HTTP Deep Dive

#Mastering the HTTP Protocol#link

In the previous lesson, we traced the lifecycle of a web request. Now we're going to zoom in on the HTTP protocol itself — the language that browsers and servers use to communicate. As a security professional, HTTP is the protocol you'll interact with more than any other. Every vulnerability you test, every exploit you craft, and every defense you implement will involve HTTP in some way.

HTTP Request Structure

An HTTP request consists of a request line, headers, an optional blank line, and an optional body. Let's examine a real request:

POST /api/login HTTP/1.1
Host: www.example.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
Content-Type: application/json
Content-Length: 42
Accept: application/json
Cookie: session_id=abc123def456

{"username": "admin", "password": "s3cret!"}

HTTP Methods

HTTP defines a set of request methods that indicate the desired action to be performed on a resource. Understanding these methods is essential for both building and testing web applications.

HTTP Response Structure

The server's response mirrors the request structure. It includes a status line, headers, and optionally a body:

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 58
Server: nginx/1.18.0
Set-Cookie: session_id=xyz789; HttpOnly; Secure
X-Frame-Options: DENY
Cache-Control: no-store

{"status": "success", "message": "Login successful"}

HTTP Status Codes

Status codes tell the client what happened with their request. They're grouped into five classes:

Critical HTTP Headers for Security

Several HTTP headers exist specifically to enforce security policies. Understanding these is crucial for both attacking and defending web applications:

• ▪Content-Security-Policy (CSP) — Restricts what resources the browser can load
• ▪X-Frame-Options — Prevents clickjacking by controlling iframe embedding
• ▪Strict-Transport-Security (HSTS) — Forces HTTPS connections
• ▪X-Content-Type-Options — Prevents MIME-type sniffing attacks
• ▪Set-Cookie with HttpOnly flag — Prevents JavaScript access to cookies
• ▪Set-Cookie with Secure flag — Cookie only sent over HTTPS
• ▪Access-Control-Allow-Origin — Controls cross-origin resource sharing (CORS)

HTTP vs. HTTPS

HTTP transmits data in plaintext — anyone on the network can read or modify the traffic. HTTPS adds a TLS (Transport Security Layer) encryption layer on top of HTTP, providing confidentiality, integrity, and authentication. In HTTPS, the TLS handshake occurs before any HTTP data is exchanged, ensuring that all subsequent communication is encrypted.