Follow a web request safely
Connect DNS, transport, HTTP, and TLS in a browser request.
- Read an HTTP request and response.
- Trace a TLS handshake and explain what it protects.
- Explain how a certificate chain proves a server's identity.
We've reached the top of the stack, where the data finally means something to a person. HTTP is the language of the web. It's a plain request and response: the client asks, and the server answers.
The shape of an HTTP message
A method says what the client wants to do: GET reads, POST submits, PUT replaces and DELETE removes. A status code says what happened, and its first digit tells you whose problem it is.
Try it
Up to 15 XPRead the status code
The first digit is the key: 2 means success, 3 means look elsewhere, 4 means the client got something wrong, and 5 means the server did. Sort each one by who should act next.
“200 OK”
“301 Moved Permanently”
“404 Not Found”
“401 Unauthorized”
“503 Service Unavailable”
“500 Internal Server Error”
The problem with plain HTTP
Every router, switch and Wi-Fi network between you and a server handles your packets. With plain HTTP, any of them could read your password or change the page. TLS fixes three things at once:
- Confidentiality: no one on the path can read the data.
- Integrity: no one can change it without being detected.
- Authentication: you know you're talking to the real server.
HTTPS is simply HTTP running inside a TLS connection.
Try it
Up to 15 XPWatch a TLS 1.3 handshake
This happens right after the TCP handshake. Keep an eye on how the two sides arrive at a shared secret when anyone can see the messages.
Why trust a certificate?
Anyone can make a certificate that says “I am your bank”. What matters is who signed it. Your browser or operating system ships with a short list of trusted certificate authorities, and every valid certificate traces back to one of them.
Try it
Up to 15 XPSpot what's wrong with the connection
Each card shows a connection. Click whatever should worry you, then check your answer.
Click every suspicious section. There are 2.
See it all with curl
curl -v prints every stage of a request. Lines starting with * are curl's notes, > is what it sent and < is what came back.
Try it
Up to 15 XPRead a real request
Click the line that answers each question.
Which line shows the encryption that was negotiated?
Key takeaways
HTTP is a request and response, and status codes say who should act next.
TLS provides confidentiality, integrity and server authentication.
A certificate chain ties a name to a key, but it doesn't vouch for the site's honesty.
Lesson quiz
8 questions · pass with 6 correct · up to 50 XP
Passing this quiz completes the lesson and keeps your streak going. Questions you miss come back in review sessions later.
Questions about this lesson
Stuck? Ask. Figured something out? Share it. Explaining is one of the best ways to learn.
Loading posts…