Skip to content
Knowledge Hub/Article
Article

What Is HTTP? HTTPS Difference, Methods, Status Codes and HTTP/3

HTTP is the request-response protocol between a browser and a web server. How it works, the methods, the status codes, how HTTPS differs and what HTTP/3 adds.

Oğuzhan Gerçek··7 min read
What Is HTTP? HTTPS Difference, Methods, Status Codes and HTTP/3

Short answer: HTTP (Hypertext Transfer Protocol) is the request-response protocol that governs how a client such as a browser or an app asks a web server for a resource and how the server answers; it is the language the web runs on. The client sends a request such as "GET /page", the server replies with a status code such as "200 OK", headers and content. HTTP is stateless, every request is evaluated on its own; sessions are built with cookies. HTTPS is the same protocol encrypted with TLS. Three versions are in use side by side today: text-based HTTP/1.1, binary and multiplexed HTTP/2, and HTTP/3, which runs on QUIC over UDP.

What is HTTP?

RFC 9110 (June 2022), which defines the semantics of HTTP, describes it as a stateless application-level protocol for distributed, collaborative, hypertext information systems. Its history is the history of the web: as MDN tells it, Tim Berners-Lee proposed a hypertext system over the internet at CERN in 1989, the four building blocks including HTTP were complete by the end of 1990, and the announcement of 6 August 1991 is now considered the official start of the web as a public project. The first version (later named HTTP/0.9) was a single-line GET request; there were no headers, no status codes and no content other than HTML.

HTTP works at layer 7 of the OSI model, the application layer; beneath it sits TCP for transport, or QUIC in HTTP/3. The layers are in the OSI article.

How HTTP works

  1. The browser resolves the address: the domain name is turned into an IP address through DNS.
  2. A connection is made to the server: TCP for HTTP/1.1 and HTTP/2, QUIC over UDP for HTTP/3. According to RFC 9110, the default port is 80 for HTTP and 443 for HTTPS.
  3. With HTTPS, the connection is encrypted with TLS; certificate verification happens here (our SSL and TLS article).
  4. The client sends the request: method and target (GET /products HTTP/1.1), headers (Host, User-Agent, Accept, cookies) and, where needed, a body (form data, JSON).
  5. The web server returns the response: a status line (HTTP/1.1 200 OK), headers (Content-Type, Cache-Control, Set-Cookie) and a body (HTML, JSON, an image).
  6. The browser repeats this cycle for every resource on the page (scripts, styles, images); in HTTP/1.1 persistent connections let the same connection be reused, in HTTP/2 requests travel in parallel over a single connection.

HTTP is stateless: the server does not connect two requests to each other on its own. Sessions, shopping carts and login state are built with cookies (the Cookie and Set-Cookie headers) or with tokens carried in a request header.

HTTP methods

The standard methods defined by RFC 9110 are GET, HEAD, POST, PUT, DELETE, CONNECT, OPTIONS and TRACE; PATCH is defined in RFC 5789. The ones in everyday use:

  • GET: Requests a resource; it is not expected to change anything on the server. Opening a page, reading data.
  • HEAD: The same as GET, but only the headers come back; for checking whether a file exists or when it last changed.
  • POST: Sends data to the server for processing: submitting a form, creating a record.
  • PUT: Replaces the resource entirely with what is sent; PATCH updates only part of it.
  • DELETE: Removes the resource.
  • OPTIONS: Asks which methods the server allows for that resource; browsers use it in CORS preflight checks.

RFC 9110 defines two properties: safe methods are read-only, they are not expected to change state on the server (GET, HEAD, OPTIONS, TRACE); idempotent methods have the same effect when repeated several times as when sent once (PUT, DELETE and the safe methods). POST is neither, which is why a browser asks before resending a POST. How web APIs use these methods is in the API article.

