5. Understanding HTTP for backend engineers, where it all starts

Overview

The video gives a backend-focused overview of HTTP’s main components and how they work together, with practical demonstrations of browser requests and responses.

Client–server model and statelessness

HTTP follows a client–server model: clients initiate requests, and servers return responses. HTTP is stateless, so each request must include the information needed to process it, such as credentials. Cookies, sessions, and tokens can provide continuity between requests. Statelessness can also simplify scaling and distributing traffic across servers.

Connections and HTTP versions

HTTP messages travel over a transport connection. The video describes how connections work across HTTP versions:

• HTTP/1.0: Uses a separate connection for each request.
• HTTP/1.1: Uses persistent connections.
• HTTP/2: Adds multiplexing and binary framing.
• HTTP/3: Uses QUIC over UDP to reduce connection latency and improve behavior under packet loss.

Messages and headers

Requests and responses contain a start line, headers, a blank line, and sometimes a body. Headers are key–value metadata that help clients and servers interpret messages and control behavior.

The video covers request and general headers, representation-related headers such as Content-Type and Content-Encoding, and security headers such as HSTS and Content Security Policy. Headers make HTTP extensible and can influence content selection, caching, and authentication.

Methods and idempotency

The video explains common HTTP methods:

• GET retrieves data.
• POST commonly creates data.
• PATCH makes a partial update.
• PUT replaces a resource.
• DELETE removes a resource.

Idempotency means that repeating an operation has the same intended effect as performing it once. GET, PUT, and DELETE are generally idempotent, while POST is generally not.

CORS and OPTIONS

Browsers enforce the same-origin policy. For cross-origin requests, servers can permit access using CORS response headers. Some requests can be sent directly; others trigger a browser-generated preflight OPTIONS request. The browser checks the server’s allowed origins, methods, and headers before sending the actual request.

A Burp Suite demonstration shows both a successful CORS exchange and a request blocked when the required response header is absent.

Status codes

Status codes provide a standardized summary of a request’s outcome:

• 1xx: Informational
• 2xx: Success
• 3xx: Redirection
• 4xx: Client errors
• 5xx: Server errors

The video discusses common examples, including 200, 201, 204, 301, 302, 304, 400, 401, 403, 404, 405, 409, 429, 500, 502, 503, and 504. A demonstration shows representative responses.

Caching

HTTP caching can reduce repeat downloads, bandwidth use, and server load. The demonstration covers Cache-Control, ETag, and Last-Modified, along with conditional request headers such as If-None-Match and If-Modified-Since.

If the resource has not changed, the server can return 304 Not Modified, allowing the client to reuse its cached copy.

Content negotiation and compression

Clients can express preferences with headers such as Accept, Accept-Language, and Accept-Encoding. The server can respond with a suitable media type, language, or supported compression format.

A demonstration compares a compressed response using gzip with an uncompressed response to show the potential reduction in transfer size.

Persistent connections and large transfers

HTTP/1.1 connections are persistent by default unless closed, allowing multiple requests and responses to reuse a connection. The video also demonstrates sending files with multipart/form-data and receiving a large response as a stream of chunks.

HTTPS and TLS

SSL is described as obsolete and superseded by TLS. HTTPS is HTTP protected by TLS, which encrypts data in transit and uses certificates to authenticate the server.

Demonstrations and Practical Guides

1. CORS with Burp Suite: Inspecting request and response headers for simple and preflight requests, and observing how browsers handle missing CORS permission.
2. Status codes: Sending example requests and examining their responses.
3. HTTP caching: Comparing initial, unchanged, and updated resource requests using validators and 304 responses.
4. Content negotiation and compression: Changing language, media type, and encoding preferences, then comparing compressed and uncompressed response sizes.
5. File transfer and streaming: Inspecting a multipart file upload and a large response delivered in chunks.

Main Speaker and Sources

• Main speaker: The video’s instructor, from the Sriniously channel.
• Demonstration tool: Burp Suite, used to inspect HTTP traffic.