# Introduction to HTTP
The Hypertext Transfer Protocol (HTTP) is the foundational protocol powering data communication across the World Wide Web. Every time you open a web page, submit a form, or interact with a web application, HTTP requests and responses travel between client devices and servers.
From a cybersecurity perspective, understanding how HTTP messages are structured and transmitted is essential for identifying misconfigurations, inspecting traffic, and preventing injection, interception, or tampering attacks.
# What is HTTP?
HTTP is an application-layer, stateless request-response protocol running over TCP/IP (and increasingly QUIC in HTTP/3). Because HTTP was originally designed without encryption, plaintext communication could easily be sniffed or modified by attackers positioned on the network path.
HTTP is inherently stateless. Web applications maintain user sessions using Cookies, Bearer Tokens (JWT), or Session IDs passed in request headers.
# HTTP Request Anatomy
An HTTP request consists of a Request Line (Method, URI, Protocol Version), Headers (Key-Value pairs providing metadata), and an optional Body payload.
POST /api/v1/auth/login HTTP/1.1
Host: api.cyberlearn.academy
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
Content-Type: application/json
Content-Length: 52
Authorization: Bearer eyJhbGciOiJIUzI1NiIsIn...
{
"username": "sec_analyst",
"password": "SecurePassword123!"
}# HTTP Response & Status Codes
Servers respond with a 3-digit status code categorized into distinct ranges:
| Range | Category | Security Implications |
|---|---|---|
| 1xx | Informational | Protocol switching (101 Switching Protocols to WebSocket) |
| 2xx | Success | 200 OK, 201 Created. Successful authentication or resource retrieval. |
| 3xx | Redirection | 301/302 Redirects. Check for Open Redirect vulnerabilities. |
| 4xx | Client Error | 401 Unauthorized, 403 Forbidden, 404 Not Found. Rate-limiting & enumeration. |
| 5xx | Server Error | 500 Internal Server Error. May leak stack traces or debug info. |
# HTTP vs. HTTPS & TLS
HTTPS wraps HTTP communication in a TLS (Transport Layer Security) tunnel. This provides three essential security guarantees: Confidentiality (encryption against eavesdropping), Integrity (tamper detection via message authentication codes), and Authentication (server identity verification via X.509 certificates).
Unencrypted HTTP traffic transmitted over public Wi-Fi or compromised routers can be intercepted and modified via ARP spoofing or DNS spoofing.
# Critical Security Headers
Modern browsers enforce powerful defensive policies based on HTTP response headers set by servers:
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none';" always;
add_header X-Frame-Options "DENY" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;- Strict-Transport-Security (HSTS): Forces browsers to communicate exclusively over HTTPS.
- Content-Security-Policy (CSP): Restricts origins for scripts, styles, images, and frames to mitigate XSS.
- X-Frame-Options: Prevents Clickjacking attacks by blocking framing (DENY or SAMEORIGIN).
- X-Content-Type-Options: Set to 'nosniff' to prevent MIME-type confusion attacks.
- Referrer-Policy: Controls how much referrer metadata is sent in outbound links.
# Common HTTP Vulnerabilities
Flaws in how web applications handle HTTP requests and headers lead to high-impact attacks:
- HTTP Request Smuggling: Desynchronization between frontend proxies and backend servers.
- Cross-Site Scripting (XSS): Injecting malicious scripts rendered in victim browsers.
- Cross-Site Request Forgery (CSRF): Forcing authenticated users to execute unwanted actions.
- Server-Side Request Forgery (SSRF): Coercing servers into sending requests to internal resources.
# Security Best Practices
To safeguard web communication and infrastructure, implement the following baseline controls:
Always enforce TLS 1.3, configure strict CSP and HSTS headers, invalidate session tokens upon logout, and sanitize all request parameters.