Concept · 10 min read
What is HTTP?
What travels between a browser and a server, and where can it be changed?
HTTP is a text protocol of requests and responses. Understanding the four parts of a request explains proxies, cookies, caching, and half of all web findings.
Anatomy of a request
text
POST /api/v1/items HTTP/1.1 ← method, target, version
Host: app.internal ← routing hint
Cookie: session=abc123 ← state the server issued
Content-Type: application/json ← how to read the body
{"q":"report"} ← bodyResponse status classes
- 1xx informational — mostly invisible except 100 Continue
- 2xx success — 200, 201, 204; 200 does not mean 'correct', only 'handled'
- 3xx redirection — 301 permanent, 302 temporary, 304 cache revalidation
- 4xx client — 401 unauthenticated, 403 not permitted, 404 absent, 429 rate limited
- 5xx server — 500, 502 through a proxy, 503 overloaded
Where a request can be modified
Client → browser extensions → local proxy (Burp, on 127.0.0.1:8080) → OS proxy settings → corporate egress → CDN or load balancer → reverse proxy → application framework. A 'header the server ignores' is usually a header some earlier hop already rewrote.
HTTPS, in one paragraph
HTTPS is HTTP over TLS: encryption plus authentication of the server's certificate, then optionally the client's. The URL, method and headers travel inside the encrypted tunnel; the hostname is visible in the certificate handshake unless encrypted SNI is negotiated. Nothing about HTTPS makes an application secure — it protects the path, not the logic.
Check your understanding
Answer before expanding. If you cannot explain it in one sentence, the section above needs a re-read.
A redirect to /login on every request — what likely happened?Q1
Your session ended. The 302 is a symptom of expired authentication, not a finding about the endpoint.
Why do tools report a path exists when it returns 403?Q2
Existence and permission are separate facts. A 403 confirms the resource is known to the server.
Where this shows up
Tools in the directory whose commands assume this knowledge.