HTTP and HTTPS Basics
Understand request/response structure, TLS handshake, and why HTTPS matters for security.
HTTP and HTTPS Basics is a free Cyber Security Academy lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
What is HTTP?
HTTP (Hypertext Transfer Protocol) is the foundation of web communication. It defines how browsers request resources from servers and how servers respond. HTTP is stateless — each request is independent.
HTTP Request Structure
An HTTP request has:
- Method: GET, POST, PUT, DELETE, PATCH, OPTIONS
- URL: the resource path
- Headers: metadata (Content-Type, Authorization, User-Agent)
- Body: data sent with POST/PUT requests
GET /api/users HTTP/1.1
Host: example.com
Authorization: Bearer eyJhbGc...HTTP Response Structure
An HTTP response includes:
- Status code: 200 OK, 301 Redirect, 401 Unauthorized, 403 Forbidden, 404 Not Found, 500 Server Error
- Headers: Content-Type, Set-Cookie, CORS headers
- Body: HTML, JSON, or other content
HTTP Methods and Security
HTTP methods and their security implications:
- GET — should be read-only; parameters in URL are logged
- POST — sends data in body; not inherently secure
- PUT/DELETE — must be protected by authentication
- OPTIONS — reveals allowed methods; can expose misconfiguration
What HTTPS Adds
HTTPS = HTTP + TLS encryption. It provides:
- Encryption: data in transit is encrypted (confidentiality)
- Integrity: tampering detected via MAC
- Authentication: server identity verified via certificate
Without HTTPS, all data including passwords and session tokens is visible to network eavesdroppers.
TLS Handshake Overview
When connecting to an HTTPS site:
- Client sends supported cipher suites
- Server sends certificate and chosen cipher
- Client verifies certificate against trusted CAs
- Key exchange establishes shared session key
- Encrypted communication begins
HTTP Security Headers
Important security response headers:
- Strict-Transport-Security (HSTS) — force HTTPS
- Content-Security-Policy (CSP) — control what resources load
- X-Frame-Options — prevent clickjacking
- X-Content-Type-Options — prevent MIME sniffing
Cookies and Sessions
HTTP is stateless, so sessions are tracked via cookies. Secure cookie attributes:
- HttpOnly — not accessible via JavaScript (prevents XSS theft)
- Secure — sent only over HTTPS
- SameSite=Strict/Lax — prevents CSRF attacks
HTTPS Does Not Mean Safe
HTTPS only encrypts the channel, not the content. A phishing site can use HTTPS (the padlock icon) while hosting malicious content. HTTPS confirms the server's identity, not the server's trustworthiness.
HTTP/2 and HTTP/3
Modern HTTP versions improve performance:
- HTTP/2 — multiplexing, header compression, server push over TLS
- HTTP/3 — uses QUIC (UDP-based) for lower latency, especially on mobile
Both require TLS. Security implications are similar to HTTP/1.1 but attack surface shifts slightly.
Inspecting HTTP Traffic
Tools for analyzing HTTP:
- Burp Suite — intercept and modify requests/responses
- curl — send requests from command line
- Wireshark — capture raw traffic (HTTP visible; HTTPS encrypted)
curl -v https://example.com
curl -X POST -H "Content-Type: application/json" -d '{"user":"test"}' https://api.example.com/loginQuick Check: HTTP and HTTPS
Which HTTP cookie attribute prevents the cookie from being accessed by JavaScript, protecting it from XSS theft?
Lesson Recap
HTTP is the foundation of web communication. HTTPS adds TLS encryption, integrity, and server authentication. Security headers harden web applications. Cookies must be flagged HttpOnly, Secure, and SameSite. Remember: HTTPS encrypts the channel but does not guarantee a site is trustworthy.
Frequently asked questions
Is the “HTTP and HTTPS Basics” lesson free?
Yes — the full text of “HTTP and HTTPS Basics” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.
What will I learn in “HTTP and HTTPS Basics”?
Understand request/response structure, TLS handshake, and why HTTPS matters for security. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Cyber Security Academy?
No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “HTTP and HTTPS Basics” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Cyber Security Academy lesson?
Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.