HTTP

Summary #

tags: HyperText, Application level protocol

Hypertext Transfer Protocol(HTTP) is used mainly to access World Wide Web (www) data. The Hypertext Transfer Protocol (HTTP) is the Web’s main application-layer protocol, although current browsers can access other types of servers. A repository of information spread all over the world and linked together.

The HTTP protocol transfers data in plain text, hypertext, audio, video, etc. HTTP utilizes TCP connections to send client requests and server replies. It is a synchronous protocol that works by making both persistent and non-persistent connections.

HTTP vs TCP #

ref

HTTP is a Hypertext Transfer Protocol, whereas TCP full form is Transmission Control Protocol.
HTTP is utilized to access websites, while TCP is a session establishment protocol between client and server.
HTTP uses port 80 and TCP uses no port.
HTTP doesn’t need authentication, whereas, TCP uses the TCP-AO.
HTTP is Stateless but not session less. In contrast, TCP is a Connection-Oriented Protocol.
HTTP is a One-way communication system, while on the other hand, TCP is a 3-Way Handshake (SYN, SYN-ACK, ACK).
In case you’re using HTTP, HTTP appears in the URL of the site, and if you’re using TCP, TCP appears in IP.
HTTP establishes data link communication only but TCP establishes session connection.
HTTP is useful for transfer of smaller documents like webpages, on the other hand, TCP is useful to setup connection for data transfer.
HTTP is faster in comparison to TCP, which is slower.

TCP	HTTP
TCP protocol is used for session establishment	HTTP protocol is used for content access
between two machine. No Port number	from web server. HTTP uses TCP’s port number 80.
TCP-AO (TCP Authentication Option)	HTTP does not perform authentication.
TCP is used extensively by many internet applications.	HTTP is useful in transferring smaller
	files like web pages.
Connection-Oriented Protocol	Stateless but not session less
Establishes Connection between Client and Server.	Transfers records between the Web client and Web server.
No URL	When you are managing HTTP, HTTP will appear in URL.
3-Way Handshake (SYN, SYN-ACK, ACK)	One-way communication system.
HTTP, HTTPs, FTP, SMTP, Telnet	Most widely used for web based applications
The speed for TCP is slower	HTTP is faster than TCP.

HTTPS #

HTTPS communication between client and server? #

How SSL Certificate Verification adds security in HTTPS communication

client sends HTTPS request to a server
server uses private key(private key pair of the public key that was in CSR), to sign(encrypt) some data and sends it back to client along with the SSL Certificate.
Client uses public key from certificate that it received from server and decrpyt to verify the server is the owner of the private key.
Case 1: what if hacker uses it own certificate to send signed data back to the client along with his/her fake SSL certificate How is this is dealt with? After or before receiving the signed data from server, client verifies the CA signature of the certificate that client receives from server using the CA public key that the client(browser) posses. If hacker cert is not verified then client creates an alarm.
Case 2: what if hacker uses a valid CA signed cert to sign some data that server sends How this is dealt with? Client also checks whether the IP and domain name mentioned in the SSL cert matches with IP and domain name of server that client(browser) believes that it is talking to - if they do not match, browser reports that something is fishy.
Case 3: what if hacker creates CA signed cert with IP and domain name of a server that he does not own? CA will not create SSL cert for a server, if the owner ship is not verified.

HTTP

Summary #

HTTP vs TCP #

HTTPS #

HTTPS communication between client and server? #

HTTP Methods #

GET #

POST #

PUT #

HEAD #

DELETE #

PATCH #

OPTIONS #

CONNECT #

TRACE #

Links to this note