HTTP

HTTP started as the one-line HTTP/0.9 of 1991 (GET only, no headers), became HTTP/1.0 in RFC 1945 (1996) and HTTP/1.1 in RFC 2068 (1997), RFC 2616 (1999) and the RFC 7230-7235 series (2014). In June 2022 the IETF separated version-independent semantics from wire formats: RFC 9110 (semantics), RFC 9111 (caching), RFC 9112 (HTTP/1.1 message syntax), RFC 9113 (HTTP/2) and RFC 9114 (HTTP/3). HTTP/2, first published as RFC 7540 in 2015, replaced text framing with binary frames multiplexed as streams over one TCP connection and compressed headers with HPACK (RFC 7541), but TCP head-of-line blocking remained. HTTP/3 runs over QUIC (RFC 9000), a UDP-based transport with TLS 1.3 built in and independent streams, and uses QPACK (RFC 9204) for headers.

The semantics are the stable core. Methods have defined properties: safe methods (GET, HEAD, OPTIONS, TRACE; RFC 9110 §9.2.1) must not request state changes, and idempotent methods (the safe ones plus PUT and DELETE; §9.2.2) may be retried automatically, which is why POST retries need application-level protection. Status codes (§15) fall in five classes; 401 means "authenticate" and must carry a WWW-Authenticate challenge, whereas 403 means "authenticated or not, no"; 307 and 308 preserve the method on redirect, where 301 and 302 historically let clients switch to GET. Conditional requests use validators: If-None-Match with an ETag yields 304 Not Modified, and If-Match gives optimistic concurrency with 412 Precondition Failed. In caching (RFC 9111), Cache-Control: no-cache still allows storage but forces revalidation; only no-store forbids storage, a frequent misconception.

HTTP is stateless, so state is layered on through cookies (RFC 6265) or credentials in the Authorization header. Many serious attacks target message syntax rather than semantics. Request smuggling exploits disagreement between a front-end proxy and a back-end server about where a message ends, typically Content-Length versus Transfer-Encoding: chunked, which RFC 9112 §6.3 now resolves strictly. CRLF injection enables response splitting, and forged Host headers poison password-reset links and caches. The HTTP/2 Rapid Reset attack (CVE-2023-44487, October 2023) abused rapid stream creation and cancellation with RST_STREAM for record-scale denial of service.

Plain HTTP exposes content and cookies to anyone on the path; https is HTTP over TLS on port 443, and HSTS (RFC 6797) tells browsers never to use the plaintext variant for a host. HTTP should be kept distinct from HTML (a content format it often carries), from the URL (the identifier a request targets) and from REST (an architectural style that uses HTTP's uniform interface).