HTTP Fundamentals
HTTP is the application protocol that clients and servers use to exchange requests and responses for resources. It gives browsers, APIs, proxies, and other systems a shared set of methods, fields, status codes, and message semantics.
itNetworking | OpenSkills.info
Course pathWalk it in order
Look it upDip in anytime
Go furtherLeaves this page
Don't Panic
Don't Panic — HTTP Fundamentals
HTTP is the arrangement that lets a client ask a server for something, then receive an answer in a form both sides can read. It arrived because a web of browsers, services, proxies, and caches cannot reasonably negotiate a private dialect for every conversation. The arrangement is modest: a request states intent, a response reports the outcome, and the machinery gets to argue about the details later. This has proved annoyingly durable.
A resource is the thing being addressed, such as a report or customer record; a representation is the version of it that crosses the wire. That distinction saves a surprising amount of confusion. A URI identifies the target, while content carries information about it. One target can have HTML for a browser and JSON for a program without requiring two separate realities, which is good news for everyone who has ever met a browser and a program in the same week.
The request is the control panel. Its method says what the client intends, its target says where, and its fields supply the conditions and metadata. The response carries a status, more fields, and sometimes content. Read the exact status rather than stopping at its first digit: a 304 is cache validation, a 502 names a gateway-to-upstream problem, and a 404 is still an HTTP response rather than a small fire in DNS or TLS.
The misleading bit is that the server in front of you may not be the origin that knows the resource. A gateway can receive a request as though it owns it, then pass it upstream; a cache can answer before the origin is asked at all. This is why a response is evidence, not a confession. Capture the method, target, status, and fields before changing anything, then work out which hop produced them.
Caching supplies the other useful surprise. A stored response can be fresh, stale, or validated with an entity tag. `If-None-Match` and `ETag` let a client ask whether its stored representation still applies; 304 says it does, not that the server has thoughtfully sent a blank document. HTTP is stateless at the protocol level, yet applications can carry cookies or credentials on every request, because apparently even a protocol needs boundaries.
Start with the Intro for the full request-and-response map. Use Slides when you need the relationships in one view, Cheatsheet for the status, field, cache, and version anchors, and Practice to capture controlled exchanges. The Quiz checks the distinctions that sound interchangeable until they are not. After that, the Reference tab leads into the standards that make all this bureaucracy behave consistently.
Where this skill leads
Relevant careers
See how this topic contributes to broader role-level skill maps.
Sources
- https://www.rfc-editor.org/rfc/rfc9110.html
Supports
- HTTP as a stateless application-level request and response protocol
- Resources, representations, clients, servers, messages, intermediaries, and origins
- URI schemes, HTTPS connection requirements, methods, method properties, fields, content, and content negotiation
- Status classes and individual status-code semantics
- Conditional requests, entity tags, authentication challenges, and shared semantics across HTTP versions
- https://www.rfc-editor.org/rfc/rfc9111.html
Supports
- HTTP cache storage, freshness, validation, and response reuse
- Cache-Control directives and shared versus private cache behavior
- Conditional validation and handling of 304 Not Modified
- https://www.rfc-editor.org/rfc/rfc9112.html
Supports
- HTTP/1.1 textual message syntax, request lines, status lines, fields, framing, and connection management
- Host routing requirements and message-body determination
- HTTP/1.1 security and interoperability boundaries
- https://www.rfc-editor.org/rfc/rfc9113.html
Supports
- HTTP/2 binary framing, streams, multiplexing, and field compression
- Mapping shared HTTP request and response semantics onto HTTP/2
- Per-hop protocol behavior through intermediaries
- https://www.rfc-editor.org/rfc/rfc9114.html
Supports
- Mapping HTTP semantics onto QUIC
- HTTP/3 request streams, control streams, and field sections
- Independent stream behavior and version boundaries
- https://www.rfc-editor.org/rfc/rfc8446.html
Supports
- TLS confidentiality, integrity, and endpoint authentication goals
- The security boundary between protected transport and application authorization
- https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/Overview
Supports
- Learner-oriented diagrams and examples of requests, responses, clients, servers, and proxies
- Browser-facing HTTP message anatomy and common web uses
- Scope and progression stated in the MDN reference-link rationale
- https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference
Supports
- Indexed reference sections for methods, status codes, fields, caching, media types, and security
- Scope and progression stated in the MDN reference-link rationale
- https://github.com/sindresorhus/awesome
Supports
- Discovery of the curated Awesome REST list from the canonical awesome-list index
- https://github.com/marmelab/awesome-rest
Supports
- Curated discovery of HTTPie, httpbin, mitmproxy, and Mockoon as relevant HTTP and REST testing tools
- Categories covering request querying, mocking, and debugging proxies
- https://httpie.io/docs/cli
Supports
- HTTPie as a command-line HTTP client for testing, debugging, and interacting with HTTP servers
- Arbitrary requests, readable output, JSON, authentication, fields, sessions, uploads, and downloads
- HTTPie Awesome Links rationale
- https://httpbin.org/
Supports
- httpbin as an HTTP request and response service
- Endpoints for methods, authentication, status codes, request and response inspection, cookies, redirects, and formats
- httpbin Awesome Links rationale
- https://docs.mitmproxy.org/stable/
Supports
- mitmproxy as an interactive intercepting proxy for HTTP and HTTPS traffic
- Inspection, modification, saving, replay, and multiple user interfaces
- mitmproxy Awesome Links rationale
- https://mockoon.com/docs/latest/
Supports
- Mockoon support for configurable mock HTTP routes
- Response status, fields, content, rules, local applications, command-line use, and serverless use
- Mockoon Awesome Links rationale
- https://www.rfc-editor.org/rfc/rfc1945.html
Supports
- The May 1996 HTTP/1.0 specification and its message-oriented protocol model.
- https://www.rfc-editor.org/rfc/rfc2068.html
Supports
- HTTP's use on the World-Wide Web since 1990, the earlier HTTP/0.9 protocol, and the January 1997 HTTP/1.1 specification.
- https://www.rfc-editor.org/rfc/rfc2616.html
Supports
- The June 1999 update to HTTP/1.1.
- https://www.rfc-editor.org/rfc/rfc7230.html
Supports
- The June 2014 HTTP/1.1 message syntax and routing specification.
- https://www.rfc-editor.org/rfc/rfc7540.html
Supports
- The May 2015 HTTP/2 specification, binary framing, and multiplexed streams.
- https://www.rfc-editor.org/rfc/rfc9000.html
Supports
- The May 2021 QUIC transport specification used by HTTP/3.
- https://nginx.org/en/
Supports
- NGINX as an HTTP server and reverse-proxy implementation with an open-source distribution.
- https://httpd.apache.org/
Supports
- Apache HTTP Server as an open-source HTTP server and proxy.
- https://www.haproxy.org/
Supports
- HAProxy as an open-source TCP and HTTP load balancer and proxy.
- https://caddyserver.com/
Supports
- Caddy as an open-source HTTP server and reverse proxy with automatic HTTPS.
- https://www.envoyproxy.io/
Supports
- Envoy as an open-source edge and service proxy for HTTP traffic.
- https://doc.traefik.io/traefik/features/
Supports
- Traefik Proxy as an open-source application proxy with reverse-proxy, load-balancing, and service-discovery capabilities.
- https://developer.konghq.com/gateway/
Supports
- Kong Gateway as an API gateway for configuring services, routes, and policies at an HTTP boundary.
- https://docs.stripe.com/api/idempotent_requests
Supports
- Application-level idempotency keys as a way to safely retry POST requests after an interrupted exchange.
