1 HTTP Messages Herng-Yow Chen

2 Outline The Flow of Messages The Parts of a Message The various methods that request message support The various status codes that are returned with response message What the various headers do

3 Messages Commute Inbound to the Origin Server proxy1proxy2proxy3 GET /index.html http/1.0 HTTP/ ok Content-type: text/html … Inbound(to server) Outbound(to user agent) client server

4 All messages flow downstream proxy1 proxy2 proxy3 proxy1 proxy2 proxy3 No messages ever go upstream Request(flowing downstream) Response(flowing downstream) client server

5 The Parts of a Message HTTP/ ok Content-type: text/plain Content-length: 19 Hi I ’ m a message Start line Headers Body clientserver

6 Request Message Syntax

7 Response Message Syntax Note that version numbers are not treated as fractional numbers. That is, HTTP/1.22 is higher version than HTTP/1.3.

8 Message Syntax client GET /pics/hychen.jpg HTTP/1.0 Host: HTTP/ OK Content-type: image/jpeg Content-length: HTTP request message contains The command and the URI HTTP response message contains The result of the transaction Internet

9 Message Syntax (a)Request message (b)Response message GET /test/hi-here.txt HTTP/1.1 Accept: text/* Host: HTTP/ ok Content-type: text/plain Content-length: 19 Hi! I ’ m a message! Start line Headers Body

10 Common HTTP method MethodMessage body? GETNo HEADNo POSTYes PUTYes TRACENo OPTIONSNo DELETENO

11 Status code Overall rangeDefine rangeCategory informational successful redirection client error server error Common status codes 200OK 401Unauthorized 404Not found

12 Headers HTTP head field add additional information to request and response messages. They are basically just lists of name/value pairs. HTTP specification defines several header fields. Applications also are free to invent their own home-brewed headers. Each HTTP has a simple syntax: a name, followed by a colon (:), followed by optional whitespace, followed by field value, followed by CRLF.

13 Header classification General headers Can appear in both request and response message Request headers Provide more information about the request Response headers Provide more information about the response Entity headers Describe body size and contents, or the resource itself Extension headers New headers that are not defined in the specification

14 Common header examples Header example Date: Tue, 3 Oct :16:03 GMT Content-length: Content-type: image/gif Accept: image/gif, image/jpeg, text/html Header continuation lines Long header lines can be made more readable by breaking them into multiple lines, preceding each extra line with at least one space or tab character. For example, Server: Test Server Version 1.0

15 Entity bodies The third part of an HTTP message is the optional entity body. Entity bodies are the payload of the HTTP messages. HTTP message can carry many kinds of digital data: images, video, HTML documents, software applications, credit card transactions, electronic mail, and so on.

16 Version 0.9 Messages client GET /pics/hychen.jpg No version number * The request contained merely the method and the request URL, and * the response contained only the entity. * No version number, no status code, no headers were included.

17 Methods Note that not all methods are implemented by every server. To be compliant with HTTP/1.1, a server need implement only the GET and HEAD methods for its resources. Even when servers do implement all of these common methods (listed in the slide 10), some methods such as DELETE and PUT most likely have restricted use. The restrictions generally are set up in the server’s configuration, so they are vary from site to site and from server to server.

18 GET GET /~hychen/index.html HTTP/1.1 Host: Accept: * client Request message HTTP/ ok Content-Type: text/html Content-Length: 617 Home Page … Response message * The most common method. It usually is used to ask a server to send a resource.

19 HEAD HEAD /~hychen/index.html HTTP/1.1 Host: Accept: * client Request message HTTP/ ok Content-Type: text/html Content-Length: 617 Response message No entity body * It behaves exactly like the GET method, but the server returns only the headers in the response.

20 HEAD No entity body is ever returned. This allows a client to inspect the headers for a resource without having to actually get the resource. Using the header, you can Find out about a resource (e.g., determine its type) without getting it. See if an object exists, by looking at the status code of the response. Test if the resource has been modified, by looking at the headers.

