What is HTTP? — HyperText Transfer Protocol Explained
What is HTTP? — HyperText Transfer Protocol Explained
Definition
HTTP (HyperText Transfer Protocol) is the foundation protocol of the World Wide Web. It is an application-layer protocol that defines how messages are formatted and transmitted between web clients (browsers) and servers. HTTP follows a client-server request/response model where the client initiates a request and the server responds with the requested resource or an error.
HTTP was developed by Tim Berners-Lee at CERN in 1989 and has evolved through HTTP/1.0, HTTP/1.1, HTTP/2, and HTTP/3.
The Request/Response Model
Every HTTP interaction consists of a request from the client and a response from the server:
HTTP Request
GET /api/users HTTP/1.1Host: api.example.comAccept: application/jsonAuthorization: Bearer abc123User-Agent: Mozilla/5.0
HTTP methods (also called verbs) indicate the desired action to be performed on a resource:
Method
Purpose
Idempotent
Safe
Has Body
GET
Retrieve a resource
✅
✅
❌
HEAD
Retrieve headers only (like GET but no body)
✅
✅
❌
POST
Create a new resource
❌
❌
✅
PUT
Replace an entire resource
✅
❌
✅
PATCH
Partially modify a resource
❌
❌
✅
DELETE
Remove a resource
✅
❌
Optional
OPTIONS
Describe communication options
✅
✅
❌
Idempotent means making the same request multiple times produces the same server state. Safe means the request does not modify server state.
Method Examples
GET /users — List usersGET /users/123 — Get user 123POST /users — Create a new userPUT /users/123 — Replace user 123 entirelyPATCH /users/123 — Update specific fields of user 123DELETE /users/123 — Delete user 123
HTTP Headers
Headers convey metadata about the request or response:
Request Headers
Header
Example
Purpose
Host
api.example.com
Target server (required in HTTP/1.1)
User-Agent
Mozilla/5.0
Client software identification
Accept
application/json
Media types the client can process
Authorization
Bearer eyJhbG...
Authentication credentials
Content-Type
application/json
Media type of the request body
Cookie
sessionId=abc123
Previously stored cookies
Response Headers
Header
Example
Purpose
Content-Type
application/json; charset=utf-8
Media type of the response body
Content-Length
234
Size of the response body in bytes
Set-Cookie
sessionId=abc123; HttpOnly
Store a cookie on the client
Cache-Control
max-age=3600
Caching directives
Location
/users/456
Redirect URL or created resource URI
Access-Control-Allow-Origin
*
CORS policy
HTTP Status Codes
Status codes indicate the result of the server's attempt to process the request:
1xx — Informational
Code
Meaning
100
Continue
101
Switching Protocols (WebSocket upgrade)
2xx — Success
Code
Meaning
When to Use
200
OK
GET, PUT, PATCH succeeded
201
Created
POST created a new resource
202
Accepted
Request accepted for async processing
204
No Content
DELETE succeeded, no body needed
3xx — Redirection
Code
Meaning
When to Use
301
Moved Permanently
Resource has a new permanent URL
302
Found
Temporary redirect
304
Not Modified
Cached resource is still valid
4xx — Client Error
Code
Meaning
When to Use
400
Bad Request
Invalid syntax, missing fields
401
Unauthorized
Missing or invalid authentication
403
Forbidden
Authenticated but not authorized
404
Not Found
Resource does not exist
405
Method Not Allowed
HTTP method not supported
409
Conflict
Resource state conflict (duplicate)
422
Unprocessable Entity
Semantic validation failure
429
Too Many Requests
Rate limit exceeded
5xx — Server Error
Code
Meaning
When to Use
500
Internal Server Error
Unexpected server failure
502
Bad Gateway
Upstream server unreachable
503
Service Unavailable
Server overloaded or in maintenance
504
Gateway Timeout
Upstream server timed out
HTTP/1.1 vs HTTP/2 vs HTTP/3
Feature
HTTP/1.1
HTTP/2
HTTP/3
Transport
TCP
TCP
QUIC (UDP)
Multiplexing
❌ (one request per connection)
✅ (multiple streams over one connection)
✅
Header Compression
❌
✅ (HPACK)
✅ (QPACK)
Server Push
❌
✅
✅
Connection Establishment
TCP handshake
TCP + TLS handshake
0-RTT (typical)
Head-of-Line Blocking
Yes (TCP level)
Partial (TCP level)
No (QUIC eliminates it)
Encryption
Optional
Required (TLS)
Required (TLS 1.3)
Year Introduced
1997
2015
2022
Browser Support
Universal
96%+
95%+
HTTP/2 introduced binary framing, multiplexing, and header compression — significantly improving page load performance without changing application semantics.
HTTP/3 switches from TCP to QUIC (based on UDP), eliminating TCP head-of-line blocking and reducing connection establishment time.
Cookies
Cookies are small pieces of data stored by the browser and sent with every request to the originating server: