[Link]
com/blog/what-are-differences-between-http-https-0#:~:text=HTTPS%20is
%20HTTP%20with%20encryption,uses%20HTTPS%20has%20HTTPS%3A%2F%2F.
What is HTTP?
HTTP stands for Hypertext Transfer Protocol. It is a protocol—or a prescribed order and syntax for
presenting information—used for transferring data over a network. Most information that is sent
over the Internet, including website content and API calls, uses the HTTP protocol.
What is an HTTP request and how does it work?
There are two main kinds of HTTP messages: requests and responses. HTTP requests are generated
by a user's browser as the user interacts with web properties. For example, if a user clicks on a
hyperlink, the browser will send a series of "HTTP GET" requests for the content that appears on
that page. These HTTP requests go to either an origin server or a proxy caching server, and that
server will generate an HTTP response. HTTP responses are answers to HTTP requests.
HTTP requests and responses are sent across the Internet in plaintext. The problem is that anyone
monitoring the connection can read these plaintexts. This is especially an issue when users submit
sensitive data via a website or a web application. This could be a password, a credit card number, or
any other data typed into a form. Essentially, a malicious actor can just read the text in the request
or the response and know exactly what information someone is asking for, sending, or receiving,
and even manipulate the communication.
The answer to above security problem is HTTPS.
HTTPS (HyperText Transfer Protocol Secure)
HTTPS can be used for,
1. encrypting communication
2. authenticating the two communicating parties
HTTPS functions over Port 443. HTTPS stands for Hypertext Transfer Protocol Secure (also
referred to as HTTP over TLS or HTTP over SSL). HTTPS uses TLS (or SSL) to encrypt HTTP
requests and responses, so instead of the plaintext, an attacker would see a series of seemingly
random characters.
HTTPS today uses Transport Layer Security, or TLS. TLS is a network protocol that establishes an
encrypted connection to an authenticated peer over an untrusted network. Earlier, less secure
versions of this protocol were called Secure Sockets Layer, or SSL)
SSL and TLS perform the same function, and TLS is a direct successor and replacement for SSL.
Because of its early ubiquity, “SSL” is frequently used today to generically refer to TLS/HTTPS.
However, all versions of SSL as a protocol are now considered insecure for modern use.
TLS (Transport Layer Security)
TLS uses a technology called public key encryption. A well-known public key cryptographic
algorithm often used with TLS is the Rivest Shamir Adleman (RSA) algorithm. There are two keys,
a public key and a private key.
The public key is shared with client devices via the server's SSL certificate. The certificates are
cryptographically signed by a Certificate Authority (CA), and each browser has a list of CAs it
implicitly trusts. Any certificate signed by a CA in the trusted list is given a green padlock lock in
the browser’s address bar, because it is proven to be “trusted” and belongs to that domain.
Companies like Let’s Encrypt have now made the process of issuing SSL/TLS certificates free.
When a client opens a connection with a server, each machine needs a verified identity. So, the two
devices use the public and private key to agree on new keys, called session keys, to encrypt further
communications between them. All HTTP requests and responses are then encrypted with these
session keys, so that anyone who intercepts communications can only see a random string of
characters, not the plaintext.
In addition to encrypting communication, HTTPS is used for authenticating the two communicating
parties. Authentication means verifying that a person or machine is who they claim to be. In HTTP,
there is no verification of identity—it is based on a principle of trust. But on the modern Internet,
authentication is essential.
Just like an ID card confirms a person's identity, a private key confirms server identity. When a
client opens a channel with an origin server (e.g. when a user navigates to a website), possession of
the private key that matches with the public key in a website's SSL certificate proves that the server
is actually the legitimate host of the website. This prevents or helps block a number of attacks that
are possible when there is no authentication, such as Man-in-the-middle attacks, DNS hijacking,
and domain spoofing.
How HTTPS handles encryption/decryption ?
1. The client contacts the server using a secure URL (HTTPS…)
2. The server sends the client its certificate and public key.
3. The client verifies certificate with a Trusted Root Certification Authority to ensure the
certificate is [Link] client and server negotiate the strongest type of encryption that
each can support.
4. The client encrypts a session (secret) key with the server’s public key, and sends session
key (secret key) back to the server.
5. The server decrypts the client communication with its private key, and the session is
established. Here client communication with server will be success only if the server is able
to decrypt the session key. Inorder to decrypt the session key , private key will be needed by
the server. This private key is unique and only the owner will have it. No hackers will be
able to get this private key and decrypt the session key. So client-server communication will
be secured at this point. So, in overall, both encryption and authentication is achieved by
using HTTPS.
6. The session key (symmetric encryption) is now used to encrypt and decrypt data transmitted
between the client and server. After this point they wont use private and public keys.