HTTP2

Question 1

What is HTTPS?

Answer 1

HTTPS is a secure version of HTTP, inserting an additional layer between HTTP and TCP called TLS or SSL (Transport Layer Security or Secure Sockets Layer, respectively)

Question 2

In what port does HTTPS work?

Answer 2

443

Question 3

How is a connection established?

Answer 3

resolve IP address from host name via DNS; establish a connection with the server; send a request; wait for a response; close connection

Question 4

Connection: close

Answer 4

tells the server to close the connection after sending the response

Question 5

Server-side Connection Handling

Answer 5

establishing a socket to start listening on port 80 (or some other port); receiving the request and parsing the message; processing the response; setting response headers; sending the response to the client; close the connection if a Connection: close request header was found

Question 6

Different ways a server can collect information for identification and authentication

Answer 6

Request headers: From, Referer, User-Agent; Client-IP; Fat Urls - storing state of the current user by modifying the URL and redirecting to a different URL on each click; each click essentially accumulates state; Cookies

Question 7

Cookies - server side

Answer 7

Cookies allow the server to attach arbitrary information for outgoing responses via the Set-Cookie response header. A cookie is set with one or more name=value pairs separated by semicolon (;), as in Set-Cookie: session-id=12345ABC; username=nettuts

Question 8

Cookies - browser side

Answer 8

Cookies are automatically sent by the browser for each request made to a server, and the browser ensures that only the domain- and path-specific cookies are sent in the request. The request header Cookie: name=value [; name2=value2] is used to send these cookies to the server.

Question 9

Basic Authentication

Answer 9

In Basic Authentication, the server initially denies the client’s request with a WWW-Authenticate response header and a 401 Unauthorized status code. On seeing this header, the browser displays a login dialog, prompting for a username and password.

Question 10

Proxy Authentication

Answer 10

Instead of a web server, the authetication challenge is requested by an intermediate proxy. The proxy sends a Proxy-Authenticate header with a 407 Unauthorized status code. In return, the client is supposed to send the credentials via the Proxy-Authorization request header.

Question 11

Digest Authentication

Answer 11

similar to Basic but uses a more secure hashing function to encrypt the username and password

Question 12

how to make the web application work over HTTPS?

Answer 12

you need to have a working digital certificate deployed on the server. Once the certificate is verified, the SSL handshake is complete and secure transmission is in effect.

Question 13

Certificates information

Answer 13

the certificate issuer
the algorithm used for the certificate
the subject name or organization for whom this cert is created
the public key information for the subject
the Certification Authority Signature, using the specified signing algorithm

Question 14

Private cache

Answer 14

within a browser, caches usernames, passwords, URLs, browsing history and web content. They are generally small and specific to a user

Question 15

Public cache

Answer 15

deployed as caching proxies between the server and client. These are much larger because they serve multiple users. A common practice is to keep multiple caching proxies between the client and the origin-server. This helps to serve frequently accessed content, while still allowing a trip to the server for infrequently needed content.

Question 16

process of maintaining a cache

Answer 16

Receive request message.
Parse the URL and headers.
Lookup a local copy; otherwise, fetch and store locally
Do a freshness check to determine the age of the content in the cache; make a request to refresh the content only if necessary.
Create the response from the cached body and updated headers.
Send the response back to client.
Optionally, log the transaction.

Question 17

responses to help to tune the cache and ensure that stale content is not kept for too long.

Answer 17

If a document hasn’t changed, the server should respond with a 304 Not Modified. If the cached copy has expired, it should generate a new response with updated response headers and return with a 200 OK. If the resource is deleted, it should come back with 404 Not Found