HTTP: requests, responses, status codes and headers

HTTP is the protocol by which a browser sends a request and a server replies with a status code (200, 301, 404, 500), headers and a body.

A conversation by the rules

When the browser knows the server’s address (in the last lessons we saw how), it sets up a connection and says its first sentence. The language the conversation runs in is called HTTP (HyperText Transfer Protocol). It’s very simple by design: the client asks, the server answers. Always in that order: the server sends nothing on its own until it’s asked. And the server doesn’t remember what you talked about a minute ago: every request is new to it (programmers call this being stateless).

In the first versions HTTP was plain text that you can read with your eyes. That’s why we can see all of it.

The request

Here is the request a browser sends when you open the services page:

GET /services/ HTTP/1.1
Host: www.example.com
Accept: text/html
Accept-Language: en
User-Agent: Mozilla/5.0 …

The first line says exactly what is being asked: the method (GET, “give”), the path (/services/) and the protocol version. Next come headers: “name: value” pairs that give details. Host names the site that is wanted: hundreds of sites can be tied to one server, and without this header it wouldn’t know whose is wanted. Accept-Language says which language you prefer. User-Agent says what kind of program is asking.

There are two main methods. GET asks to receive something, and that’s how pages and pictures are opened. POST sends something to the server, for example the data of a form. There are others (PUT, DELETE, HEAD), and we’ll meet them in the part on the server.

If a request sends something, after the headers comes a blank line and the body: the data itself.

The response

The server replies on the same pattern:

HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Content-Length: 5120
Cache-Control: max-age=3600

<!doctype html>
<html lang="en"> …

The first line: the version, the status code and its short name. Then headers. Then a blank line and the body: the page itself, a picture or whatever was asked for. The body is what the browser draws.

Try it yourself: choose a method and an address, and the “server” of a small site will answer.

GET /services HTTP/1.1
Host: www.example.com
Accept: text/html
Accept-Language: en
User-Agent: Mozilla/5.0 …

HTTP/1.1 301 Moved Permanently
Location: /services/
Content-Length: 0

Status codes

The code in the response’s first line is the most important thing: it says whether it worked. The numbers are grouped by their first digit:

• 2xx: success. 200 OK: all is well, here is the page.
• 3xx: redirection. Look somewhere else. 301 Moved Permanently: the page has moved for good, and the new address is in the Location header. 302 Found: moved for the time being. 304 Not Modified: nothing has changed since last time, so use your copy from memory.
• 4xx: a request error. You asked for the wrong thing. 404 Not Found: there’s no such page. 403 Forbidden: you may not go there. 405 Method Not Allowed: you can’t address this URL that way. 410 Gone: the page existed and was deliberately removed. 429 Too Many Requests: you’re asking too often.
• 5xx: a server error. It broke on their side, not yours. 500 Internal Server Error: something went wrong. 502, 503, 504: the server is unavailable, overloaded, or didn’t get an answer from another one.

You needn’t memorize them all. It’s enough to remember the groups: a two is good, a three is go there, a four is your mistake, a five is our mistake.

Headers worth knowing

There are many headers, and the full list is huge. These are the ones that will be useful first:

• Content-Type: what is in the response body (text/html, image/png, application/json) and in which encoding.
• Location: where the page moved to, with the codes 301 and 302.
• Cache-Control: how long a response may be kept in memory so it doesn’t have to be asked for again. This speeds up repeat visits.
• Content-Encoding: whether the response is compressed (gzip or br). A compressed response weighs several times less.
• Set-Cookie and Cookie: this is how a site remembers you between requests, for example that you’re logged in.
• Accept-Language: which language you prefer. A multilingual site can choose the right one by it.

You can look at all these headers yourself. Open the developer tools (F12), the Network tab, reload the page and click any request: you’ll see exactly what we’ve been talking about, with real values.

The versions of HTTP

Over its life the protocol was updated, but the meaning stayed the same: “request, response, codes, headers”. HTTP/1.1 (1997) was text-based and opened several connections. HTTP/2 (2015) became binary and lets many requests share one connection. HTTP/3 (2022) replaced TCP with a new transport, QUIC, which runs over UDP and recovers faster from loss. Pages don’t change because of this: for a site’s author there’s no difference, and the browser and the server agree on the version themselves. The general rules are written in the document RFC 9110, which is in the sources.

Practice

You’re in the era of 2010. Your site was rebuilt, and the addresses of the sections changed. If you simply throw out the old addresses, every link to them (from search, from social networks, from other people’s emails) will lead to a 404. To avoid that, you set up a redirect: the old address answers with the code 301 and the new address in the Location header.

Fill in the map of moves: for each section of your project, the old address, the new address and the code 301. The sections are filled in from the brief. Then complete the 404 page: explain that there’s no such page, and put in a link to the section that leads to your site’s main action. A person who lands on a 404 shouldn’t be left in a dead end.

What was wrong with 2010

Many sites then answered a request for a missing page with the code 200 and the text “nothing found”: search engines took such pages for real ones. For a person it goes unnoticed, but for a machine it’s a lie. A good 404 page tells the truth in the code and in the text, to the person and to the machine.