HTTP Protocol Deep Dive

HTTP Methods in Depth

HTTP defines several methods (verbs) that indicate the desired action on a resource.

GET — Read a Resource

GET /api/users/123 HTTP/1.1
Host: api.example.com
Accept: application/json

HTTP/1.1 200 OK
Content-Type: application/json

{
  "id": 123,
  "name": "Alice",
  "email": "alice@example.com"
}

GET is safe (doesn't modify data) and idempotent (same result every time). Browsers cache GET responses.

POST — Create a Resource

POST /api/users HTTP/1.1
Content-Type: application/json

{
  "name": "Bob",
  "email": "bob@example.com",
  "password": "securePass123"
}

HTTP/1.1 201 Created
Location: /api/users/124
Content-Type: application/json

{
  "id": 124,
  "name": "Bob",
  "email": "bob@example.com"
}

POST is not idempotent — sending it twice creates two resources. Returns 201 Created with a Location header.

PUT — Replace a Resource

PUT /api/users/123 HTTP/1.1
Content-Type: application/json

{
  "name": "Alice Updated",
  "email": "alice.new@example.com"
}

PUT replaces the entire resource. If a field is missing, it's set to null/default. Always idempotent.

PATCH — Partial Update

PATCH /api/users/123 HTTP/1.1
Content-Type: application/json

{
  "email": "alice.updated@example.com"
}

PATCH only updates the specified fields, leaving others unchanged.

DELETE — Remove a Resource

DELETE /api/users/123 HTTP/1.1

HTTP/1.1 204 No Content

Returns 204 No Content on success. Idempotent — deleting an already-deleted resource returns the same result.

Idempotency Summary

HTTP Status Codes

Status codes tell the client what happened with their request.

2xx — Success

// Express.js examples
app.get('/api/users/:id', (req, res) => {
  const user = findUser(req.params.id);
  if (!user) return res.status(404).json({ error: 'User not found' });
  res.json(user);  // 200 OK
});

app.post('/api/users', (req, res) => {
  const user = createUser(req.body);
  res.status(201).json(user);  // 201 Created
});

app.delete('/api/users/:id', (req, res) => {
  deleteUser(req.params.id);
  res.status(204).end();  // 204 No Content
});

3xx — Redirection

4xx — Client Error

5xx — Server Error

Common Mistakes

• Using 200 for errors instead of proper 4xx codes
• Returning 401 when you mean 403 (401 = not logged in, 403 = logged in but not allowed)
• Not including error details in the response body

HTTP Headers

Headers carry metadata about requests and responses.

Content Negotiation

# Client sends preferred formats
Accept: application/json
Accept-Language: en-US,en;q=0.9
Accept-Encoding: gzip, deflate, br

# Server responds with actual format
Content-Type: application/json
Content-Encoding: gzip
Content-Language: en-US

Authentication Headers

# JWT Bearer token
Authorization: Bearer eyJhbGciOiJIUzI1NiIs...

# Basic auth (base64 encoded)
Authorization: Basic dXNlcjpwYXNzd29yZA==

# API key (custom header)
X-API-Key: abc123def456

Caching Headers

# Server tells client how to cache
Cache-Control: public, max-age=3600
ETag: "abc123"
Last-Modified: Wed, 21 Sep 2026 10:00:00 GMT

# Client sends conditional request
If-None-Match: "abc123"
If-Modified-Since: Wed, 21 Sep 2026 10:00:00 GMT

# Server responds with 304 if unchanged
HTTP/1.1 304 Not Modified

CORS Headers

# Server allows cross-origin requests
Access-Control-Allow-Origin: https://myapp.com
Access-Control-Allow-Methods: GET, POST, PUT, DELETE
Access-Control-Allow-Headers: Content-Type, Authorization
Access-Control-Max-Age: 86400

# Preflight request (browser sends automatically)
OPTIONS /api/data HTTP/1.1
Origin: https://myapp.com
Access-Control-Request-Method: POST

Security Headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-XSS-Protection: 1; mode=block
Content-Security-Policy: default-src 'self'
Referrer-Policy: strict-origin-when-cross-origin

Cookie Headers

# Server sets a cookie
Set-Cookie: sessionId=abc123; HttpOnly; Secure; SameSite=Strict; Path=/

# Client sends cookie back
Cookie: sessionId=abc123; theme=dark

Key Headers to Know