Web Basics
HTTP Protocol
HTTP Request Headers
Explanation
Method + Resource + Protocol
GET: retrieve pages, send parameters(data) in URL.
POST: send parameters(data) in message body like form submissions.
HEAD: similar to GET but without message body.
OPTIONS: list all the supported methods by the web server.
PUT: put files on the server.
DELETE: delete files from the server.
TRACE: print the request back in the response body for debugging purposes.
Domain name of the server like example.com or example.com:8080
Name of the web browser used
Media types that are acceptable for the response
List of acceptable human languages for the response
List of acceptable encoding for the response
Control options for the current connection like close or keep-alive
HTTP Response Headers
Explanation
Protocol + Status-Code
1xx: Information
2xx: Success
3xx: Redirect
4xx: Resource not found or Unauthorized
5xx: Internal server error
The date and time that the message was sent
Name of the web server
The MIME type of this content
The length of the response body
Control options for the current connection like close or keep-alive
Reference: https://en.wikipedia.org/wiki/List_of_HTTP_header_fields
HTTP Cookies
Explanation
Content: PHPSESSID=7145drfkb8tmhjetbh56qgtjo3;
Expire: 13 Mar 2019, IF NOT EXIST will expire when browser closed.
Domain: google.com IF NOT EXIST will be the target host only (127.0.0.1).
Path: /blog which means (/blog and /blog/folder1 and /blog/folder1/file.html)
HTTPONLY: access through http only not javascript.
Secure: access through https only not http.
Note about Cookies Domain:
Cookies for y.z.com domain will be applicable to y.z.com and x.y.z.com and a.x.y.z.com.
Domain like x.y.z.com can set cookies for itself and it's parents (x.y.z.com and y.z.com).
HTTP Authentication
Basic Authentication
Digest Authentication
HTTPS Protocol
Explanation
Google buy a signed certification from Certificate Authority (CA).
Web browser ask google.com to identify himself.
Google send his certificate and public key to web browser.
Web browser check the certification from CA.
Web browser encrypt session key by the google public key and send it to google.com.
Google decrypt the session key with his private key, and then use that session key to encrypt and decrypt all the messages between him and web browser.
Now the web browser and google.com can encrypt and decrypt all the messages using that key.
Same Origin Policy (SOP)
The same-origin policy is a restrictive cross-origin specification that limits the ability for a website to interact with resources outside of the source domain. The same-origin policy was defined many years ago in response to potentially malicious cross-domain interactions, such as one website stealing private data from another. It generally allows a domain to issue requests to other domains, but not to access the responses.
Must three parts match:
Protocol: http, https
Host: google.com, yahoo.com
Port: 80, 443
Compare this website:
http://www.example.com
Hidden Directories & Files
Last updated