata about the request

Body (Optional)

{
  "username": "john",
  "password": "secret"
}

Data sent with POST, PUT, etc.

HTTP Response

Status Line

HTTP/1.1 200 OK

Version + status code + message

Headers

Content-Type: text/html
Content-Length: 1234
Set-Cookie: sessionId=abc123

Metadata about the response

Body

<!DOCTYPE html>
<html>
<head><title>Example</title></head>
<body>...</body>
</html>

Actual data (HTML, JSON, etc.)

HTTP Methods

HTTP methods (GET, POST, PUT, PATCH, DELETE) are essential for building structured, predictable, and RESTful web services. Each method has a specific purpose in client-server communication.

The five methods at a glance
Method	What it is for
`GET`	Retrieve data
`POST`	Create data
`PUT`	Update data
`PATCH`	Partial update
`DELETE`	Remove data

GET — For Reading Data

Retrieve information without changing anything on the server. Fast and safe, cacheable by browsers.

SafeIdempotentCacheable

Real-world Example:

Loading a product page on Amazon. When you view a product, your browser sends a GET request to retrieve the product details without modifying anything.

GET

GET /api/products/123 HTTP/1.1
Host: example.com
Accept: application/json

POST — For Creating Data

Send data to the server to create a new resource. Used in user signups, contact forms, payments, etc.

Not IdempotentHas Body

Real-world Example:

Submitting a registration form on Facebook. When you create a new account, your details are sent via POST request to create your profile in their database.

POST

POST /api/users HTTP/1.1
Content-Type: application/json

{
  "name": "Alice",
  "email": "[email protected]",
  "password": "securepassword123"
}

PUT — For Full Updates

Replace an entire existing resource. Idempotent - repeating the request won't change the result.

IdempotentHas Body

Real-world Example:

Updating your entire profile on LinkedIn. When you save changes to your profile, a PUT request replaces your entire profile data with the new version.

PUT

PUT /api/users/123 HTTP/1.1
Content-Type: application/json

{
  "name": "Alice Updated",
  "email": "[email protected]",
  "title": "Senior Developer",
  "location": "New York"
}

PATCH — For Partial Updates

Update only specific fields of a resource. More efficient than PUT for small changes.

IdempotentHas Body

Real-world Example:

Changing just your profile picture on Twitter. Instead of sending your entire profile data, a PATCH request updates only the avatar field.

PATCH

PATCH /api/users/123 HTTP/1.1
Content-Type: application/json

{
  "avatar": "https://example.com/new-avatar.jpg"
}

DELETE — For Removing Data

Delete a resource permanently. Idempotent - once deleted, repeating has no further effect.

Idempotent

Real-world Example:

Deleting a post on Instagram. When you remove a post, a DELETE request is sent to permanently remove it from the server.

DELETE

DELETE /api/posts/456 HTTP/1.1
Host: example.com
Authorization: Bearer token123

Benefits of Using Correct HTTP Methods

Makes your API RESTful and intuitive
Improves code clarity and maintainability
Helps with security, debugging, and tooling compatibility
Enables standardized client-server communication

HTTP Status Codes

HTTP Status Codes are 3-digit numbers sent by a web server in response to a client request. They indicate whether the request was successful, redirected, or failed due to an error.

Code	Name	What it means
`200`	OK	Request was successful
`301`	Moved	Resource has a new URL
`400`	Bad Request	Malformed request
`401`	Unauthorized	Authentication required
`403`	Forbidden	Access denied
`404`	Not Found	Resource not found
`500`	Server Error	General server error

Why Are Status Codes Important?

Indicate success or failure of a request
Diagnose issues in development and debugging
Handle authentication and permission errors
Manage redirects and caching

HTTP vs HTTPS

HTTP

HTTP (HyperText Transfer Protocol) is the foundation of data communication on the web. It enables web browsers to request resources from web servers using a request–response model.

Not secure - data is sent in plain text
Uses port 80 by default
Vulnerable to eavesdropping and MITM attacks

HTTPS

HTTPS (HyperText Transfer Protocol Secure) is the secure version of HTTP. It uses SSL/TLS encryption to protect data exchanged between your browser and the web server.

Secure - data is encrypted
Uses port 443 by default
Authenticates websites (prevents phishing)

Always use HTTPS for secure, private communication.

HTTP Components

HTTP Components are the key parts that make up an HTTP request and response. These components define how information is transferred between a client and a server.

URL

Uniform Resource Locator (e.g., https://example.com/products)

Headers

Metadata like content-type, auth token

Body

Optional data sent with POST, PUT, etc.

Cookies

Data stored by the browser for session handling

HTTP Versions

HTTP versions represent the evolution of the HyperText Transfer Protocol to improve speed, performance, and security in web communication.

The Standard Version

Introduced in 1997, HTTP/1.1 is the most widely used version. It‘s text-based and supports persistent connections and pipelining, but has head-of-line blocking issues.

Text-basedPersistent connectionsWidely supported

The Performance Version

Released in 2015, HTTP/2 is a binary protocol that introduces multiplexing, header compression, and server push to significantly improve performance.

