What the Heck is HTTP?

You see it on the front of URLs. You know that it's important to APIs. When you write applications that are connecting to services on other machines you're using it. So you're likely using it in everything you build. But, what the heck is HTTP, really?

In this talk, we'll dive into the mechanics of HTTP starting from requests & responses, diving into nouns & verbs, and going deep into the mechanics of how authentication works over the protocol. Come join us as we learn all about something that most of us use everyday.

This talk was given at Nebraska.Code() 2023.

Transcript

1. What the Heck Is HTTP? Scott McAllister Principal Developer Advocate Nebraska.Code() 2023
2. Protocols @stmcallister
3. Protocols @stmcallister A set of rules or standards to communicate effectively
4. HyperText Transfer Protocol @stmcallister
5. HTTP @stmcallister A set of rules or standards for clients and web servers to communicate effectively
6. HTTP @stmcallister Image source: https://developer.mozilla.org/en-US/docs/Web/HTTP/Overview
7. HTTP @stmcallister Client Server Request
8. HTTP @stmcallister Response Client Server Request
9. HTTP @stmcallister Response Client Server Request
10. © ngrok. All rights reserved. Confidential Information of ngrok Header Body HTTP Message Information about the message Data being sent Method The action being taken. POST, GET, PUT, DELETE @stmcallister HTTP Message
11. HTTP Request @stmcallister GET / HTTP/1.1 Host: demo.ngrokpaperscissors.com User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml
12. HTTP Request @stmcallister GET / HTTP/1.1 Host: demo.ngrokpaperscissors.com User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml Method or Verb
13. HTTP Request @stmcallister GET / HTTP/1.1 Host: demo.ngrokpaperscissors.com User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml Headers
14. HTTP Response @stmcallister HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Content-Length: 32 <h1>App Running on Server 1</h1> Headers
15. HTTP Response @stmcallister HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Content-Length: 32 <h1>App Running on Server 1</h1> Body (or payload)
16. Evolution of HTTP @stmcallister
17. HTTP/0.9 @stmcallister Only GET Requests Response only returned HTML file No Headers No Status Codes
18. HTTP/1 @stmcallister Versioning Headers! Status Codes Content-Type SSL
19. HTTP/1.1 @stmcallister First Standardized Version Reusable Connections Standard REST Relies On Extensions (WebSockets, etc)
20. HTTP/2 @stmcallister Binary rather than Text Multiplexing Messages (Parallel Requests) Encapsulates Messages into Frames
21. HTTP/3 @stmcallister Uses QUIC instead of TCP Lower Latency Packet Loss Detection
22. HTTP Version Adoption @stmcallister Image source: https://radar.cloudflare.com/adoption-and-usage?range=28d
23. Common Headers @stmcallister Content-Type Accept Authorization User-Agent
24. HTTP Messages @stmcallister A lot like Washington, D.C.
25. HTTP Messages @stmcallister Stateless
26. Cookies @stmcallister
27. HTTP Response Codes @stmcallister
28. © ngrok. All rights reserved. Confidential Information of ngrok @stmcallister HTTP Status Codes: 100s — Informative
29. © ngrok. All rights reserved. Confidential Information of ngrok @stmcallister SUCCESS SUCCESS
30. © ngrok. All rights reserved. Confidential Information of ngrok @stmcallister REDIRECTION
31. © ngrok. All rights reserved. Confidential Information of ngrok @stmcallister CLIENT ERRORS
32. © ngrok. All rights reserved. Confidential Information of ngrok @stmcallister CLIENT ERRORS
33. © ngrok. All rights reserved. Confidential Information of ngrok @stmcallister CLIENT ERRORS
34. © ngrok. All rights reserved. Confidential Information of ngrok CLIENT ERRORS MOAR @stmcallister
35. © ngrok. All rights reserved. Confidential Information of ngrok EVEN MOAR CLIENT ERRORS @stmcallister
36. © ngrok. All rights reserved. Confidential Information of ngrok SERVER ERRORS @stmcallister
37. HTTP @stmcallister Response Client Server Request
38. HTTP @stmcallister Response Client Server Request PLAIN TEXT
39. HTTPS TLS @stmcallister Response Client Server Request Encrypted
40. HTTPS @stmcallister Image source: https://developer.mozilla.org/en-US/docs/Web/HTTP/Overview
41. TLS @stmcallister Requires Digital Certificate from Server Generated from Trusted Certificate Authority Public/Private Keys
42. HTTPS TLS Handshake @stmcallister Presents certificate & public key Client Server
43. HTTPS TLS Handshake @stmcallister Presents certificate & public key Client Server Verifies cert. Generates random string. Encrypts with public key.
44. HTTPS TLS Handshake @stmcallister Presents certificate & public key Client Server Verifies cert. Generates random string. Encrypts with public key. Decrypts message with private key. Client and server now have same secret string. Secret string used to generate Session Key
45. Authentication @stmcallister
46. Basic Authentication @stmcallister Client Server GET / HTTP/1.1
47. Basic Authentication @stmcallister Client Server Responds with 401 (Unauthorized) status. WWW-Authenticate header w/ challenge GET / HTTP/1.1
48. Basic Authentication @stmcallister Client Server Responds with 401 (Unauthorized) status. WWW-Authenticate header w/ challenge GET / HTTP/1.1 GET / HTTP/1.1 Authorization: Basic bAs364enc0d3Cr3ds
49. Basic Authentication @stmcallister Client Server Responds with 401 (Unauthorized) status. WWW-Authenticate header w/ challenge GET / HTTP/1.1 GET / HTTP/1.1 Authorization: Basic bAs364enc0d3Cr3ds HTTP/1.1 200 OK
50. OAuth @stmcallister
51. OAuth ❏ Open standard for authorizing secure access on HTTP service ❏ Uses tokens rather than password data to prove identity ❏ Provides “secure delegated access” to client applications ❏ Limits user’s scope of access @stmcallister
52. Resources @stmcallister HTTP Docs on MDN https://developer.mozilla.org/en-US/docs/Web/HTTP What is HTTP and How Does It Work? https://youtu.be/2yfDgnm6eAs Learning ngrok: Inspect and Replay https://dev.to/stmcallister/learning-ngrok-inspect-and-replay-14ge HTTP Status Dogs https://httpstatusdogs.com/ HTTP Status Cats https://httpcats.com/ SSL, TLS, HTTPS Explained https://youtu.be/j9QmMEWmcfo
53. © ngrok. All rights reserved. Confidential Information of ngrok @stmcallister
54. Scott McAllister Speaker, Writer, Coder @stmcallister stmcallister.github.io @stmcallister.bsky.social techhub.social/@stmcallister
55. Thank you