INTRODUCTION TO HTTP
What is HTTP?
HTTP stands for Hypertext Transfer Protocol. It is an application protocol, a
system of rules that serve as link between applications and trasnfer of
Hypertext documents.
HTTP follows a simple model where the client sends a request to the server
and waits for a response. HTTP is called a request/response protocol. We can
think of request and response as simple strings or messages that follow a
standard format that the other machine can comprehend.
The Internet
The internet consist of millions of interconnected networks that allows for all
types of computer and devices to connect to each other. Conventionally all
devices that engage in a network are provided by a label called an IP address.
What is an IP address?
The IP address (Internet protocol address) is like a computers phone number
on the internet.
[Link]
The above number is an example of an IP address.
For wider internet effective communication begins when each device has a
public IP address provided by the ISP.
What is a Port?
Ports give more detail about how to communicate.
Each server or computer has an IP address which have hundreds of ports,
where each port is used for a different communication purpose to that device
or server.
INTRODUCTION TO HTTP 1
[Link]:1234
In the above mentioned number the [Link] is the IP address and 1234 is
the port number.
The DNS
The mapping from domain name to IP address is handeled by a DNS (domain
name system). A DNS is a distributed database which links domain names to IP
address so that the IP address can used to send a request to the server.
Where is the DNS database stored?
The DNS database is stored in computers called DNS servers.
There is no single DNS server that holds all the database. There is a world-wide
network of hierarichally organized DNS servers. If one DNS server does not
hold a domain name it routes the request to another DNS server up the
hierarchy.
What are the steps that follow when we enter a URL in our
browser?
The steps are
1. We enter a URL for example [Link] into our browser
2. The browser creates a HTTP request, which is package up and sent to our
device’s network interface.
3. If the devcie already has an IP address for the domain name in its DNS
cache, it will use the cached domain name, if not then a DNS request is
sent to the domain name system to obtain IP address for the domain name.
4. The pacakaged up HTTP request is sent over to the internet where it is
directed to the server with the matching IP address.
5. The remote server accpets the request and sends a response over the
internet back to our network interface which passes it on to our browser.
6. Finally, the browser displays the response in form of a webpage.
INTRODUCTION TO HTTP 2
Describe Client and Server?
A most common client is the application we interact with, the Web Browser.
Web browsers are responsible for issuing HTTP requests and processing the
response in a user- friendly manner onto our screens.
Web browsers are not the only clients as there are other tools and applications
that can issue an HTTP request.
Servers holds the content that is beign requested. A server is a machine or
device that handles inbound requests and is responsible to issue response.
Often the response sent back from a server contains the relevant data as
specified in the request.
What is a resource?
A resource is a generic term used for things we interact with on the internet via
the URL. This includes images, videos, web pages and other files. Resource
may also be in a form of a software on which we play video games or that let
you buy and sell stocks.
INTRODUCTION TO HTTP 3
What is Statelessness?
A protocol is said to be stateless when it is desgined in such a way that the
request/response cycle is completely independent of the previous one.
HTTP is a stateless protocol. This means that a server does not need to hold
onto information between requests.
This makes HTTP a resilient protocol but also a difficult protocol to build
stateful application. As HTTP, the protocol of the internet, is inheritily stateless
web developers have to work really hard to build stateful applications
There are tricks that developers and frameworks employ to make it look like the
application is stateful.
INTRODUCTION TO HTTP 4
HTTP Request
HTTP Request with a Browser
To issue a HTTP request from the browser just enter a URL like
[Link] The server that hosts the main facebook website handels
the request and issues a response back to the browser. The browser is smart
enough and process the response that is sent back and displays site.
HTTP Request with a HTTP Tool
To see the raw response we can use a HTTP tool. Just like a browser isssue an
HTTP request when entered the URL we can issue a request using a HTTP tool
but instead of showing a processed response the tool shows us a raw
response.
We can also use our web browser inspector to view HTTP request and
response.
Request Methods
Request method can be thought as a verb that tells the server what action to
perform on a resource.
There are two most common HTTP request methods POST and GET .
GET is used to retrieve a resource.
Every request gets a reposne even if the response is an error, it is still a
response.
GET Requests
A GET request is made by clicking on a link or through the address bar in our
browser.
When we enter a URl in our web browser we are basically asking the browser to
go retrieve the resource at that address.
The same is true when we click on links on web applications. The default
behaviour of a link is to issue a GET request to a URL.
HTTP Request 1
To conclude:
GET requests are used to retrieve a resource, and most links are GETs.
