HTTP vs HTTPS — what actually happens in a request

The HTTP Request-Response Cycle

HTTP (HyperText Transfer Protocol) is the language browsers and servers use to communicate.

Every page load follows this pattern:

Browser - TCP connection > Server
Browser - HTTP Request  > Server
Browser - HTTP Response > Server

Anatomy of an HTTP Request

GET /courses/ai-foundations HTTP/1.1
Host: academyai.co.za
Accept: text/html,application/xhtml+xml
Accept-Language: en-ZA,en;q=0.9
User-Agent: Mozilla/5.0 ...
Cookie: session_id=abc123

Key parts:

• Method: GET (retrieve), POST (submit data), PUT (update), DELETE (remove)
• Path: the resource being requested
• Headers: metadata about the request
• Body: present in POST/PUT requests, contains the submitted data

Anatomy of an HTTP Response

HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Content-Length: 14523
Cache-Control: max-age=3600
Set-Cookie: session_id=abc123; HttpOnly; Secure

<!DOCTYPE html>
<html>...

Key status codes:

HTTPS - HTTP with Encryption

HTTPS adds TLS (Transport Layer Security) encryption to the request-response cycle.

Without HTTPS, every request is transmitted in plain text. Anyone on the same network can read it.

The TLS Handshake:

1. Browser connects to server on port 443
2. Server sends its SSL certificate
3. Browser verifies the certificate against a trusted Certificate Authority
4. Both sides agree on an encryption key (without sending it over the wire)
5. All subsequent communication is encrypted

Key points:

• HTTP uses port 80; HTTPS uses port 443
• The padlock in the browser confirms TLS is active
• Let's Encrypt provides free SSL certificates (covered in Module 6)
• Mixed content (HTTPS page loading HTTP resources) triggers browser warnings