Explain the HTTP protocol, including request methods, status codes and headers, and the role of HTTPS in securing web traffic

What this dot point is asking

NESA wants you to know the structure of HTTP requests and responses, the standard methods and status codes, the role of headers, and how HTTPS layers encryption and identity on top.

The answer

Anatomy of an HTTP request

Every HTTP request starts with a request line that names the method and path, then carries any number of headers, then optionally a body. The example below shows a POST request submitting a JSON payload.

POST /api/comments HTTP/1.1
Host: blog.example.com
Authorization: Bearer eyJhbGciOiJIUzI1NiIs...
Content-Type: application/json
Content-Length: 32

{"article_id": 7, "text": "Hi"}

• Method: POST
• Path: /api/comments
• Version: HTTP/1.1 (or HTTP/2, HTTP/3)
• Headers: key-value metadata
• Body: optional, present for POST/PUT/PATCH

Anatomy of an HTTP response

Every HTTP response starts with a status line that names the version, status code and a short reason phrase, then headers, then optionally a body. The example below shows a successful resource creation that returns the new resource as JSON.

HTTP/1.1 201 Created
Content-Type: application/json
Location: /api/comments/91
Content-Length: 27

{"id": 91, "status": "ok"}

• Status code: 201
• Status text: Created
• Headers: response metadata
• Body: optional, contains the resource representation

Methods

Idempotent means calling the request many times has the same effect as calling it once. Safe means the request does not change server state.

Status codes

• 1xx: informational (rarely seen).
• 2xx: success. 200 OK, 201 Created, 204 No Content.
• 3xx: redirect. 301 Moved Permanently, 302 Found, 304 Not Modified.
• 4xx: client error. 400, 401, 403, 404, 429 Too Many Requests.
• 5xx: server error. 500 Internal Server Error, 502 Bad Gateway, 503 Service Unavailable.

Headers

Headers carry metadata. Useful examples:

• Content-Type: application/json describes the body format.
• Authorization: Bearer ... carries an authentication token.
• Cache-Control: no-store instructs caches not to retain the response.
• Set-Cookie: session=... issues a cookie to the browser.
• Strict-Transport-Security: max-age=31536000 forces future requests to use HTTPS.

HTTPS

HTTPS is HTTP carried over TLS. It provides three guarantees:

• Confidentiality: traffic is encrypted so eavesdroppers see only ciphertext.
• Integrity: tampering with the request or response is detected.
• Server authentication: the certificate proves the browser is talking to the legitimate server (not a man-in-the-middle).

The TLS handshake combines asymmetric and symmetric encryption: asymmetric for key exchange and certificate verification, symmetric (AES) for the bulk session traffic.

A worked example

A Python script using requests:

import requests

response = requests.post(
    "https://api.example.com/comments",
    headers={
        "Authorization": "Bearer eyJhbGciOiJIUzI1NiIs...",
        "Content-Type": "application/json",
    },
    json={"article_id": 7, "text": "Hi"},
)

print(response.status_code)  # 201
print(response.headers["Content-Type"])  # application/json
print(response.json())  # {"id": 91, "status": "ok"}

requests handles the TLS handshake automatically. The HTTP wire format - method, path, headers, body - is what is actually sent across the network.