HTTP and HTTPS — The Conversation Your API Has
ASP.NET Core spends its entire life doing one thing: reading HTTP requests and writing HTTP responses. When a phone app asks ReadingRoom for a book, it sends a few lines of text and gets a few lines back. If you can read those lines, you can debug almost any web bug.
The rule
Request: method, path, headers, body. Response: status, headers, body.
A request to ReadingRoom looks like this:
POST /books HTTP/1.1
Host: api.readingroom.example
Content-Type: application/json
{ "title": "Dune", "author": "Frank Herbert" }And the response:
HTTP/1.1 201 Created
Location: /books/7
Content-Type: application/json
{ "id": 7, "title": "Dune", "author": "Frank Herbert" }Methods state intent: GET reads, POST creates, PUT replaces, PATCH changes part, DELETE removes. Status codes group by first digit:
- 2xx success —
200 OK,201 Created,204 No Content - 3xx go elsewhere —
301,302,304 Not Modified - 4xx the client got it wrong —
400 Bad Request,401 Unauthorized,403 Forbidden,404 Not Found - 5xx the server failed —
500 Internal Server Error,503 Service Unavailable
HTTP itself is plain text anyone on the network can read. HTTPS is HTTP inside a TLS connection: encrypted, and the server proves its identity with a certificate. ASP.NET Core templates call app.UseHttpsRedirection() to send plain-HTTP visitors to HTTPS, and dotnet dev-certs https --trust sets up a local certificate.
The shortcut
For any status code, read only the first digit and ask whose fault? 2 → it worked. 4 → the caller must change the request. 5 → the server must be fixed. Then read the rest for detail.
Read the method and path
GET /books/99: the client wants to read book 99.
The trap: returning 200 OK with an error message in the body. Clients, proxies and monitoring all read the status code; tell the truth there.
Drills
Answer fast — trust the rule.
Which method should create a new loan?
The API returns 503. Whose problem is it?
A client sends a book with no title. Which status fits best?
What does HTTPS add on top of HTTP?
Which response fits a successful DELETE /books/7 that sends nothing back?
Remember
- Request: method, path, headers, body. Response: status, headers, body.
- First digit first: 2 worked, 4 caller's fault, 5 server's fault.
- HTTPS is HTTP inside TLS; never report errors with a 200.