HTTP and HTTPS

A request and a response

GET /learn/ HTTP/1.1
Host: pandadevhub.com
User-Agent: curl/8.5
Accept: text/html
Cookie: session=abc123

HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Cache-Control: no-store
Strict-Transport-Security: max-age=31536000; includeSubDomains
Set-Cookie: session=abc123; HttpOnly; Secure; SameSite=Lax

Methods

This is why PandaDev only changes data on POST: a GET link can be prefetched, crawled or embedded in an image tag by an attacker.

Status codes

Headers worth knowing

• Cache-Control: whether and how long responses may be cached.
• Content-Security-Policy: which scripts and styles the browser may load; a strong defence against XSS.
• Strict-Transport-Security: always use HTTPS for this domain.
• Cookie flags HttpOnly (JavaScript cannot read it), Secure (HTTPS only) and SameSite (limits cross-site sending, helping against CSRF).

TLS and certificates

HTTPS is HTTP inside a TLS connection. The certificate proves the server owns the domain; it is signed by a certificate authority your device trusts. Let's Encrypt issues free certificates valid for 90 days, renewed automatically by tools like Certbot or by your platform.

openssl s_client -connect pandadevhub.com:443 -servername pandadevhub.com </dev/null 2>/dev/null \
  | openssl x509 -noout -subject -issuer -dates

Expired certificates are a leading cause of avoidable outages. Monitor the notAfter date.

curl for debugging

curl -I https://pandadevhub.com                 # headers only
curl -v https://pandadevhub.com/api/health      # full conversation, including TLS
curl -L http://pandadevhub.com                  # follow redirects
curl -X POST -H "Content-Type: application/json" -d '{"text":"hi"}' https://api.example.com/v1/echo
curl -w "dns:%{time_namelookup} connect:%{time_connect} tls:%{time_appconnect} total:%{time_total}\n" -o /dev/null -s https://pandadevhub.com

The last command splits a slow request into DNS, TCP, TLS and server time, telling you which layer is slow.

HTTP versions

HTTP/1.1 sends one request at a time per connection. HTTP/2 multiplexes many over one connection. HTTP/3 runs over QUIC (UDP) and handles lossy mobile networks better. Your web server or CDN usually negotiates the best one automatically.

Check yourself

• Why must GET requests never change data?
• What does a 502 mean, compared with a 504?
• Which three cookie flags should session cookies have?