The response from a GET request can be anything, but if it's HTML and that
HTML references other resources, your browser will automatically request
those referenced resources. A pure HTTP tool will not.
POST Requests
A POST request is sent when we want to initiate some action on the server or
send some data to the server.
Typically within a browser a POST request is sent when submitting a form. POST
request allows to send much larger and sensitive data to the server, such as
videos and images.
If we wanted to send our user name and password to a server. We could use a
GET request and send it through the qurey string. But now our credentials are
exposed in the URL. So, a better approach will be to use a POST request in a
form.
With the help of a POST request we can send larger forms of information to the
server.
So when a form is submitted with some data so how does this data gets
submitted to the server as it was not part of the URL? When the form was
submitted a POST request is issued by our browser and the data is sent in HTTP
body. The HTTP body contains the data that is being transmitted in a HTTP
message. The HTTP body is optional, that is the HTTP message can have an
empty body or it can contain HTML, video or images.
HTTP Headers
HTTP headers allow the client and server to send additional information during
the HTTP request/response cycle.
HTTP headers are colon separated name value pairs and are sent in plain text.
Request and response both ahve headers
Request Headers
HTTP Request 2
Request header give more information about the client and the resource to be
fetched.
Summary
The most important components to understand about an HTTP request are:
HTTP method
path (the resource name and any query parameters)
headers
message body (for POST requests)
HTTP Request 3
URL
what is a URL?
Just like in our physical world we need an address to locate a friends house
and require a phone number to call a freind. Due to the uniformity of how an
address is formatted compared to how a phone number is formatted we can
immdiately distinguisg between both.
There is a similar concept for finding and accessing servers on the internet.
When we launch our web browser and navigate to some address
“[Link]/account”. Now the web browser makes an HTTP request to
this address resulting in a resource being returned to the browser.
Here the address we entered “[Link]/account” is the uniform
resource locator or URL.
What are the URL components?
Given the URL: "[Link]
The above URL can be broken into 5 parts.
1. The scheme http : the scheme always comes before a colon and two front
slashes. This tells the web client how to access the resource. Here it tells
the web client to use the Hypertext transfer protocol. So the scheme
indicates which protocol is to be used to access the resource. Other
popular schemes are ftp, mailto or git.
2. The host [Link]: This part tells the client where the resource
is hosted or located.
3. The port :88: The port number is only required if we want to use other than
the default.
4. The path /home: It shows which local resource is being requested. (this
part is optional)
5. The query string ?item=book: This part is made up of query parameters. It
is used to send data to the server. This part is also optional.
URL 1
The default Port for HTTP is port 80. It is not always specified but it is assumed
to be part of every url. Unless a different port is specified, port 80 is used by
default in normal HTTP request.
Query strings/parameters
There are different components in a qurey string. Consider the following URL
with a qurey string:
[Link]
The components of the query string are as follows:
Qurey string
Description
component
? This is a reserved character that marks the start of the qurey string
search=ruby This is the parameter name/value pair
This is a reserved character, used when adding more parameters to
&
the qurey string
result=10 This is another parameter name/value pair
In the url “[Link]
product=iphone&size=32gb&color=white”
The name/value pairs in form of product=iphone, size=32gb, color=white are
passed to the server from the URL. This is just asking the [Link]
server to narrow down on a product iphone with size 32gb and color white.
How the server uses these paramters is upto the server side application.
As qurey strings are passed in through the URL, they are usually only used in
HTTP GET request. POST request do allow qurey string, but is uncommon.
Whenever we type in a URL in our browser, the browser issues a HTTP GET
request.
What are the limits to the use of a query string?
Qurey strings have a mximum length, so if there is alot of data then it wont
be poosible to pass all of it through a query string
URL 2
The name/value pairs are visible in the URL. So, passing sensitive
information like username or password is not recommended.
Space and characters like & cannot be used with qurey strings. They must
be URL encoded.
URL Encoding
Characters must be encoded if:
They have no corresponding character within the standard ASCII character
set
The use of the character is unsafe since it may be misinterpreted or
modified by some systems
The character is reserved for special use within the URL scheme. Some
characters are reserved for a special meaning; their presence in a URL
serves a specific purpose. Characters such as / , ? , : , @ , and & are all
reserved and must be encoded.
So what characters can be used safely within a URL?
Only alphanumeric and special characters $-_.+!'()", and reserved characters
when used for their reserved purposes can be used unencoded within a URL.
As long as a character is not being used for its reserved purpose, it has to be
encoded.
