HTTP and HTTPS

InfrastructureTier 2 · build and shipPhase 1 · Put a page on the internet

The agreed language browsers and servers use to ask for and send things. HTTPS is the same language, encrypted so others cannot read it.

A browser and a server are usually built by different people who never coordinate, so they need one fixed format for asking and answering or nothing would interoperate. HTTP exists to be that shared contract: every exchange is a request and a matching response in an agreed shape. HTTPS exists on top of it because plain HTTP travels as readable text that anyone on the same wifi or along the network path can see, so the encrypted version is now the default and browsers actively warn users away from sites without it.

HTTP is a set of rules: the browser sends a request ("give me the menu page"), the server sends a response (the page, plus a status code saying how it went). Every web interaction is requests and responses in this format.

HTTPS wraps that same conversation in encryption. Without it, anyone between the user and the server, on the same wifi or along the network path, can read everything. The S, and the padlock, mean the connection is private.

Turn HTTPS off and predict what the eavesdropper can read.
Browser
Eavesdropper
Server
What the eavesdropper on the wire reads
Nothing on the wire yet. Send a request to see what leaks at the midpoint.
HTTPS encrypts the same request, so anyone on the network path sees only noise.
A junior PM, stuck

In bug triage the engineer said "the response is fine, it's the request that's wrong," and I nodded, but I could not actually point at which part was the request and which was the response. They are all just lines to me. I also do not really know what the S in HTTPS changes, beyond the padlock.

Two small things, both readable in a few minutes. First, one exchange always has two halves: the request your app sends and the response the server sends back, and there is a clean line between them. Second, the same exchange over plain HTTP versus HTTPS looks completely different to anyone watching the wifi. I captured the menu call both ways so you can see both at once.

GET /api/products, the same exchange over HTTP and over HTTPS
Over HTTP, what a snooper on the cafe wifi reads
1.1
:
: 1
:
1.1 200
:
{ "count": 12, "products": [ { "id": "p_1042", "price": 649 } ] }
Over HTTPS, what the same snooper reads
17 03 03 00 45 2 1 9 3 0 77 14 8 2 5
1 40 6 9 02 7 88 33 51 7 0 96 4 22
5 8 74 10 63 99 2 41 0 3 7 8 26 55 90

Click a step to see the lines it points at.

Debugging the wrong half. If the response JSON is correct but the screen is wrong, the bug is above the seam or in the frontend, not in the server. Naming request versus response first saves a round trip with the wrong team.
Thinking the padlock is cosmetic. It is the difference between the first block and the second on every public wifi. A page that takes a password or a token over plain HTTP is leaking it to everyone nearby.
Reading a mixed-content warning as harmless. It means the page is HTTPS but some piece still loads over HTTP, so that piece is readable and tamperable. It is a real hole, not a style nit.
Assuming HTTPS also means the data is correct or the server is trustworthy. It only means the connection is private. A scam site can serve perfect HTTPS; the S is about eavesdropping, not honesty.

Next time in triage, say it back precisely: "So the response body is correct, the bug is in the request we send, that is our side." You separated the two halves and named which one owns the fix. That is the whole skill, and it is also how you will spot a plaintext leak when it matters.

HTTPS is non-negotiable now. Browsers warn users away from plain HTTP sites, and it affects search ranking.
When engineers talk about "the request" or "the response," this is the layer they mean.

"Mixed content warning, some images are still loading over HTTP."

Appears in Phase 1, Put a page on the internet.