Roadmap › Networking & Hosting — How a Website Works, End to End › Module: HTTP and the Browser
Lessons in this course (12)
5. HTTP in depth — methods, status codes, headers, versions
Basic★ Must knowLesson 5 of 12
http
GET /api/orders?page=1 HTTP/1.1
Host: www.shop.com
Accept: application/json
Authorization: Bearer eyJhbGciOi...
Cookie: session=abc123
HTTP/1.1 200 OK
Content-Type: application/json; charset=utf-8
Cache-Control: private, max-age=60
Content-Encoding: br
Set-Cookie: theme=dark; Path=/; Secure; HttpOnly; SameSite=Lax
{"items":[...],"total":42}| Method | Purpose | Safe | Idempotent |
|---|---|---|---|
| GET | Read | ✅ | ✅ |
| POST | Create / action | ❌ | ❌ |
| PUT | Replace | ❌ | ✅ |
| PATCH | Partial update | ❌ | ❌ (usually) |
| DELETE | Remove | ❌ | ✅ |
| HEAD / OPTIONS | Headers only / capabilities (CORS preflight) | ✅ | ✅ |
Status classes: 1xx info, 2xx success (200, 201, 204), 3xx redirect (301 permanent, 302/307 temporary, 304 not modified), 4xx client error (400, 401, 403, 404, 409, 429), 5xx server error (500, 502 bad gateway, 503 unavailable, 504 gateway timeout).
HTTP versions:
| Version | Transport | Key point |
|---|---|---|
| HTTP/1.1 | TCP | Text; one request at a time per connection (browsers open ~6 per host); keep-alive |
| HTTP/2 | TCP + TLS | Binary, multiplexing many requests on one connection, header compression (HPACK) — but a lost TCP packet blocks all streams |
| HTTP/3 | QUIC over UDP | No TCP head-of-line blocking, faster handshake (0-RTT/1-RTT), survives network changes (Wi-Fi → 4G) |
HTTP is stateless — each request stands alone; state is carried by cookies, tokens or server-side sessions.