Englishবাংলা
SubscribeWrite
Latest
Binary search: patterns, templates and common pitfallsDocker's $250 Cloud Sandboxes credit: what it covers and what it does notTwo pointers and sliding window: patterns with examplesArrays and hash maps: the interview patterns you must knowBig-O notation explained: time and space complexity for interviewsSoftware testing basics: the test pyramid and what to testClean code and code review habits that make you a better developerREST API design best practices: URLs, status codes and errors

HTTP, HTTPS and TLS: what happens when you open a website

Type a URL and a lot happens in under a second. Follow the whole journey and learn the parts you will meet every day.

••3 min read
A request travelling from a browser to a server with a lock

When you open https://example.com/page, several things happen in a fraction of a second. Knowing the steps helps you debug almost any web problem.

The journey of one request

  1. DNS lookup: find the IP address of example.com.
  2. TCP connection: the browser opens a connection to that IP on port 443 (a three-way handshake). HTTP/3 uses QUIC over UDP instead.
  3. TLS handshake: the browser and server agree on encryption, the server proves its identity with a certificate, and both derive keys for the session.
  4. HTTP request: the browser sends the request over the encrypted connection.
  5. HTTP response: the server answers with a status, headers and a body (HTML, JSON, an image).
  6. The browser reads the HTML and requests more files (CSS, scripts, images), repeating much of this, often over the same connection.

What HTTP looks like

A request:

GET /page HTTP/1.1
Host: example.com
User-Agent: Mozilla/5.0
Accept: text/html
Cookie: session=abc123

A response:

HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=3600
Set-Cookie: session=abc123; Secure; HttpOnly; SameSite=Lax

<!doctype html>...

Methods

  • GET: read something. Should not change data.
  • POST: create something or submit data.
  • PUT and PATCH: replace or partly update.
  • DELETE: remove.
  • HEAD and OPTIONS: metadata and capabilities (OPTIONS is used for CORS checks).

Status codes

Range Meaning Examples
2xx Success 200 OK, 201 Created, 204 No Content
3xx Redirect 301 permanent, 302 temporary, 304 Not Modified
4xx Client error 400 Bad Request, 401 Unauthorized, 403 Forbidden, 404 Not Found, 429 Too Many Requests
5xx Server error 500 Internal Error, 502 Bad Gateway, 503 Unavailable, 504 Gateway Timeout

A quick rule: 4xx means the request is the problem, 5xx means the server is. A 502 or 504 usually means a proxy could not get a good answer from the app behind it.

Important headers

  • Content-Type: what the body is.
  • Cache-Control, ETag: how long and whether the response can be reused.
  • Cookie and Set-Cookie: state and sessions.
  • Authorization: credentials or tokens.
  • Location: where a redirect goes.
  • Security headers: Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options.

What HTTPS gives you

HTTPS is HTTP inside TLS. It provides:

  • Confidentiality: others on the network cannot read the traffic.
  • Integrity: the data cannot be changed unnoticed.
  • Authentication: you are talking to the real server, proven by a certificate signed by a trusted certificate authority (CA).

It does not make a site trustworthy or safe by itself. A phishing site can also have HTTPS. The padlock means the connection is private, not that the owner is honest.

Certificates in short

A certificate binds a domain name to a public key. The browser checks that it is signed by a trusted CA, matches the domain and has not expired. Let's Encrypt issues free certificates and renews them automatically.

HTTP versions

  • HTTP/1.1: one request at a time per connection (browsers open several).
  • HTTP/2: many requests multiplexed on one connection, with header compression.
  • HTTP/3: runs over QUIC, which reduces connection delays on poor networks.

Common errors

  • Certificate expired or name mismatch: renew it or fix the domain name.
  • Mixed content: an HTTPS page loads something over plain HTTP, so the browser blocks it.
  • Too many redirects: a redirect loop, often HTTP and HTTPS rules fighting.
  • CORS error: the browser blocked a cross-origin response because the server did not allow it.

Try it yourself

curl -I https://example.com        # response headers only
curl -v https://example.com        # watch the TLS and HTTP exchange

Also open the browser DevTools Network tab to see each request, its timing and headers.

Takeaway: a page load is DNS, then TCP, then TLS, then HTTP. HTTPS gives privacy, integrity and server identity, status codes tell you whose side the problem is on, and curl plus DevTools show you what really happens.

Networking & Cloud series, Part 1 (how the internet works): 3 of 5. Previous: DNS explained: records, resolution and common problems.

Keep reading