21 PUT PUT /product-list.txt HTTP/1.1 Host: Content-type: text/plain Updated product list coming soon! client Request message HTTP/ Created Location: Content-Type: text/plain Content-Length: 47 Response message Server updates/creates resource ” /prod uct-list.txt ” and writes it to its disk. The PUT method writes documents to a server, in the inverse of the way that GET reads documents from the server.

22 PUT Some publishing systems (e.g. frontpage, dreamwaver) let you create web pages in a local computer and install them directly on a web server via PUT method. The semantics of the PUT method are for the server to take the body of the request and either use it to create a new document named by the requested URL, or, if that URL already exists, use the body to replace it. Because PUT allows you to change content, many web servers require you to log in with a password fore you can perform a PUT.

23 POST PUT is used to deposit data into a resource on the server (e.g., a file). In comparison, the POST method was designed to send input data to the server. In practice, it is used to support HTML forms. The data from a filled-in from typically is sent to a server gateway program to process it.

24 POST POST /check.cgi HTTP/1.1 Host: Content-Type: text/plain Content-Length: 18 item=bandsaw 2647 HTTP/ OK Content-type: text/plain Context-lenght: 37 The bandsaw model 2647 is in stock! client Request message Response message YES! item=bandsaw 2647 Inventory list Inventory check Browser sticks data in entity body of message CGI program

25 TRACE When a client makes a request, that request may have to travel through firewalls, proxies, gateways, or other applications. Each of these has the opportunity to modify the original HTTP request. The TRACE method allows clients to see how its request looks when it finally makes it to the server. The TRACE method is used primarily for diagnostics; i.e., verifying that requests are going through the request/response chain as intended.

26 TRACE client Proxy TRACE /product-list.txt HTTP/1.1 Accept:* Host : Request message TRACE /product-list.txt HTTP/1.1 Host : Accept:* Via:1.1 proxy.ncnu.edu.tw HTTP/ OK Content-type: text/plain Content-length: 96 TRACE /product-list.txt HTTP/1.1 Host: Accept: * Via: 1.1 proxy.ncnu.edu.tw Response message HTTP/ OK Content-type: text/plain Content-length: 96 Via:1.1 proxy.ncnu.edu.tw TRACE /product-list.txt HTTP/1.1 Host: Accept: * Via: 1.1 proxy.ncnu.edu.tw

27 OPTIONS The OPTIONS method asks the server tell us about the various supported capabilities of the web server. Some servers may support particular operations on on particular kinds of objects.

28 OPTIONS client Request message OPTIONS * HTTP/1.1 Host : Accept : * Response message HTTP/ OK Allow: GET, POST, PUT, OPTIONS Context-length: 0 Since the request is for options on all resources, the server just returns the methods it supports for its resources.

29 DELETE The DELETE method asks the server to delete the resource specified by the requested URL. However, the client application is not guaranteed that the delete is carried out. This is because the HTTP specification allows the server to override the request without telling the client.

30 DELETE client Request message DELETE /product-list.txt HTTP/1.1 Host : Response message HTTP/ OK Content-Type: text/plain Content-Length: 54 I have your delete request, will take time to process. File ” product-list.txt ” removed from server ’ s disk

31 Extension Methods HTTP was designed to be field-extensible, so new features wouldn’t cause older software to fail. Extension Method are method that are not defined in HTTP/1.1 specification. They provide developers with a means of extending the capabilities of the HTTP services their servers implement on the resources that the servers manage.

