HTTP vs HTTPS

HTTP (Hypertext Transfer Protocol) is the foundation of data communication on the web. HTTPS adds encryption via SSL/TLS.

HTTP

• Port: 80
• Stateless: each request is independent — the server doesn’t remember previous requests
• Methods: GET, POST, PUT, DELETE, PATCH, HEAD, OPTIONS
• Status codes: 2xx (success), 3xx (redirect), 4xx (client error), 5xx (server error)
• Headers: metadata about the request/response (Content-Type, Authorization, Cache-Control)

Statelessness

The server does not store any information about the client between requests. To maintain session state, we use:

• Cookies — server sends a token, client sends it back on every request
• JWT (JSON Web Tokens) — stateless auth tokens embedded in requests
• Sessions — server-side storage referenced by a cookie ID

HTTPS (HTTP + TLS)

• Port: 443
• Encryption: all data is encrypted between client and server
• Authentication: server presents a certificate signed by a trusted CA (Certificate Authority)
• Integrity: data cannot be modified in transit without detection

TLS Handshake

Client                               Server
  │─── ClientHello (ciphers, TLS version) ─→
  │←── ServerHello + Certificate + KeyEx ───│
  │─── ClientKeyExchange + Finished ───────→│
  │←── Finished ────────────────────────────│
  │         Secure communication begins      │

1. Asymmetric encryption (RSA/ECDSA) is used to securely exchange a symmetric key
2. Symmetric encryption (AES) is used for the bulk data — much faster

Common HTTP Status Codes

Code	Meaning	Typical use
200	OK	Successful response
301	Moved Permanently	URL redirected permanently
400	Bad Request	Client sent malformed data
401	Unauthorized	Authentication required
403	Forbidden	Authenticated but not allowed
404	Not Found	Resource doesn’t exist
500	Internal Server Error	Server-side failure
503	Service Unavailable	Server overloaded or down