{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"cs/http","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/cs/http/","da":"https://cmaintz.github.io/tech-atlas/da/terms/cs/http/"},"term":{"en":"HTTP","da":"HTTP"},"aka":{"en":["Hypertext Transfer Protocol"],"da":["Hypertext Transfer Protocol"]},"domain":["cs"],"cluster":"web","layer":"network","status":"current","era":1991,"summary":{"en":"The request-and-answer rules a web browser and a server follow to fetch pages, pictures and data across the internet.","da":"De regler for forespørgsel og svar, som en webbrowser og en server følger for at hente sider, billeder og data over internettet."},"body":{"formal":{"en":"A protocol in which a client sends a request naming a resource and a method, such as GET or POST, and the server replies with a status code and content. Each request stands alone, so the server keeps no memory between them by itself; newer versions carry the same messages in faster forms.","da":"En protokol, hvor en klient sender en forespørgsel med en ressource og en metode, fx GET eller POST, og serveren svarer med en statuskode og indhold. Hver forespørgsel står alene, så serveren husker ikke selv noget mellem dem; nyere versioner bærer de samme beskeder i hurtigere former."},"plain":{"en":"Like ordering at a counter by slip of paper - you write what you want, hand it over, and get back either the item or a note saying why not.","da":"Som at bestille ved en disk med en seddel - du skriver, hvad du vil have, rækker den over og får enten varen eller en besked om, hvorfor ikke."},"inPractice":{"en":"A citizen clicks an old link to a page on the municipality’s website. The browser sends a GET request, and because the page has since been deleted, the server answers with status 404 instead of the page.","da":"En borger klikker på et gammelt link til en side på kommunens hjemmeside. Browseren sender en GET-forespørgsel, og fordi siden er blevet slettet, svarer serveren med status 404 i stedet for siden."},"whyItMatters":{"en":"Almost everything on the web, from pages to apps talking to each other, travels over it; on its own it is sent as open text that anyone on the route can read or change, which is why HTTPS exists.","da":"Næsten alt på nettet, fra sider til apps, der taler sammen, sendes med protokollen; alene går den som åben tekst, som alle på ruten kan læse eller ændre, og derfor findes HTTPS."}},"deepDive":{"en":"HTTP started as the one-line HTTP/0.9 of 1991 (GET only, no headers), became HTTP/1.0 in RFC 1945 (1996) and HTTP/1.1 in RFC 2068 (1997), RFC 2616 (1999) and the RFC 7230-7235 series (2014). In June 2022 the IETF separated version-independent semantics from wire formats: RFC 9110 (semantics), RFC 9111 (caching), RFC 9112 (HTTP/1.1 message syntax), RFC 9113 (HTTP/2) and RFC 9114 (HTTP/3). HTTP/2, first published as RFC 7540 in 2015, replaced text framing with binary frames multiplexed as streams over one TCP connection and compressed headers with HPACK (RFC 7541), but TCP head-of-line blocking remained. HTTP/3 runs over QUIC (RFC 9000), a UDP-based transport with TLS 1.3 built in and independent streams, and uses QPACK (RFC 9204) for headers.\n\nThe semantics are the stable core. Methods have defined properties: safe methods (GET, HEAD, OPTIONS, TRACE; RFC 9110 §9.2.1) must not request state changes, and idempotent methods (the safe ones plus PUT and DELETE; §9.2.2) may be retried automatically, which is why POST retries need application-level protection. Status codes (§15) fall in five classes; 401 means \"authenticate\" and must carry a WWW-Authenticate challenge, whereas 403 means \"authenticated or not, no\"; 307 and 308 preserve the method on redirect, where 301 and 302 historically let clients switch to GET. Conditional requests use validators: If-None-Match with an ETag yields 304 Not Modified, and If-Match gives optimistic concurrency with 412 Precondition Failed. In caching (RFC 9111), Cache-Control: no-cache still allows storage but forces revalidation; only no-store forbids storage, a frequent misconception.\n\nHTTP is stateless, so state is layered on through cookies (RFC 6265) or credentials in the Authorization header. Many serious attacks target message syntax rather than semantics. Request smuggling exploits disagreement between a front-end proxy and a back-end server about where a message ends, typically Content-Length versus Transfer-Encoding: chunked, which RFC 9112 §6.3 now resolves strictly. CRLF injection enables response splitting, and forged Host headers poison password-reset links and caches. The HTTP/2 Rapid Reset attack (CVE-2023-44487, October 2023) abused rapid stream creation and cancellation with RST_STREAM for record-scale denial of service.