Binary protocolMultiplexingHeader compressionServer push

The Future Version

Emerging standard (2022) that uses QUIC (over UDP) instead of TCP. Reduces latency, improves performance on unreliable networks, and provides better security.

Uses QUICReduced latencyBetter mobile performanceBuilt-in encryption

HTTP Header Fields

HTTP headers are key-value pairs sent in both requests and responses. They convey metadata about the HTTP message (such as content type, length, caching policies, authentication, etc.).

1. Request Headers

Sent by the client (browser or app) to provide information about the request or client environment.

Header	Description	Example
`Host`	Specifies the domain name of the server	`Host: example.com`
`User-Agent`	Describes the client software making the request	`User-Agent: Mozilla/5.0`
`Accept`	Tells the server what content types are acceptable	`Accept: text/html, application/json`
`Authorization`	Contains credentials for authenticating the user	`Authorization: Bearer <token>`
`Content-Type`	Describes the format of the request body	`Content-Type: application/json`

2. Response Headers

Sent by the server to give context or instructions about the response.

Header	Description	Example
`Content-Type`	Specifies the type of content returned	`Content-Type: text/html`
`Set-Cookie`	Sends a cookie to the client	`Set-Cookie: userId=101; Path=/; HttpOnly`
`Content-Length`	Size of the response body in bytes	`Content-Length: 3421`
`Cache-Control`	Caching behavior (no-store, max-age, etc.)	`Cache-Control: no-cache`
`Location`	Used in redirects to indicate a new URL	`Location: /login`

3. Entity Headers (Used in both requests & responses)

Provide meta-information about the body (content) of a request or response.

Header	Description	Example
`Content-Encoding`	Compression method (e.g., gzip)	`Content-Encoding: gzip`
`Content-Language`	Language of the content	`Content-Language: en-US`
`Last-Modified`	Last modification date of the resource	`Last-Modified: Wed, 12 Jun 2024 10:00:00 GMT`
`Expires`	Date/time after which response is considered stale	`Expires: Tue, 20 Jul 2024 08:00:00 GMT`

Registration Example

Registration is a common feature in web applications where a user creates a new account by providing personal details like name, email, and password.

1. Client Sends Registration Request

The user fills out a registration form and the frontend sends an HTTP POST request to the backend.

Request

POST /register HTTP/1.1
Host: example.com
Content-Type: application/json

{
  "name": "John Doe",
  "email": "[email protected]",
  "password": "secret123"
}

Explanation:

POST: Method used to create a new user
register: The endpoint for handling registration
Content-Type: application/json: Data is in JSON format
Body contains the actual registration data

2. Server Validates and Responds

The backend checks if the email is available, password is strong, and all required fields are provided.

Success Response:

HTTP/1.1 201 Created
Content-Type: application/json

{
  "message": "Registration successful",
  "user_id": 101
}

201 Created: Standard status code for successful resource creation.

Error Response:

HTTP/1.1 400 Bad Request
Content-Type: application/json

{
  "error": "Email already exists"
}

400 Bad Request: Something is wrong with the input.

3. Response to Client

The client shows a success message or an error message based on the server's response.

Success UI

Registration successful!

Welcome, John Doe. Your account has been created.

Error UI

Registration failed

Email already exists. Please try another email.

Understanding HTTP in Modern Web Communication

The HyperText Transfer Protocol (HTTP) is the backbone of the modern web. It governs how data is requested and transferred between clients (like browsers or apps) and servers.

Through this guide, you‘ve learned the fundamentals of HTTP that power every web interaction, from simple page loads to complex API calls.

Key Takeaways

How HTTP requests and responses work
The role of parameters, methods, and messages
The purpose and format of HTTP headers
The difference between HTTP and HTTPS

Best Practices

Use the correct HTTP method for each operation
Always use HTTPS for secure communication
Handle status codes properly for better UX
Use headers effectively for metadata

How HTTP works: requests, methods, status codes and HTTPS

Introduction to HTTP

Client

Server

HTTP Parameters

Query Parameters

Body Parameters

Path Parameters

HTTP Messages

HTTP Request

Request Line

Headers

Body (Optional)

HTTP Response

Status Line

Headers

Body

HTTP Methods

GET — For Reading Data

POST — For Creating Data

PUT — For Full Updates

PATCH — For Partial Updates

DELETE — For Removing Data

Benefits of Using Correct HTTP Methods

HTTP Status Codes

Why Are Status Codes Important?

HTTP vs HTTPS

HTTP

HTTPS

HTTP Components

URL

Headers

Body

Cookies

HTTP Versions

The Standard Version

The Performance Version

The Future Version

HTTP Header Fields

1. Request Headers

2. Response Headers

3. Entity Headers (Used in both requests & responses)

Registration Example

1. Client Sends Registration Request

2. Server Validates and Responds

Success Response:

Error Response:

3. Response to Client

Understanding HTTP in Modern Web Communication

API development and integration

Learn it here. Build it with us when you are ready.