1. Hypertext Transfer Protocol HTTP Photo courtesy: http://www.flickr.com/people/dotbenjamin/ 1

2. B ACKGROUND  HTTP is the protocol used by most web applications  Consists of two primary phases  REQUEST: a client asks a server for information  RESPONSE: the server responds to the clients request  Communication is mostly textual 2

3.  An HTTP Request is a "text message":  REQUEST LINE: three parts separated by a space: : GET|HEAD|POST|PUT|DELETE : the document being requested : HTTP version of the client: typically HTTP/1.0.  HEADER: Optional lines allowing additional information about the request and/or the client (i.e. browser, operating system, etc.). Each line is a name-value pair.  BODY: Optional lines which must be separated from the header by an empty line  Entire specification: http://www.ietf.org/rfc/rfc1945.txt 3 : … : BODY OF THE REQUEST : … : BODY OF THE REQUEST R EQUEST P HASE

4. R EQUEST LINE :M ETHOD  Usually either GET or POST  POST:  The corresponding URL typically denotes a program to execute rather than a document to retrieve  Generally used to submit HTML FORMS  The message body contains that data to send to the server 4 : … : BODY OF THE REQUEST : … : BODY OF THE REQUEST METHODDescription GETRequest for the resource located at the specified URL HEADRequest for the header of the resource located at the specified URL POSTSends data to the program located at the specified URL PUTSends data to the specified URL DELETEDeletes the resource located at the specified URL

5. URL S YNTAX  Resource type (aka scheme):  Defines the namespace, purpose, and the syntax of the remaining part of the URL.  Case insensitive  Examples: HTTP: A browser will send an HTTP request to example.org using port 80. MAILTO: A browser will usually start an email system with the username and domain in the "to" field. mailto:bob@example.commailto:bob@example.com Others: HTTPS, GOPHER, FTP  Domain: The IP address or textual equivalent (as entered into DNS)  Case insensitive  Example: The domain google.com or IP address 74.125.255.18 The domain charity.cs.uwlax.edu or IP address 138.49.38.235 5 : … : BODY OF THE REQUEST : … : BODY OF THE REQUEST resource_type://username:password@domain:port/path?query_string#anchor

6. URL S YNTAX  Port (optional): if omitted, the default port for the specified scheme is used.  Well-known ports: 21: File Transfer Protocol (FTP) 22: Secure Shell (SSH) 25: Simple Mail Transfer Protocol (SMTP) 80: Hypertext Transfer Protocol (HTTP) used in the World Wide Web 110: Post Office Protocol (POP) 443: HTTP Secure (HTTPS)  Example: http://myvncserver.no-ip.org:5800 will connect to port 5800 of myvncserver.no-ip.org; this port is used by the VNC remote control program and would set up a remote control session.  Path:  The location of the resource.  Case-sensitive (though it may be treated as case-insensitive by some servers).  Query string:  Information that is passed to the web app  Format: n1=v1&n2=v2&…  Example: first_name=John&last_name=Doe.  Anchor: Specifies a location on the page.  Example: http://en.wikipedia.org/wiki/URL#Syntax addresses the beginning of the Syntax section. 6 resource_type://username:password@domain:port/path?query_string#anchor

7. URL E XAMPLES  http://charity.cs.uwlax.edu:352/  resource_type: http  username:password: none  domain: charity.cs.uwlax.edu  port: 352  path: none  query_string: none  anchor: none  http://www.flickr.com/search/?q=flower  resource_type: http  username:password: none  domain: www.flickr.com  port: none (defaults to 80)  path: search  query_string: q=flower  anchor: none 7 resource_type://username:password@domain:port/path?query_string#anchor

8. URL E XAMPLES  http://courage.cs.uwlax.edu:8080/  port: 8080 which is the tomcat default  ftp://apache.cs.utah.edu/apache.org  resource_type: ftp  http://charity.cs.uwlax.edu/cs120/#grades  anchor: grades  http://en.wikipedia.org/wiki/Www#Web_Servers  anchor: Web_Servers 8 resource_type://username:password@domain:port/path?query_string#anchor

9. R EQUEST P HASE :H EADERS 9 Header nameDescription AcceptType of content accepted by the browser (for example text/html). See MIME types Accept-CharsetCharacter set expected by the browser Accept-EncodingData coding accepted by the browser Accept-LanguageLanguage expected by the browser (English by default) AuthorizationIdentification of the browser to the server Content-EncodingType of coding for the body of the request Content-LanguageType of language in the body of the request Content-LengthLength of the body of the request Content-TypeType of content of the body of the request (for example text/html). See MIME types DateDate data transfer starts. ForwardedUsed by intermediary machines between the browser and server FromAllows the client email address to be specified FromMakes it possible to specify that the document must be sent if it has been modified since a certain date. If-modified-sinceAllows caching of pages and resends the page if modified since caching took place Orig-URLURL from which the request originated RefererLink URL from which the request has been made User-Agent String giving information about the client, such as the name and version of the browser and the operating system OTHERSThese are some of the more common headers – others do exist. <HEADER>:<SP><Value><NL>…<HEADER>:<SP><Value><NL> BODY OF THE REQUEST <HEADER>:<SP><Value><NL>…<HEADER>:<SP><Value><NL> BODY OF THE REQUEST

