Lesson 4.7: HTTP and HTTPS: how the web talks, and how it's protected
The web's protocol: requests and responses, methods, status codes and headers, cookies; then HTTPS: TLS encryption, certificates and the authorities that sign them, what the padlock does and doesn't prove, and HSTS. In the lab you follow a redirect from HTTP to HTTPS, read request and response headers, check status codes, inspect the server's certificate, check a session cookie's protections and see what happens with an expired certificate.
20 min
You will learn to
- Describe an HTTP request and response
- Read status code classes and common headers
- Explain what TLS and certificates provide
- Inspect a certificate with openssl
- Explain HSTS and secure cookie flags
Key terms
- HTTP
- The request-response protocol of the web: a client asks for a resource, the server answers with a status, headers and usually a body.
- Method
- The action requested: GET to read, POST to send data, PUT and DELETE to change or remove, HEAD for headers only.
- Status code
- A three-digit result: 1xx information, 2xx success, 3xx redirect, 4xx client error, 5xx server error.
- Header
- A name: value line carrying extra information about a request or response.
- Cookie
- A small value a site stores in your browser and gets back with each request; often a session ID that keeps you logged in.
- HTTPS and TLS
- HTTPS is HTTP inside TLS, which encrypts the traffic, protects it against changes and proves the server's identity with a certificate.
- Certificate and certificate authority (CA)
- A certificate binds a name to a public key and is signed by a CA that browsers trust; it expires and must be renewed.
- HSTS
- A response header that tells the browser to use only HTTPS for a site for a set time.
← Hard and symbolic links · All lessons · White, black and grey hats: what makes hacking ethical →