HTTP: how browsers and servers talk
Lesson 3 of 3
3HTTP: how browsers and servers talk
The big pictureEvery image, every "like" and every login is an HTTP request and a reply. Understand this conversation and you understand the whole web.
What the picture shows: One request, one reply. The request says "what I want"; the reply starts with a code saying "how it went", then the content.
Map of this part
The concepts in order, click any one to jump to it:
Two ways into the same idea
Like ordering in a restaurant: you tell the waiter "I want the menu" (GET) or "place my order" (POST). They come back with "here you go" (200), "that dish does not exist" (404) or "the kitchen broke" (500). The waiter does not remember you, so you give your table number every time (the cookie).
HTTP/1.1 is a stateless text protocol: a request line (verb, path, version), headers (Host, Content-Type, Authorization, Cookie), a blank line, then the body. Verbs carry meaning: GET is safe and idempotent, PUT and DELETE are idempotent, POST is not. Codes: 2xx success, 3xx redirect, 4xx client error, 5xx server error. HTTP/2 and 3 change the transport (multiplexing, QUIC over UDP), not the semantics.
Before You Start
🧭From link to page
You know URL parts and the DNS journey.
The Core Idea
1The shape of a request and a reply
Requests and replies are text you can read. This example builds a request, then reads and splits a reply, without any network, so you see every line.
request = (
"GET /menu?lang=ar HTTP/1.1\r\n"
"Host: cafe.example\r\n"
"Accept: application/json\r\n"
"\r\n"
)
print(request.splitlines()[0])
reply = 'HTTP/1.1 200 OK\r\nContent-Type: application/json\r\n\r\n{"items": 3}'
head, body = reply.split("\r\n\r\n", 1)
status = head.splitlines()[0].split(" ", 2)
print("code:", status[1], "| reason:", status[2])
print("body:", body)2Verbs: what you want to do
GET read, POST create, PUT replace, PATCH change part, DELETE remove. Opening a page is GET; submitting a sign-up form is usually POST. Never change data with GET, because browsers and search engines repeat it freely.
3Status codes
The first digit tells the story: 2xx fine (200 OK, 201 Created), 3xx go elsewhere (301, 302), 4xx your fault (400 bad request, 401 log in, 403 forbidden, 404 not found), 5xx the server's fault (500, 503).
from http import HTTPStatus
for code in [200, 201, 301, 401, 403, 404, 500, 503]:
s = HTTPStatus(code)
print(code, s.phrase, "->", ["", "info", "success", "redirect", "client error", "server error"][code // 100])4Headers and cookies
Headers describe the request: content type (Content-Type), preferred language, who you are (Authorization). HTTP forgets everything between requests, so after login the server sends Set-Cookie and the browser returns it on every later request so the server knows it is you.
Worked example
Problem: a to-do app. Which request for each action? Answer: list tasks GET /tasks → 200. Add a task POST /tasks with a JSON body → 201. Mark done PATCH /tasks/7 → 200. Delete DELETE /tasks/7 → 204. Ask for a missing task GET /tasks/999 → 404. A request without login → 401.
Myth vs Reality
| Myth | Reality |
|---|---|
| HTTPS is a different language from HTTP. | It is exactly HTTP, inside an encrypted TLS tunnel. |
| The server remembers you automatically. | HTTP is stateless. A cookie or token on every request is what makes it "remember". |
Test your understanding
You submitted a form and got 500. Whose fault?
5xx means the server failed to handle a request that may well have been fine.
Which verb fits creating a new account?
POST creates a new resource and usually replies 201.
You are logged in but the admin page returns 403. What does it mean?
403 after login means missing permission, not missing identity.
Quick review cards
Check Your Understanding
Why not delete data with a GET request?
Because GET is assumed safe, so browsers, crawlers and caches may repeat it and delete data by accident.
What is the difference between 401 and 403?
401: your identity is unknown. 403: your identity is known and you lack permission.
How does a site "remember" you logged in?
With a cookie holding a session id that the browser sends with every request, and the server links it to your account.
Resources for this lesson
Grouped by type. Start with the official docs for precision, or an article or video for the explanation.
Official docs2
Done with this lesson?
Sign in to save your progress.