\n\nPlain HTTP exposes content and cookies to anyone on the path; https is HTTP over TLS on port 443, and HSTS (RFC 6797) tells browsers never to use the plaintext variant for a host. HTTP should be kept distinct from HTML (a content format it often carries), from the URL (the identifier a request targets) and from REST (an architectural style that uses HTTP's uniform interface).","da":"HTTP begyndte som enlinjes-protokollen HTTP/0.9 i 1991 (kun GET, ingen headere), blev til HTTP/1.0 i RFC 1945 (1996) og HTTP/1.1 i RFC 2068 (1997), RFC 2616 (1999) og RFC 7230-7235-serien (2014). I juni 2022 adskilte IETF den versionsuafhængige semantik fra formaterne på ledningen: RFC 9110 (semantik), RFC 9111 (caching), RFC 9112 (beskedsyntaks for HTTP/1.1), RFC 9113 (HTTP/2) og RFC 9114 (HTTP/3). HTTP/2, første gang udgivet som RFC 7540 i 2015, erstattede tekstformatet med binære frames, der multiplekses som streams over én TCP-forbindelse, og komprimerede headere med HPACK (RFC 7541), men head-of-line blocking i TCP bestod. HTTP/3 kører over QUIC (RFC 9000), en UDP-baseret transport med indbygget TLS 1.3 og uafhængige streams, og bruger QPACK (RFC 9204) til headere.\n\nSemantikken er den stabile kerne. Metoderne har definerede egenskaber: sikre metoder (GET, HEAD, OPTIONS, TRACE; RFC 9110 afsnit 9.2.1) må ikke anmode om tilstandsændringer, og idempotente metoder (de sikre plus PUT og DELETE; afsnit 9.2.2) må gentages automatisk, og derfor kræver gentagne POST-kald beskyttelse på applikationsniveau. Statuskoderne (afsnit 15) falder i fem klasser; 401 betyder \"autentificér dig\" og skal have en WWW-Authenticate-udfordring med, mens 403 betyder \"nej, uanset autentificering\"; 307 og 308 bevarer metoden ved omdirigering, hvor 301 og 302 historisk lod klienter skifte til GET. Betingede forespørgsler bruger validatorer: If-None-Match med en ETag giver 304 Not Modified, og If-Match giver optimistisk samtidighedskontrol med 412 Precondition Failed. I caching (RFC 9111) tillader Cache-Control: no-cache stadig lagring, men kræver genvalidering; kun no-store forbyder lagring, en udbredt misforståelse.\n\nHTTP er tilstandsløs, så tilstand lægges ovenpå via cookies (RFC 6265) eller loginoplysninger i Authorization-headeren. Mange alvorlige angreb rammer beskedsyntaksen snarere end semantikken. Request smuggling udnytter uenighed mellem en front-end-proxy og en back-end-server om, hvor en besked slutter, typisk Content-Length over for Transfer-Encoding: chunked, som RFC 9112 afsnit 6.3 nu afgør strengt. CRLF-injektion muliggør response splitting, og forfalskede Host-headere forgifter links til nulstilling af adgangskoder og caches. HTTP/2 Rapid Reset-angrebet (CVE-2023-44487, oktober 2023) misbrugte hurtig oprettelse og annullering af streams med RST_STREAM til denial of service i rekordstørrelse.\n\nRen HTTP blotlægger indhold og cookies for alle på ruten; https er HTTP over TLS på port 443, og HSTS (RFC 6797) fortæller browsere, at de aldrig må bruge klartekstvarianten for en vært. HTTP skal holdes adskilt fra HTML (et indholdsformat, den ofte bærer), fra URL'en (den identifikator, en forespørgsel går til) og fra REST (en arkitekturstil, der bruger HTTP's ensartede grænseflade)."},"edges":[{"type":"requires","to":"cs/tcp-ip","confidence":"high","strength":"normal"},{"type":"requires","to":"cs/client","confidence":"high","strength":"normal"},{"type":"requires","to":"cs/server","confidence":"high","strength":"normal"},{"type":"kind-of","to":"cs/protocol","confidence":"high","strength":"normal"},{"type":"used-with","to":"cs/url","why":{"en":"Every HTTP request names the resource it wants by its URL.","da":"Hver HTTP-forespørgsel angiver den ressource, den vil have, med dens URL."},"confidence":"high","strength":"primary"},{"type":"used-with","to":"cs/json","confidence":"high","strength":"normal"}],"depth":4,"sources":[{"title":"RFC 9110 - HTTP Semantics","url":"https://www.rfc-editor.org/rfc/rfc9110","tier":"standard","publisher":"IETF"},{"title":"Kurose & Ross, Computer Networking: A Top-Down Approach","tier":"textbook"}],"draft":true}