HTTP status codes

The server's three-digit answer. RFC 9110 defines five classes:

  • 1xx informational: The request was received, processing continues (101 Switching Protocols).
  • 2xx success: 200 OK, 201 Created (a record was created), 204 No Content (success, no body).
  • 3xx redirection: 301 Moved Permanently (the address changed for good; the code used for old URLs in SEO), 302 Found (temporary), 304 Not Modified (the cached copy is still valid).
  • 4xx client error: 400 Bad Request, 401 Unauthorized (authentication required), 403 Forbidden (no permission), 404 Not Found, 429 Too Many Requests (rate limit exceeded).
  • 5xx server error: 500 Internal Server Error, 502 Bad Gateway (a proxy or load balancer in between received an invalid response from the server behind it), 503 Service Unavailable (the server is temporarily unable to serve), 504 Gateway Timeout.

On the monitoring side, the 5xx rate shows the health of the application, the 4xx rate shows client and permission problems, and 3xx chains reveal needless redirects; the APM article explains why the error rate is one of the golden signals.

The difference between HTTP and HTTPS

HTTPS is HTTP traffic encrypted with TLS; the protocol is the same, the transport is encrypted. According to RFC 9110, for an https address the client establishes a TLS connection with the server, the server is authenticated as acting for that domain, and the communication gains confidentiality and integrity protection. According to MDN, this layer arrived at the end of 1994 with Netscape's SSL and made e-commerce sites possible; SSL was later standardized and became TLS. Over plain HTTP, addresses, cookies and form data can be read and modified in transit, which is why browsers mark plain HTTP pages as "not secure". Certificates, versions and renewal are in the SSL article.

Versions: HTTP/1.1, HTTP/2 and HTTP/3

Following MDN's timeline:

  • HTTP/1.0 (RFC 1945, November 1996): Version information, status codes, headers and Content-Type were added.
  • HTTP/1.1 (1997): The first standardized version. Persistent connections (the same connection is reused), the Host header (several domains hosted on one IP address), chunked responses and cache control. Revised in 1999 (RFC 2616) and 2014 (RFC 7230-7235); because requests on one connection went in sequence, browsers opened up to six connections per site.
  • HTTP/2 (May 2015): Based on Google's experimental SPDY protocol. A binary rather than text protocol, parallel requests over the same connection (multiplexing) and header compression. According to W3Techs data, its use peaked in January 2022 at 46.9 percent of all websites.
  • HTTP/3 (RFC 9114): The same semantics, a different transport: QUIC, which runs over UDP instead of TCP. Because QUIC handles packet loss detection and retransmission independently for each stream, a loss in one stream does not hold up the others. According to W3Techs, 26 percent of websites were using HTTP/3 by October 2022.
  • 2022: HTTP was revised end to end and published as RFC 9110 (semantics), 9111 (caching), 9112 (HTTP/1.1), 9113 (HTTP/2) and 9114 (HTTP/3), gaining Internet Standard status (STD 97).

On the enterprise side

In front of an internet-facing application stand three HTTP layers: a CDN that distributes content, a load balancer that spreads requests across servers, and a WAF that filters HTTP traffic. Designing and running those layers is the subject of our application security (WAF) and application runtime and middleware operations services.

Frequently asked questions

What does HTTP stand for? Hypertext Transfer Protocol: the set of rules by which a browser requests pages and data from a web server and the server answers.

What is the difference between HTTP and HTTPS? HTTPS is the same HTTP traffic encrypted with TLS; the server's identity is verified with a certificate, and the data cannot be read or altered in transit. Plain HTTP has none of that.

What does 404 mean? The requested resource was not found on the server: the address is wrong or the page has been removed. For pages that have moved permanently, the right answer is a 301 redirect.

What does an HTTP 500 error mean? An unexpected error on the server side: the application crashed, the configuration is broken or the database behind it is not answering. 502 and 504 instead mean that a proxy or load balancer in between could not reach the server behind it.

What is the difference between HTTP/2 and HTTP/3? Both carry the same request-response semantics. HTTP/2 runs binary and multiplexed over TCP; HTTP/3 uses QUIC over UDP instead of TCP, so packet loss in one stream does not hold up the others.

What does it mean that HTTP is stateless? That the server evaluates every request independently of the previous ones. To recognize a logged-in user, session information is resent with every request in a cookie or a token.

Sources