Back to posts
Notes

HTTP, REST API & HTTPS — How Browsers Talk to Servers

May 19, 20265 min read5 views
HTTP

What is HTTP?

HTTP (HyperText Transfer Protocol) is the set of rules that browsers and servers use to communicate.

Think of it like ordering food:

- You (browser) place an order (request)

  • • Waiter (HTTP) carries it to the kitchen
  • • Kitchen (server) prepares and sends back the food (response)

    ---

    How a Browser Connects to a Server

    When you type google.com and hit Enter, here's what happens step by step:

    ``

    • 1. DNS Lookup Browser asks: "What is the IP address of google.com?" DNS replies: "It's 142.250.195.46"

    2. TCP Handshake (SYN → SYN-ACK → ACK) Browser and server "shake hands" to establish a connection

    3. HTTP Request Browser sends a request: "Give me the homepage"

    4. HTTP Response Server replies with HTML, CSS, JS files

    5. Browser renders the page `

    > DNS is like a phonebook — it converts a domain name to an IP address. > TCP Handshake is just confirming both sides are ready to talk.

    ---

    HTTP Request Structure

    Every request has these parts:

    |Part|What it is|Example| |---|---|---| |Method|What action you want|GET, POST, DELETE| |URL/Path|Where you're sending the request|/users/1| |Headers|Extra info about the request|Content-Type: application/json| |Body|Data you're sending (optional)|{ "name": "Koi" }|

    ---

    HTTP Methods

    |Method|What it does|Real world analogy| |---|---|---| |GET|Fetch / read data|Reading a menu| |POST|Create new data|Placing an order| |PUT|Replace existing data|Rewriting your whole order| |PATCH|Update part of existing data|Changing just one item| |DELETE|Remove data|Cancelling your order|

    ---

    HTTP Status Codes

    |Range|Meaning|Common Examples| |---|---|---| |2xx|✅ Success|200 OK, 201 Created| |3xx|↪️ Redirect|301 Moved Permanently, 302 Found| |4xx|❌ Your fault|400 Bad Request, 401 Unauthorized, 404 Not Found| |5xx|💥 Server fault|500 Internal Server Error|

    > Easy trick: 4xx = YOU messed up, 5xx = SERVER messed up

    ---

    REST API

    REST (Representational State Transfer) is a set of rules/style for designing APIs using HTTP.

    Key Ideas

    - Everything is a resource (user, post, product) with its own URL

  • • Use HTTP methods to do things with resources
  • • Stateless — each request is independent, server doesn't remember the previous one
  • • Mostly returns JSON data

    Example — A User API

    `

    • GET /users → Get all users POST /users → Create a new user GET /users/1 → Get user with ID 1 PUT /users/1 → Replace user 1's data PATCH /users/1 → Update part of user 1's data DELETE /users/1 → Delete user 1 `

    What a Response Looks Like (JSON)

    `json { "id": 1, "name": "Koi", "email": "koi@example.com" } `

    ---

    HTTPS — The Secure Version

    HTTP vs HTTPS

    ||HTTP|HTTPS| |---|---|---| |Data|Travels as plain text|Encrypted before sending| |Analogy|Sending a postcard — anyone can read it|Sealed envelope — only receiver can open it| |URL|http://|https://| |Use|Old, insecure|Standard today|

    ---

    SSL vs TLS

    People use these terms interchangeably but they're different:

    - SSL* (Secure Sockets Layer) — the old protocol from the 1990s. Had security vulnerabilities. *Deprecated, no longer used.

  • • TLS (Transport Layer Security) — the modern, fixed version of SSL. This is what actually runs HTTPS today. TLS 1.2 and 1.3 are the current standards.

    > Everyone still says "SSL certificate" out of habit — but they almost always mean TLS. Same thing in casual conversation.

    ---

    What is a TLS Certificate?

    A TLS certificate is a digital ID card for a website. It proves two things:

    1. Identity — this server really is google.com, not an imposter

    • 2. Encryption key — here's the public key to start encrypting our conversation

    It's issued by a trusted third party called a Certificate Authority (CA) — like DigiCert, Let's Encrypt, or Comodo. Your browser already has a built-in list of CAs it trusts.

    > ⚠️ The 🔒 padlock in your browser means the connection is encrypted — NOT that the website is safe or trustworthy. A scam website can have HTTPS too.

    ---

    Full HTTPS Connection Flow

    ` 1. DNS Lookup → get IP address 2. TCP Handshake → establish connection 3. TLS Handshake → (new) set up encryption 4. HTTP Request → now encrypted 5. HTTP Response → now encrypted 6. Browser renders `

    What Happens in the TLS Handshake?

    ` 1. Browser says hello → "I want to connect securely, here's what encryption I support" 2. Server responds → sends its TLS certificate + picks an encryption method 3. Browser verifies → checks the certificate with a trusted CA 4. Keys exchanged → both sides agree on a secret key for this session 5. Secure tunnel open → everything from here is encrypted 🔒 `

    ---

    Quick Summary

    ` Browser → DNS → TCP Handshake → (TLS Handshake if HTTPS) → Request → Server → Response → Render ``

    - HTTP = language of the web

  • • Request has: Method + URL + Headers + Body
  • • Methods: GET / POST / PUT / PATCH / DELETE
  • • Status codes: 2xx ✅ | 3xx ↪️ | 4xx ❌ (your fault) | 5xx 💥 (server fault)
  • • REST = rules for building clean HTTP APIs using resources + methods
  • • HTTPS = HTTP + TLS encryption
  • • SSL* = old name, *TLS = what actually runs today
  • • Certificate = digital ID card issued by a Certificate Authority (CA)