---

Introduction

Every time you:

• Open Amazon
• Watch Netflix
• Check Gmail
• Use WhatsApp Web
• Login to your banking application

your browser communicates with a server using HTTP or HTTPS.

For example, when you open:

https://codewithvenu.com

your browser performs several operations:

• Resolves the domain using DNS
• Establishes a TCP connection
• Performs a TLS handshake (HTTPS)
• Sends an HTTP request
• Receives an HTTP response
• Renders the web page

Understanding HTTP and HTTPS is fundamental for every Backend Engineer, Java Developer, and Solution Architect because almost every distributed application relies on these protocols.

---

Learning Objectives

After completing this article, you will understand:

• What is HTTP?
• What is HTTPS?
• HTTP Request Lifecycle
• Client-Server Architecture
• HTTP Methods
• HTTP Status Codes
• Headers
• Cookies
• Sessions
• SSL/TLS
• HTTPS Handshake
• HTTP/2 & HTTP/3
• REST APIs
• Real-world Examples

---

What is HTTP?

HTTP stands for

HyperText Transfer Protocol

It is an application layer protocol used for communication between clients and servers.

Example

Browser

↓

HTTP Request

↓

Server

↓

HTTP Response

↓

Browser

---

Client Server Architecture

flowchart LR
    A[Browser]
    B[Internet]
    C[Spring Boot Server]

    A --> B
    B --> C

    C --> B
    B --> A

---

HTTP Request Lifecycle

flowchart LR
    A[User Types URL]
    B[DNS Lookup]
    C[TCP Connection]
    D[HTTP Request]
    E[Spring Boot]
    F[Database]
    G[HTTP Response]

    A --> B
    B --> C
    C --> D
    D --> E
    E --> F
    E --> G

---

Real-Time Example

Customer visits Amazon.

Customer

↓

www.amazon.com

↓

DNS

↓

Load Balancer

↓

Application

↓

Database

↓

Response

The entire process usually completes within a few hundred milliseconds.

---

HTTP Request Structure

Every HTTP request contains:

Request Line

Headers

Body

Example

GET /products HTTP/1.1

Host: api.codewithvenu.com

Authorization: Bearer JWT_TOKEN

---

HTTP Response Structure

Status Line

Headers

Body

Example

HTTP/1.1 200 OK

Content-Type: application/json

{
  "message":"Success"
}

---

HTTP Methods

Method	Purpose
GET	Retrieve data
POST	Create resource
PUT	Replace resource
PATCH	Update resource
DELETE	Delete resource
OPTIONS	Supported operations
HEAD	Retrieve headers only

---

REST API Example

Retrieve customer

GET /customers/1001

Create customer

POST /customers

Update customer

PUT /customers/1001

Delete customer

DELETE /customers/1001

---

HTTP Status Codes

Code	Meaning
200	Success
201	Created
204	No Content
301	Redirect
400	Bad Request
401	Unauthorized
403	Forbidden
404	Not Found
409	Conflict
429	Too Many Requests
500	Internal Server Error
503	Service Unavailable

---

HTTP Communication Flow

flowchart LR
    A[Client]

    B[Load Balancer]

    C[Spring Boot]

    D[(Database)]

    A --> B
    B --> C
    C --> D

---

Common HTTP Headers

Header	Purpose
Authorization	JWT Token
Content-Type	JSON/XML
Accept	Response Format
Cache-Control	Caching Rules
Host	Requested Domain
User-Agent	Browser Details

---

Cookies

Cookies store information inside the browser.

Example

Session ID

↓

Browser Cookie

Uses

• Login session
• Shopping cart
• Preferences

---

Session Management

flowchart LR
    A[User Login]

    B[Application]

    C[Session ID]

    D[Browser Cookie]

    A --> B
    B --> C
    C --> D

---

What is HTTPS?

HTTPS stands for

HyperText Transfer Protocol Secure

HTTPS is simply

HTTP

+

TLS Encryption

HTTPS protects:

• Passwords
• Credit Cards
• Banking Transactions
• JWT Tokens
• Personal Information

---

HTTP vs HTTPS

HTTP	HTTPS
Plain Text	Encrypted
Port 80	Port 443
Not Secure	Secure
Vulnerable	TLS Encryption
No Certificate	SSL Certificate

---

HTTPS Architecture

flowchart LR
    A[Browser]

    B[TLS Encryption]

    C[Spring Boot Server]

    A --> B
    B --> C

---

SSL/TLS Handshake

Before exchanging data,

HTTPS establishes trust.

flowchart LR
    A[Browser]

    B[Client Hello]

    C[Server Hello]

    D[Certificate]

    E[Session Key]

    F[Encrypted Communication]

    A --> B
    B --> C
    C --> D
    D --> E
    E --> F

---

HTTPS Request Flow

flowchart LR
    A[Browser]

    B[DNS]

    C[TLS Handshake]

    D[HTTP Request]

    E[Application]

    F[HTTP Response]

    A --> B
    B --> C
    C --> D
    D --> E
    E --> F

---

SSL Certificate

An SSL certificate verifies the identity of a website.

