Build a useful mental model of HTTP
Start with what travels between a client and server, then connect that foundation to browsers, intermediaries, caching, and modern HTTP versions. Continue into finalized standards updates or the deeper history of the protocol.
Build the core mental model
Read in order for a complete introduction, or start at a known concept. Each guide names the exact prerequisites to revisit.
Step 1 · beginner
Understand the HTTP request-response cycle
Learn the roles, direction, and observable boundaries of one request and its associated responses.
8 minute lessonStep 2 · beginner
Read HTTP messages without guessing
Read the parts of an HTTP message and know which details are shared across HTTP versions.
9 minute lessonStep 3 · beginner
Choose an HTTP method by its semantics
Choose methods from their defined semantics and understand why retries and redirects treat them differently.
11 minute lessonStep 4 · beginner
Interpret HTTP status codes in context
Use the status class for orientation, then the exact code and request method for the response meaning.
10 minute lessonStep 5 · beginner
Connect HTTP fields to representations
Read HTTP fields as typed metadata and connect selected representations to media types and negotiation.
12 minute lessonStep 6 · intermediate
Predict HTTP redirects and method handling
Predict a redirect by reading its status, Location value, original method, and client behavior together.
11 minute lessonStep 7 · intermediate
Understand HTTP caching and validation
Follow the decisions a cache makes from storage through freshness and validator-based reuse.
15 minute lessonStep 8 · intermediate
Separate cookies, origins, and sites
Keep host and path cookie scope distinct from origin and same-site browser boundaries.
14 minute lessonStep 9 · intermediate
Understand the browser CORS flow
CORS is a browser response-sharing protocol layered on HTTP, not proof that the network request failed.
14 minute lessonStep 10 · intermediate
Find the TLS boundaries around HTTP
TLS protects one connection between peers; trace each termination point before reasoning about end-to-end visibility.
10 minute lessonStep 11 · intermediate
Configure HTTP security headers deliberately
Connect each browser security header to a threat, deployment boundary, and safe verification process before auditing a live response.
16 minute lessonStep 12 · intermediate
Trace HTTP through proxies and CDNs
Treat every intermediary as a possible HTTP peer and identify the hop that produced an observation.
13 minute lessonStep 13 · intermediate
Separate HTTP semantics from protocol versions
HTTP versions carry shared semantics through different framing, compression, multiplexing, and transport mechanisms.
13 minute lesson
Standards watch
Understand current HTTP developments
These articles cover finalized RFCs and material revisions that change how modern HTTP is designed, implemented, or secured.
Current HTTP · intermediate
Parse modern HTTP fields with Structured Fields
Use a field's declared Structured Field type and the standard algorithms instead of splitting modern HTTP field values by hand.
13 minute deep diveCurrent HTTP · intermediate
Verify HTTP content with Digest Fields
RFC 9530 separates digests of conveyed message content from digests of representation data and replaces the older Digest field.
14 minute deep diveCurrent HTTP · advanced
Bind HTTP messages with HTTP Message Signatures
HTTP Message Signatures bind selected HTTP fields and derived components to a key, but applications must define coverage, trust, and freshness.
16 minute deep diveCurrent HTTP · advanced
Wait for HTTP/1.1 protocol transitions before sending untrusted data
HTTP/1.1 clients must treat a requested protocol transition as unconfirmed until the server accepts it, especially when forwarding untrusted data.
13 minute deep diveCurrent HTTP · intermediate
Use the HTTP QUERY method for safe requests with content
Use QUERY when a safe, idempotent operation needs structured request content that does not fit naturally in a URI.
16 minute deep dive
Protocol history
See why HTTP evolved this way
The historical series connects design decisions to the constraints, deployments, revisions, and abandoned ideas that shaped them.
6-part series · 134 minutes
From CERN and HTTP/0.9 to QUIC, HTTP/3, and modern extensions
Follow the original primary documents and RFC lineage, then carry the lessons into newer work such as Structured Fields and QUERY.