10. R EQUEST E XAMPLES GET www.foobar.edu/index.html HTTP/1.0 Accept: text/html If-Modified-Since: Saturday, 15-January-2000 14:37:11 GMT User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 95) GET www.foobar.edu/index.html HTTP/1.0 Accept: text/html If-Modified-Since: Saturday, 15-January-2000 14:37:11 GMT User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 95) GET /index.html HTTP/1.1 Host: charity.cs.uwlax.edu GET /index.html HTTP/1.1 Host: charity.cs.uwlax.edu POST /path/script.cgi HTTP/1.0 From: kenny@hunt.com User-Agent: HTTPTool/1.0 Content-Type: application/x-www-form-urlencoded Content-Length: 38 user=Kenny&creditCard=1234567890123456 POST /path/script.cgi HTTP/1.0 From: kenny@hunt.com User-Agent: HTTPTool/1.0 Content-Type: application/x-www-form-urlencoded Content-Length: 38 user=Kenny&creditCard=1234567890123456 10 :... : BODY OF THE REQUEST :... : BODY OF THE REQUEST

11. R ESPONSE P HASE  An HTTP Response is a collection of textual lines:  STATUS LINE: Made up of three elements which must be separated by a space: VERSION – Identical to request version STATUS CODE – three digit code DESCRIPTION – textual description of the code  HEADER: Optional lines allowing additional information about the request. Each line is a name-value pair. The content-type header is required.  BODY: Optional lines which must be separated from the header by an empty line  Entire specification: http://www.ietf.org/rfc/rfc1945.txt 11 : Content-type: text/html : BODY OF THE REQUEST : Content-type: text/html : BODY OF THE REQUEST

12. R ESPONSE P HASE :S TATUS  Status Code  A three digit code  First digit denotes the category 1: Informational 2: Success 3: Redirection 4: Client error 5: Server error 12 : … : BODY OF THE REQUEST : … : BODY OF THE REQUEST

13. R ESPONSE P HASE : S TATUS C ODES CodeMessageDescription 10xInformation messageThese codes are not used in version 1.0 of the protocol 200OKThe request has been accomplished correctly 201CREATEDThis follows a POST command and indicates success, the remaining body of the document indicates the URL where the newly created document must be located.URL 202ACCEPTEDThe request has been accepted, the procedure which follows has not been accomplished 203PARTIAL INFORMATIONWhen this code is received in response to a GET command it indicates that the response is not complete. 204NO RESPONSEThe server has received the request by there is no information to send back 205RESET CONTENTThe server tells the browser to delete the content in the fields of a form 30xRedirectionThese codes indicate that resource is no longer in the location specified 301MOVEDThe requested data has been transferred to a new address 302FOUNDThe requested data is at a new URL, but has however maybe been moved since... 303METHODThis means that the client must try a new address, preferably by trying another method to GETGET 304NOT MODIFIED If the client has carried out a conditional GET command (by requesting if the document has been modified since the last time) and the document has not been modified it sends back this code. 40xError due to the clientThese codes indicate that the request is incorrect 400BAD REQUESTThe syntax of the request is badly formulated or is impossible to satisfy 401UNAUTHORIZED The parameters of the message give specifications of unacceptable forms of authorisation. The client must reformulate its request with the correct authorisation data 403FORBIDDENAccess to the resource is quite simply denied 404NOT FOUNDClassic! The server has not found anything at the specified address. Left without leaving a forwarding address....:) 50xError due to the serverThese codes indicate that there is an internal error in the server 500INTERNAL ERRORThe server has encountered an unexpected condition which prevented it from following up the request (just one of those things that happen to servers...) 501NOT IMPLEMENTEDThe server does not support the service requested (it cannot know everything...) 13

14. C ONTENT -T YPE  The content-type indicates what kind of document is being delivered.  text/html  image/png  application/msword  audio/x-mpeg  The server is responsible for generating this header 14

15. R ESPONSE EXAMPLE HTTP/1.1 200 OK Date: Tues, 18 May 2004 16:45:13 GMT Server: Apache (Red-Hat/Linux) Last-modified: Tues, 18 May 2004 16:38:38 GMT Etag: "841fb-4b-3d1a0179" Accept-ranges: bytes Content-length: 364 Connection: close Content-type: text/html, charset=ISO-8859-1 12345678901234567890… HTTP/1.1 200 OK Date: Tues, 18 May 2004 16:45:13 GMT Server: Apache (Red-Hat/Linux) Last-modified: Tues, 18 May 2004 16:38:38 GMT Etag: "841fb-4b-3d1a0179" Accept-ranges: bytes Content-length: 364 Connection: close Content-type: text/html, charset=ISO-8859-1 12345678901234567890… 15

16. HTTP S ECURITY  Obviously – insecure  Aspects of security  Privacy – Nobody should be able to obtain my credit card number when sent from client to server  Integrity – Nobody should be able to modify my credit card number when sent from client to server  Authentication – The clients identity should be correct  Nonrepudiation – Neither client nor server should be able to deny receipt of message or sending of message  Encryption solves the first two issues – encrypted messages are private (can’t be understood without the key) and insures integrity (can’t modify the message without the key) 16