HTTP and HTTPS

Lecture Notes for CS349W
Fall Quarter 2008
John Ousterhout

HTTP: HyperText Transfer Protocol

Used by browsers for fetching Web data from servers.
Because of its universal availability (e.g., firewalls don't interfere) has become widely used as a general-purpose protocol for network communication.
Simple request-response protocol, sent using TCP/IP sockets.
Sample request:
```
GET /index.html HTTP/1.1
Host: www.example.com
User-Agent: Mozilla/5.0
Accept: text/xml,application/xml,application/xhtml+xml,text/html*/*
Accept-Language: en-us
Accept-Charset: ISO-8859-1,utf-8
Connection: keep-alive
<blank line>
```
- First line contains method, URL, version number
  - GET method: read information from server. Should have no side effects.
  - POST method: sends data from the browser to the server (typically form data), returns information from the server. Likely to have side effects. Data is in the body of the message, after the blank line.
  - There are several other methods defined besides these two, but they are not commonly used.
- Headers: name-value pairs providing various information that may be useful to the server.
- A request can also contain data following the headers, but the GET method doesn't have any data (POST does, though).
Sample response:
```
HTTP/1.1 200 OK
Date: Thu, 24 Jul 2008 17:36:27 GMT
Server: Apache-Coyote/1.1
Content-Type: text/html;charset=UTF-8
Content-Length: 1846

<html>
...
</html>
```
- First line contains protocol version number, numerical status code, textual explanation.
- Headers have same general format as for requests
- Blank line separates headers from response data.
Redirection: rather than returning an HTML page, the server can set the Location header to some other URL and return a status of 307. This causes the browser to immediately fetch the new URL in place of the page initially requested. Useful if information has moved, and for handling POST requests.
For the most part, HTTP is invisible to Web application developers; everything happens automatically for you (occasionally you will need to read or write various headers).

HTTPS

Works identically to HTTP, except that the request and response messages are transmitted using SSL (Secure Sockets Layer) or its successor TLS (Transport Layer Security).
HTTPS is used automatically for any URL beginning with "https:" instead of "http:".
What HTTPS does for you:
- The request and response messages are transmitted between the browser and server in encrypted form.
- This prevents snoopers on the network from accessing private information in the messages, such as passwords or credit card numbers.
However, HTTPS does not guarantee that the browser and server can trust each other. You just know that no-one else is listening.
HTTPS requires additional server setup: must create a certificate that identifies the server to the browser.
In designing Web applications you must make sure that HTTPS is used whenever private data has been transmitted, such as when forms are submitted for login or for credit card authorization.
There are numerous security issues related to HTTPS, such as
- When to use it.
- How to mix HTTP and HTTPS safely.
- These are beyond the scope of this course, but beware!