HTTP — Requests and Responses
Packets get bytes to your server, but the bytes need a shared language. When a shopper opens book 42, the browser and your backend have a short, strictly structured conversation. That language is HTTP, and almost everything a backend developer builds is an answer to an HTTP request.
The rule
The client asks with a method and path; the server answers with a status.
A request has a method, a path, headers and sometimes a body:
GET /books/42 HTTP/1.1
Host: bookshop.example
Accept: application/jsonA response has a status code, headers and usually a body:
HTTP/1.1 200 OK
Content-Type: application/json
{"id": 42, "title": "The Salt Road", "price": 399}The method says what the client wants to do:
| Method | Meaning |
|---|---|
| GET | read something, change nothing |
| POST | create something, or trigger an action |
| PUT | replace something completely |
| PATCH | change part of something |
| DELETE | remove something |
Headers are Name: value lines about the message, such as Content-Type (what format the body is in) or Authorization (who is asking).
The status code is a three-digit verdict, and its first digit tells you the family:
- 2xx success:
200 OK,201 Created,204 No Content - 3xx go elsewhere:
301 Moved Permanently,304 Not Modified - 4xx the client got something wrong:
400 Bad Request,401 Unauthorized,404 Not Found - 5xx the server failed:
500 Internal Server Error,503 Service Unavailable
HTTP is stateless: each request must carry everything the server needs, because the server does not remember the previous one by itself. Logins work by sending a cookie or token again with every request. HTTPS is the same HTTP carried inside an encrypted TLS connection.
The shortcut
To read any exchange, look at just two things: the method tells you the intent, the first digit of the status tells you whose problem it is. A 4 points at the request, a 5 points at the server.
Read the method
POST /orders— the client wants to create a new order.
A trap is replying 200 OK with a body like {"error": "out of stock"}. Every tool that reads status codes will think the request succeeded. Let the status tell the truth.
Drills
Answer fast — trust the rule.
Which method should fetch the list of books without changing anything?
A client sends a body that is not valid JSON and gets 400. Whose side must fix it?
Your code throws an unhandled exception while handling a request. Which status does the client most likely see?
What does it mean that HTTP is stateless?
Remember
- The client asks with a method and path; the server answers with a status.
- Method = intent. First digit of the status: 2 success, 3 elsewhere, 4 client's fault, 5 server's fault.
- Never hide an error inside a
200; the status must tell the truth.