URL 3
Processing Response
The raw HTTP data sent back by the server is called the response.
what are the components of an HTTP
response
1. Status Code
The HTTP status code is a three digit number that the server sends back after
recieving a request which reveals the status of the request.
status text next to the status code provides the description of the status code.
The most common status code is 200 which means that the request was
handled successfully.
Some other useful status code which a web developer should know about are:
Status Code Status Text Meaning
200 OK The request was handled successfully
The requested resource has changed temporairily.
302 Found
Usually results in a redirect to another URL
404 Not Found The requested resource could not be found
Internal Server
500 The server has encountered a generic error
Error
302 Found
When a resource is moved the best stratergy is to re-route the request from the
original URL the new URL. This re-routing is known as a redirect .
The browser automatically follows the re-routed URL found in the Location
response header when the browser sees the response status code of 302.
Processing Response 1
404 Not Found
This satus code tells that the requested resource is not available. A resource
can be anything image, CSS style sheets or video etc.
500 Internal Server Error
This staus code indicated there is an issue at the server side.
Response Header
Resposne Headers offer more information about the resource beign sent back
Some common response headers are
resposne header provide additional meta-information about the response data
beign returned.
Summary
The most important parts of an HTTP response are:
status code
headers
message body, which contains the raw response data
Processing Response 2
Security
Secure HTTP (HTTPS)
As client and server are sending request and response to each other, all the
request and response are beign sent as strings. Requests contain session id
which uniquely identifies client to the server, and if someone (a hacker) copied
the session id they could send a request to the server posing as the client.
They are logged in automatically without having access to username and
password.
This is where HTTPS helps. A resource that is accessed by HTTPS starts with
https://
With HTTPS every request/response is encrypted before beign transported on
the network
HTTPS send messages through a crptographic protocol TLS for encryption.
Previous version of HTTPS used SSL . These cryptograhic protocols use
certificates to communicate with the remote servers and exchange security
keys before data encryption happens.
Same Origin Policy
The same-origin policy permits unrestricted interaction between resources
originating from the same origin, but restricts certain interactions between
resources originating from different origins. By origin, we mean the
combination of the scheme, host, and port.
Same-origin policy doesn't restrict all cross-origin requests. Requests such as
linking, redirects, or form submissions to different origins are typically allowed.
The same-origin policy is an important guard against session hijacking attacks
and serves as a cornerstone of web application security.
Let's look at some HTTP security threats and their counter-measures.
Session Hijacking
Session plays an important role in keeping HTTP stateful. Session id serves as
a unique token used to identify each session. Session id is implemented as a
Security 1
random string that comes in the form of a cookie stored on the computer. With
the session id in place on the client side now every time a request is sent to the
server this data is added and is used to identify the session.
This is what many web applications with authentication do. When a username
password match a session id is stored on the browser so that on the next
request they won’t have to reauthenticate.
So now if an attacker gets hold of the session id, now both the user and the
attacker share the same session and access to the web application.
Counter Measures for Session Hijacking
One way is to solve session hijacking is by resetting sessions. With
authentication system this means a successful login must make an old session
id invalid and create a new one. With this in place, on the next request, the
victim will required to aunthenticate. At this point, the altered session id will
change, and the attacker will not be able to access. Most websites implement
this technique by making sure users authenticate when entering any potentially
sensitive area, such as charging a credit card or deleting the account.
Another useful solution is setting an expiration time on sessions. Sessions that
do not expire give an attacker an infinite amount of time to pose as the real
user. Expiring sessions after, say 30 minutes, gives the attacker a far narrower
window to access the app.
Finally, as we have already covered, another approach is to use HTTPS across
the entire app to minimize the chance that an attacker can get to the session id.
Cross-Site Scripting(XSS)
This type of attack arises when you allow user to input HTML or JavaScript that
ends up being displayed by the site directly.
For instance a website lets you leave a comment on a form that gets displayed
on the site. AS it is just a normal HTML <textarea>, user are free to input
anything into the form. This means that the users can add any raw HTML or
JavaScript and submit it to the server.
If the server side does not do any sanitization of the input, the user input will be
injected into the page contents, and the browser will interpret the javascript and
execute it.
Security 2
Attackers can craft ingeniously malicious HTML and JavaScript and be very
destructive to both the server as well as future visitors of this page. For
example, an attacker can use JavaScript to grab the session id of every future
visitor of this site and then come back and assume their identity. It could
happen silently without the victims ever knowing about it. Note that the
malicious code would bypass the same-origin policy because the code lives on
the site.
Potential solutions for cross-site scripting
One way to prevent this kind of attack is to always sanatize user input.
The second way to guard against XSS is to escape all user input data when
displaying it.
Security 3