What is HTTP? — HyperText Transfer Protocol Explained

What is HTTP? — HyperText Transfer Protocol Explained

Definition

HTTP (HyperText Transfer Protocol) is the foundation protocol of the World Wide Web. It is an application-layer protocol that defines how messages are formatted and transmitted between web clients (browsers) and servers. HTTP follows a client-server request/response model where the client initiates a request and the server responds with the requested resource or an error.

HTTP was developed by Tim Berners-Lee at CERN in 1989 and has evolved through HTTP/1.0, HTTP/1.1, HTTP/2, and HTTP/3.


The Request/Response Model

Every HTTP interaction consists of a request from the client and a response from the server:

HTTP Request

GET /api/users HTTP/1.1
Host: api.example.com
Accept: application/json
Authorization: Bearer abc123
User-Agent: Mozilla/5.0

HTTP Response

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 234
Cache-Control: max-age=3600
Date: Mon, 15 Jun 2026 10:30:00 GMT
 
{"id": 1, "name": "Alice", "email": "alice@example.com"}

Structure Breakdown

Component Request Response
Start Line GET /api/users HTTP/1.1 HTTP/1.1 200 OK
Headers Metadata about the request Metadata about the response
Body Optional data (POST/PUT) Optional resource data

HTTP Methods

HTTP methods (also called verbs) indicate the desired action to be performed on a resource:

Method Purpose Idempotent Safe Has Body
GET Retrieve a resource ✅ ✅ ❌
HEAD Retrieve headers only (like GET but no body) ✅ ✅ ❌
POST Create a new resource ❌ ❌ ✅
PUT Replace an entire resource ✅ ❌ ✅
PATCH Partially modify a resource ❌ ❌ ✅
DELETE Remove a resource ✅ ❌ Optional
OPTIONS Describe communication options ✅ ✅ ❌

Idempotent means making the same request multiple times produces the same server state. Safe means the request does not modify server state.

Method Examples

GET    /users          — List users
GET    /users/123      — Get user 123
POST   /users          — Create a new user
PUT    /users/123      — Replace user 123 entirely
PATCH  /users/123      — Update specific fields of user 123
DELETE /users/123      — Delete user 123

HTTP Headers

Headers convey metadata about the request or response:

Request Headers

Header Example Purpose
Host api.example.com Target server (required in HTTP/1.1)
User-Agent Mozilla/5.0 Client software identification
Accept application/json Media types the client can process
Authorization Bearer eyJhbG... Authentication credentials
Content-Type application/json Media type of the request body
Cookie sessionId=abc123 Previously stored cookies

Response Headers

Header Example Purpose
Content-Type application/json; charset=utf-8 Media type of the response body
Content-Length 234 Size of the response body in bytes
Set-Cookie sessionId=abc123; HttpOnly Store a cookie on the client
Cache-Control max-age=3600 Caching directives
Location /users/456 Redirect URL or created resource URI
Access-Control-Allow-Origin * CORS policy

HTTP Status Codes

Status codes indicate the result of the server's attempt to process the request:

1xx — Informational

Code Meaning
100 Continue
101 Switching Protocols (WebSocket upgrade)

2xx — Success

Code Meaning When to Use
200 OK GET, PUT, PATCH succeeded
201 Created POST created a new resource
202 Accepted Request accepted for async processing
204 No Content DELETE succeeded, no body needed

3xx — Redirection

Code Meaning When to Use
301 Moved Permanently Resource has a new permanent URL
302 Found Temporary redirect
304 Not Modified Cached resource is still valid

4xx — Client Error

Code Meaning When to Use
400 Bad Request Invalid syntax, missing fields
401 Unauthorized Missing or invalid authentication
403 Forbidden Authenticated but not authorized
404 Not Found Resource does not exist
405 Method Not Allowed HTTP method not supported
409 Conflict Resource state conflict (duplicate)
422 Unprocessable Entity Semantic validation failure
429 Too Many Requests Rate limit exceeded

5xx — Server Error

Code Meaning When to Use
500 Internal Server Error Unexpected server failure
502 Bad Gateway Upstream server unreachable
503 Service Unavailable Server overloaded or in maintenance
504 Gateway Timeout Upstream server timed out

HTTP/1.1 vs HTTP/2 vs HTTP/3

Feature HTTP/1.1 HTTP/2 HTTP/3
Transport TCP TCP QUIC (UDP)
Multiplexing ❌ (one request per connection) ✅ (multiple streams over one connection) ✅
Header Compression ❌ ✅ (HPACK) ✅ (QPACK)
Server Push ❌ ✅ ✅
Connection Establishment TCP handshake TCP + TLS handshake 0-RTT (typical)
Head-of-Line Blocking Yes (TCP level) Partial (TCP level) No (QUIC eliminates it)
Encryption Optional Required (TLS) Required (TLS 1.3)
Year Introduced 1997 2015 2022
Browser Support Universal 96%+ 95%+

HTTP/2 introduced binary framing, multiplexing, and header compression — significantly improving page load performance without changing application semantics.

HTTP/3 switches from TCP to QUIC (based on UDP), eliminating TCP head-of-line blocking and reducing connection establishment time.


Cookies

Cookies are small pieces of data stored by the browser and sent with every request to the originating server:

HTTP/1.1 200 OK
Set-Cookie: sessionId=abc123; Expires=Wed, 01 Jan 2027 00:00:00 GMT; HttpOnly; Secure; SameSite=Lax
Set-Cookie: theme=dark; Max-Age=31536000; Path=/
Attribute Description
Expires / Max-Age Cookie lifetime
Domain Which domains receive the cookie
Path URL path scope
Secure Only sent over HTTPS
HttpOnly Not accessible via JavaScript (XSS protection)
SameSite Controls cross-site sending (Strict, Lax, None)

Caching

HTTP caching improves performance by reusing previously fetched resources:

Cache-Control Directives

Cache-Control: public, max-age=3600, must-revalidate
Directive Purpose
public Response can be cached by any cache (browser, CDN, proxy)
private Response is for a single user (browser cache only)
no-cache Must revalidate with server before using cached version
no-store Response must not be cached at all
max-age=<seconds> Maximum time the response is considered fresh

ETag Validation

# Request
GET /api/users HTTP/1.1
If-None-Match: "abc123"
 
# Response (if unchanged)
HTTP/1.1 304 Not Modified
ETag: "abc123"

LangStop HTTP & API Tools