32 WebDAV HTTP extension MethodDescription LOCKAllows a user to “lock” a resource– for example, you could lock a resource while you are editing it MKCOLAllows a user to create a resource COPY Facilitates copying resources on a server MOVEMoves a resource on a server

33 Status Codes : Informational Status Code Status Code Reason Phrase 100Continue 101Switching Protocols

: success status code Status CodeReason Phrase 200OK 201Created 202Accepted 203Not-Authoritative Information 204Not Content 205Reset Content 206Partial Content

: Redirection Status Code Status codeReason Phrase 300Multiple Choices 301Moved Permanently 302Found 303See other 304Not Modified 305Use Proxy 306(Unused) 307Temporary Redirect

:Redirection Status Codes client Request message Get /pet-products.txt HTTP/1.1 Host: Accept: * Response message HTTP/ OK Location: Content-length: 56 Content-type: text/plain Please go to our partner site, English.csie.ncnu.edu.tw client english.csie.ncnu.edu.tw Request message Get / HTTP/1.1 Host: english.csie.ncnu.edu.tw Accept: * Response message HTTP/ OK Content-type: text/html Content-length: 3307 …

:Redirection Status Codes (cont.) client Request message Get /m_faculty.html HTTP/1.1 Host: Accept: * If-Modified-Since: Wed, Sept :16:00 GMT Has not changed Client has previously requested copy of: client Response message HTTP/ Not Modified … Browswe displays local copy, since the original has not changed since we last requested it

: Client Errors Status Codes Status CodeReason Phrase 400Bad Request 401Unauthorized 402Payment Requested 403Forbidden 404Not Found 405Method Not Allowed 406Not Acceptable 407Proxy Authentication Required 408Request Timeout 409Conflict

: Client Errors Status Codes Status CodeReason Phrase 410Gone 411Length Required 412Precondition Failed 413Request Entity Too Large 414Request URI Too Long 415Unsupported Media Type 416Requested Range Not Satisfiable 417Expectation Failed

: Server Error Status CodeReason Phrase 500Internal Server Error 501Not Implemented 502Bad Gateway 503Service Unavailable 504Gateway Timeout 505HTTP Version Not Supported

41 Headers General headers E.g., Date: Tue, 3 Oct :16:00 GMT Request headers E.g., Accept: */* Response headers E.g., Server: Apache/1.3 Entity headers E.g., Content-Type: text/html; charset=iso-latin-1 Extension headers

42 General Headers HeaderDescription ConnectionAllow clients and servers to specify options about the request/response connection Date MIME-Version TrailerList the set of headers that are in the trailer of a message encoded with the chunked transfer encoding Transfer-Encoding Upgrade Via

43 General caching headers HeaderDescription Cache-ControlUsed to pass caching directions along with the message ProgmaAnother way to pass direction along the message, though not specific caching

44 General caching headers HeaderDescription Cache-ControlUsed to pass caching directions along with the message ProgmaAnother way to pass direction along the message, though not specific caching

45 Request Headers HeaderDescription Client-IP From Host Referer UA-Color UA-CPU UA-Disp UA-OS UA-Pixels User-Agent

46 Accept Headers HeaderDescription Acceptwhat media types Accept-Charset Accept-Encoding Accept-Language TEwhat extension transfer codings are okay to use

47 Request Headers HeaderDescription Client-IP From Host Referer UA-Color UA-CPU UA-Disp UA-OS UA-Pixels User-Agent

48 Accept Headers HeaderDescription Acceptwhat media types Accept-Charset Accept-Encoding Accept-Language TEwhat extension transfer codings are okay to use

49 Conditional requester headers HeaderDescription Expect If-Match If-Modified-Since If-None-Match If-Range If-Unmodified-Since Range

50 Request security headers HeaderDescription Authorization Cookie Cookie2

51 Proxy request headers HeaderDescription Max-Forwards Proxy-Authorization Proxy-Connection

52 Response headers HeaderDescription Age Public Retry-After Server Title Warning

53 Negotiation headers HeaderDescription Accept-Ranges Vary

54 Response security headers HeaderDescription Proxy-Authenticate Set-Cookie Set-Cookie2 WWW-Authenticate

55 Entity Headers HeaderDescription Content-Base Content-Encoding Content-Language Content-Length Content-Location Content-MD5 Content-Range Content-Type

56 Entity caching headers HeaderDescription ETag Expires Last-Modified

57 HTTP protocol information The W3C architecture page for HTTP. RFC 2616, “Hypertext Transfer Protocol- HTTP/1.1”, is the official specification for HTTP/1.1, the current version of the HTTP protocol.