English
Magyar
If you look very closely at the web addresses in your browser’s top bar, you’ve probably already noticed the very first part of any website’s address: the letters ‘HTTP’ or ‘HTTPS’. But what exactly is HTTP, and how does it work? Let’s take a look at the glue that holds the web together.
HTTP: The short version
HTTP is an acronym, standing for Hypertext Transfer Protocol. Let’s break it down a little, starting with the ‘protocol’ part. In the world of technology, a protocol is the set of rules that machines must follow in order to ‘talk’ to one another. For example, VPN protocols define how VPNs connect to servers. HTTP is much less specific than this, and instead defines the rules governing how the internet works.
This is no exaggeration. Without HTTP, there would be no communication on the World Wide Web. This is because HTTP governs communication between web servers and web clients – the ‘transfer’ part. You can connect to web servers to view websites; for example, you are currently connected to aWh’s web server to read this article.
To access the web server, you need a web client. This client is usually a web browser, but it can actually be any application. For example, if you clicked on this article from the Facebook mobile app, then the browser within the Facebook app is your web client. The client-server interaction is, in essence, the very foundation of the internet, and HTTP forms an integral part of this.
The last part of the abbreviation ‘HTTP’ stands for ‘hypertext’, which refers to the type of files being transferred – almost always HTML files. Files of this type are the building blocks of the web, as they not only display text but can also be linked together. This differs from the file types on your device, which are generally not capable of doing this.
How HTTP works in a nutshell
HTTP is a protocol that runs on the so-called application layer of the internet, above the internet layer, where the actual elements of the web, such as IP addresses, are located. The application layer is where the browsers and applications you use every day are found, and HTTP is a major part of this layer.
The way it works is that the browser, acting as the client, sends an HTTP request over the network, which is processed by the server hosting the website the user wishes to visit. The website then returns an HTTP response which – if everything went well – is the requested page. The browser then displays the response.
Breaking down HTTP requests
Of course, there’s a bit more to it than that. An HTTP request actually consists of several parts, each of which plays an important role in rendering the website. The most important parts of every request include the HTTP method, the request headers and the request body.
The method generally refers to the operation requested via HTTP, i.e. retrieving or providing information (the ‘GET’ and ‘POST’ commands, although there are many others). The headers of an HTML request are a little more difficult to explain, but think of them as envelopes: each one contains the address where the message is sent, the sender’s address, and a whole lot of other information, such as the type of postbox (browser) and details regarding encryption.
The HTML body ‘fills’ the envelope with information such as login details, or anything else the server needs to know in order to display the page; sometimes it is empty, and the envelope – the request header – is sufficient.
HTTP responses
Once the request has been received, the web server begins to process the response, which also consists of three parts: the HTTP status code, the response header and the response body. The header and body are very similar to their counterparts in requests, with the difference that the body contains much more information, such as the files carrying the information required to display the web page.
Status codes are an interesting topic, as we’ve probably all come across them without realising what they are. They consist of three digits, which can start with any number from 1 to 5. Each sequence means something. So any three-digit code beginning with a 2 indicates success (the page loads without any problems), whilst a code beginning with a 4 indicates an error, such as the infamous 404: page not found code.
This call-and-response system forms the basis of everything we do on the internet. Although it becomes more complex than described above, this covers the basics. Of course, there is still the question of how we keep all this communication secure.
HTTP and security
This is where we run into the problem with HTTP: HTTP does not encrypt or protect information in any way. It is purely a matter of sending and receiving; there is no stage at which security is added. Anyone capable of intercepting the messages can see what is being sent, which may include things such as credit card numbers or account details.
In some ways, it’s like having a chat with your neighbour over the fence that separates your plots: everyone is in their own space, but if someone stands close enough, they can hear every word you say.
As you can imagine, this is extremely bad news for most internet users, and incredibly good news for those who exploit them. To remedy this, a new type of HTTP has been introduced: HTTPS, where the final ‘S’ stands for ‘secure’. This version of HTTP encrypts the information, making it much harder for anyone to eavesdrop, so to speak.
Nowadays, we are seeing fewer and fewer websites using ‘plain’ HTTP, as almost every notable website has switched to HTTPS over the past few years. There are some, however, which – for reasons varying depending on the site owner – have resisted this change. It is advisable to avoid these, or at the very least to use a VPN to protect sensitive information.
That said, whilst HTTPS is undoubtedly a vital update, it is still merely a patch for the original solution. HTTP has been powering the internet since its inception, and it is doubtful that this will change any time soon.