Web (HTTP & HTTPS)

Computer Network & Network Security System — Application Layer, NEC licence examination syllabus (Nepal Engineering Council).

Web: HTTP and HTTPS, the protocol behind every website you've ever visited

Every single webpage load is a tiny conversation, following a very specific script.

HTTP (HyperText Transfer Protocol) is a request-response protocol: your browser sends a request, the server sends back a response.

📨 HTTP Methods

GETRetrieve data (loading a page, an image).

POSTSend data to the server (submitting a form, uploading a photo).

PUT / DELETEUpdate or remove a resource on the server.

🔗 Persistent vs Non-Persistent Connections

Non-persistentA new TCP connection is opened and closed for EVERY single object on a page (each image, each stylesheet) — old HTTP/1.0 behaviour, wasteful.

PersistentOne TCP connection stays open and is reused for multiple requests — the modern default (HTTP/1.1+), much faster.

Cookies let a stateless protocol (HTTP has no built-in memory of previous requests) fake having memory — the server sends a small piece of data the browser stores and sends back on future requests, which is how a website "remembers" you're logged in.

HTTPS is just HTTP wrapped in TLS/SSL encryption — the padlock icon you see in your browser's address bar every single time you're on a secure site.

💡 One-liner: "Why is HTTP called 'stateless'?" → Each request is independent, with no memory of previous requests — cookies exist specifically to work around this limitation.

The property everything else follows from

HTTP is stateless: each request is independent and the server remembers nothing about previous ones. Two requests from the same browser, seconds apart, are as unrelated as requests from opposite sides of the world.

That looks like a defect and was a deliberate choice. A stateless server need keep no per-client memory, so it can serve enormous numbers of clients and any server in a group can answer any request. It is what makes the web scale.

💡 It also means the protocol cannot support logging in on its own. Cookies exist to work around statelessness: the server sends a token, the browser returns it on every subsequent request, and state is reconstructed from that token each time. The server is still stateless; the state now travels with the request.

Reading a status code from its first digit

🔢 The five classes

1xxInformational — the request was received and processing continues.

2xxSuccess — 200 OK, 201 Created.

3xxRedirection — the resource is elsewhere; 301 permanently, 302 temporarily.

4xxClient error — the request was wrong. 404 not found, 403 forbidden.

5xxServer error — the request was fine and the server failed. 500 internal error, 503 unavailable.

The 4xx/5xx split is the one examiners test: it says whose fault it is. A 404 means you asked for something that does not exist; a 500 means you asked correctly and the server broke. Knowing which class a code falls in tells you where to start looking without knowing the specific number.

Why GET and POST are not interchangeable

📨 The properties that separate them

GET is safeIt should only read, never change anything. So it can be cached, bookmarked, prefetched and retried freely.

POST is notIt may change server state, so browsers warn before resubmitting it and it is never cached.

VisibilityGET parameters sit in the URL — logged, stored in history, visible in the address bar. POST data is in the body.

💡 Hence the practical rule: never use GET for anything that changes data or carries a password. A GET that deletes a record will be triggered by anything that follows links — a crawler, a browser prefetching, a link checker — and a password in a URL ends up in server logs and browser history.

💡 HTTPS is HTTP carried inside TLS — the protocol is unchanged, and a TLS layer is inserted beneath it. That is why the methods, status codes and headers are all identical, and why the handshake covered in the SSL topic happens before any HTTP is sent.

Syllabus points

HTTP request/response, methods
Persistent vs non-persistent, cookies
HTTPS

Create a free account to tick topics off, take notes as you read, watch the video lessons and get a day-by-day study plan built around your exam date.