Understanding HTTP and HTTPS
A request and a response
A browser sends a request: a method, a path, headers and optionally a body.
GET /login HTTP/1.1
Host: example.com
User-Agent: Mozilla/5.0
Cookie: session=abc123
The server answers with a status code, headers and a body.
HTTP/1.1 200 OK
Content-Type: text/html
Set-Cookie: session=abc123; Secure; HttpOnly; SameSite=Lax
Common methods: GET (read), POST (submit), PUT/PATCH (change), DELETE (remove). Common status codes: 200 OK, 301/302 redirect, 401 unauthenticated, 403 forbidden, 404 not found, 500 server error.
What HTTPS adds
HTTPS wraps HTTP in TLS. TLS 1.3 (RFC 8446) provides:
- Confidentiality — eavesdroppers cannot read the traffic.
- Integrity — tampering is detected.
- Authentication — a certificate issued by a trusted authority proves the server's identity.
Plain HTTP exposes everything, including form passwords — try capturing it in Wireshark or the Cleartext Credentials challenge.
Security-relevant headers and flags
| Setting | Purpose |
|---|---|
Strict-Transport-Security |
Tells browsers to use HTTPS only |
Secure cookie flag |
Cookie sent only over HTTPS |
HttpOnly cookie flag |
Hides the cookie from JavaScript |
SameSite |
Limits cross-site cookie sending (CSRF defence) |
Content-Security-Policy |
Restricts where scripts and resources may load from |
What HTTPS does not do
It does not make a site trustworthy or free of vulnerabilities such as SQL injection or XSS — see web application security fundamentals.
Practise
Open your browser's developer tools, Network tab, and inspect the requests and headers of a site you use.
Related tool: Wireshark
Use techniques only on systems you are authorised to test.