Example

https://codewithvenu.com

↓

Certificate

↓

Trusted Website

---

Banking Example

Without HTTPS

Password

↓

Internet

↓

Plain Text

Anyone intercepting the traffic could read the password.

With HTTPS

Password

↓

Encrypted

↓

Only Server Can Read

---

HTTP/1.1

Characteristics

• One request at a time per connection
• Head-of-line blocking
• Text-based protocol

---

HTTP/2

Improvements

• Multiplexing
• Header Compression
• Binary Protocol
• Server Push

flowchart LR
    A[Browser]

    B[Single Connection]

    C[Request 1]

    D[Request 2]

    E[Request 3]

    A --> B
    B --> C
    B --> D
    B --> E

---

HTTP/3

Uses QUIC instead of TCP.

Benefits

• Lower latency
• Faster connection setup
• Better mobile performance
• Reduced packet loss impact

---

REST API Architecture

flowchart TD
    A[Client]

    B[API Gateway]

    C[Authentication]

    D[Spring Boot API]

    E[(Database)]

    A --> B
    B --> C
    C --> D
    D --> E

---

Real-World Example — Amazon

Customer opens Amazon.

Browser

↓

HTTPS

↓

CloudFront

↓

Load Balancer

↓

Spring Boot

↓

Database

All communication is encrypted.

---

Real-World Example — Banking

Money Transfer

flowchart TD
    A[Customer]

    B[HTTPS]

    C[API Gateway]

    D[Payment Service]

    E[(Core Banking)]

    A --> B
    B --> C
    C --> D
    D --> E

HTTPS ensures account numbers and transaction details cannot be read by attackers during transmission.

---

Performance Considerations

HTTP Performance

• Keep connections alive
• Use HTTP/2
• Compress responses
• Use CDN
• Cache static files
• Minimize payload size

---

Monitoring

Monitor

• Request Latency
• Response Time
• TLS Handshake Time
• Error Rate
• HTTP Status Codes
• Active Connections
• Requests Per Second

Tools

• Datadog
• Grafana
• Prometheus
• CloudWatch

---

Common Mistakes

❌ Using HTTP for login pages

❌ Sending passwords in URL parameters

❌ Not validating SSL certificates

❌ Returning incorrect HTTP status codes

❌ Large response payloads

❌ Ignoring connection reuse

---

Best Practices

• Always use HTTPS in production.
• Redirect HTTP traffic to HTTPS.
• Use TLS 1.2 or TLS 1.3.
• Implement HSTS (HTTP Strict Transport Security).
• Compress API responses with GZIP or Brotli.
• Use appropriate HTTP status codes.
• Design RESTful APIs.
• Keep APIs stateless.
• Secure endpoints with OAuth2 and JWT.
• Monitor latency and error rates continuously.

---

Common Interview Questions

What is HTTP?

HTTP is an application-layer protocol used for communication between clients and servers over the web.

---

What is HTTPS?

HTTPS is HTTP secured with TLS encryption, providing confidentiality, integrity, and server authentication.

---

What is the difference between HTTP and HTTPS?

HTTP	HTTPS
Unencrypted	Encrypted
Port 80	Port 443
No certificate	Requires SSL/TLS certificate
Vulnerable to interception	Secure communication

---

Why is HTTPS important?

HTTPS protects sensitive information such as passwords, banking transactions, JWT tokens, and personal data from eavesdropping and tampering.

---

What improvements does HTTP/2 provide?

HTTP/2 introduces multiplexing, header compression, binary framing, and more efficient use of a single connection, resulting in better performance.

---

Summary

HTTP and HTTPS are the foundation of modern web communication. Every browser request, REST API call, and cloud-native application depends on these protocols.

In this article, we covered:

• HTTP fundamentals
• HTTPS and TLS
• Request-response lifecycle
• HTTP methods
• Status codes
• Cookies and sessions
• SSL/TLS handshake
• HTTP/2 and HTTP/3
• REST API architecture
• Real-world banking and e-commerce examples
• Best practices

Understanding HTTP and HTTPS is essential before learning advanced topics such as Load Balancers, Reverse Proxies, API Gateways, Caching, and CDN architectures, as these components all operate on top of these protocols.

---