View source for HTTP (HyperText Transfer Protocol)

= HTTP (HyperText Transfer Protocol) =
'''Summary:'''
HTTP is an application‑layer protocol that defines how clients and servers exchange representations. While often described as simple and stateless, real‑world HTTP behaviour is shaped by decades of evolution, intermediaries, infrastructure policy, and layered usage. Understanding HTTP as a '''container protocol''' is essential to designing, publishing, securing, and troubleshooting modern systems.

== Context ==
HTTP was created to transfer documents between machines.
It was not designed to be an application framework, a session manager, or a security system — those concerns emerged later.
Today, HTTP underpins:

Web browsing
APIs and microservices
Cloud control planes
Device management
Media streaming
Enterprise integration

The gap between HTTP’s original intent and its modern usage explains much of its perceived complexity.

== Position in the Stack ==
HTTP operates above the transport layer.
+---------------------------+
| Application (HTTP)        |
+---------------------------+
| Transport (TCP / QUIC)    |
+---------------------------+
| Network (IP)              |
+---------------------------+
| Data Link / Physical      |
+---------------------------+

Key implications:

HTTP does not guarantee delivery (the transport does)
HTTP does not encrypt data (TLS does)
HTTP does not manage long‑term state (applications do)


== Core Concepts ==
=== Request–Response Model ===
HTTP is fundamentally client‑driven.
Client                    Server
  | --- Request --------> |
  | <--- Response ------- |

There is no server‑initiated messaging in classic HTTP.
Everything begins with a request.

=== Methods and Intent ===
HTTP methods express intent, not implementation.

GET – retrieve a representation
POST – submit data or trigger processing
PUT – replace a resource
PATCH – modify a resource
DELETE – remove a resource

Misuse of methods commonly breaks:

caching
retries
intermediaries
security assumptions


=== Status Codes ===
Status codes communicate outcome, not meaning.

2xx – success
3xx – redirection
4xx – client error
5xx – server error

A status code indicates where a failure occurred — not why.

== HTTP as a Container ==
HTTP is best understood as a '''structured container'''.
It defines:

how data is wrapped
how metadata is expressed
how representations are transported

It does not define:

business meaning
processing logic
data validity
security policy


=== The HTTP Envelope ===
An HTTP message consists of three parts:
+----------------------------------+
| Start Line                        |
|----------------------------------|
| Headers                           |
|----------------------------------|
|                                  |
| Body (Representation)             |
|                                  |
+----------------------------------+


The start line expresses intent or outcome
Headers describe the representation
The body carries opaque data

HTTP does not interpret the body.

=== Headers as Metadata ===
Headers describe content — they do not enforce behaviour.
Examples:

Content-Type
Content-Length
Authorization
Cache-Control

Any intermediary may:

inspect headers
rewrite headers
add new headers
ignore headers entirely


=== Nested Containers ===
Modern systems routinely layer containers:
HTTP
 └─ JSON / XML
     └─ Domain Object
         └─ Business Meaning

When something breaks, the key question is:
'''Which container failed?'''

== How HTTP Evolved ==
HTTP evolved in response to real operational pain.
=== HTTP/0.9 – File Transfer ===

No headers
One request per connection
Experimental

=== HTTP/1.0 – Metadata ===

Headers introduced
Status codes
Still connection‑per‑request

=== HTTP/1.1 – Operational Reality ===

Persistent connections
Chunked transfer encoding
Mandatory Host header
Improved caching

HTTP/1.1 remains widely deployed.

=== Intermediaries Become Permanent ===
As the web scaled, intermediaries emerged:

proxies
firewalls
load balancers
CDNs

Modern HTTP behaviour is often shaped more by the path than by the endpoints.

=== HTTP/2 and HTTP/3 ===
Later versions improved transport efficiency:

multiplexing
binary framing
improved connection handling

They did not change HTTP semantics.

== Stateful and Application‑Aware Firewalls ==
Stateful firewalls remember conversations.
Application‑aware firewalls interpret HTTP itself.
They may:

validate methods
inspect headers
block responses
rewrite content
terminate sessions

HTTP may be stateless — infrastructure is not.

== Reverse Proxies ==
A reverse proxy presents itself as the server while forwarding requests upstream.
Client ───► Reverse Proxy ───► Application

Common responsibilities:

service publication
TLS termination
load balancing
authentication
policy enforcement

Reverse proxies are architectural boundaries, not optimisations.

== Forward Proxies, Caching, and Control ==
Forward proxies act on behalf of clients.
Client ───► Proxy ───► Internet

They are used for:

caching
traffic control
policy enforcement
bandwidth management
hotspot and walled‑garden control

HTTP’s descriptive nature makes it an effective policy surface.

== Hotspots and Walled Gardens ==
In controlled networks, HTTP is intercepted and shaped.

DNS is allowed
authentication portals are reachable
other destinations are blocked
access is gradually opened

This is achieved by controlling HTTP flows, not by modifying applications.

== HTTP Across Web 1.0, 2.0, and 3.0 ==
The “Web X.0” labels describe usage patterns, not protocol changes.

'''Web 1.0''' – HTTP delivers documents
'''Web 2.0''' – HTTP carries application messages
'''Web 3.0''' – HTTP underpins services and abstractions

HTTP remains the constant container beneath evolving expectations.

== SOAP: HTTP as a Transport Bus ==
SOAP is an application protocol layered on HTTP.
HTTP
 └─ SOAP Envelope
     └─ XML Payload

SOAP treats HTTP primarily as:

transport
addressing
firewall‑friendly delivery

It prioritises:

contracts
strong typing
formal governance

SOAP did not fail technically — it optimised for enterprise integration rather than browser ergonomics.

== DLNA and HTTP Beyond the Browser ==
DLNA demonstrates HTTP used outside traditional web contexts.

Discovery uses HTTP‑formatted messages over UDP (SSDP)
Control uses SOAP over HTTP/TCP
Media streaming uses HTTP over TCP
RTP over UDP is optional and legacy

DLNA uses HTTP as:

a message grammar
a control channel
a content container


== Common Pitfalls ==

Assuming clients talk directly to servers
Ignoring intermediaries
Treating headers as authoritative
Misusing HTTP methods
Assuming stateless behaviour end‑to‑end

Most HTTP failures are emergent, not local.

== Design & Architecture Considerations ==
=== Scalability ===
Stateless endpoints scale; state moves elsewhere.
=== Security ===
Trust boundaries matter more than encryption alone.
=== Maintainability ===
Explicit contracts and logging at boundaries are essential.
=== Backwards Compatibility ===
Legacy behaviour persists indefinitely.

== Troubleshooting & Diagnostics ==
When HTTP breaks:

inspect raw requests and responses
compare behaviour across paths
log before and after intermediaries
validate container boundaries

HTTP failures are often observable — if you look at the wire.

== Architectural Takeaway ==
HTTP is not just a protocol.
It is:

a container
a negotiation mechanism
a policy surface
a historical artifact
an infrastructural constant

Understanding HTTP means understanding the '''entire path''' it travels.

== Related Topics ==

[[TCP]]
[[TLS]]
[[Reverse Proxies]]
[[API Design]]
[[SOAP]]
[[DLNA]]


== References ==

RFC 9110 – HTTP Semantics
RFC 9112 – HTTP/1.1
RFC 7540 – HTTP/2
RFC 9000 – QUIC