HTTP & Web Protocols
The HTTP protocol, methods, status codes, caching, and REST.
14 questions
JuniorTheoryVery commonWhat are the main HTTP methods, and GET vs POST for a form?
What are the main HTTP methods, and GET vs POST for a form?
Common methods: GET reads, POST creates, PUT/PATCH update, DELETE removes, HEAD fetches headers. A GET form puts fields in the URL query string (cached, logged); POST sends them in the body, preferred for sensitive data.
Common mistakes
- ✗Thinking
GETputs form data in the body instead of the URL query string - ✗Sending passwords or large uploads via
GETwhere they get logged and cached - ✗Believing only
GETandPOSTexist and ignoringPUT/PATCH/DELETE/HEAD
Follow-up questions
- →Why is
GETconsidered safe and idempotent whilePOSTis neither? - →When would you choose
PUToverPATCHto update a resource?
JuniorTheoryVery commonWhat do the HTTP status code classes 1xx–5xx mean?
What do the HTTP status code classes 1xx–5xx mean?
The first digit groups the semantics: 1xx informational, 2xx success (200), 3xx redirection (301/302), 4xx client error (bad or forbidden request), 5xx server error. A client reads that leading digit to react.
Common mistakes
- ✗Swapping
4xxand5xx— thinking4xxis server error and5xxis client error - ✗Treating
3xxredirects as plain success like2xx - ✗Memorizing individual codes without grasping that the first digit defines the class
Follow-up questions
- →What is the difference between
401and403within the4xxclass? - →Why should a failed validation return
4xxrather than5xx?
JuniorTheoryCommonWhat is HTTP and how is a request/response message structured?
What is HTTP and how is a request/response message structured?
HTTP is a text-based, stateless application-layer protocol over TCP/IP for client-server request/response. Both messages share a start line, key:value headers, a blank line, then an optional body.
Common mistakes
- ✗Calling
HTTPa transport-layer or binary protocol instead of a text-based application-layer one - ✗Assuming
HTTPis stateful and keeps a session without cookies or tokens - ✗Forgetting the blank line that separates headers from the body
Follow-up questions
- →How does
HTTPkeep state across requests if the protocol itself is stateless? - →What does the version field in the start line (
HTTP/1.1vsHTTP/2) change?
JuniorTheoryCommonWhat is the difference between HTTP and HTTPS?
What is the difference between HTTP and HTTPS?
HTTPS is HTTP carried over a TLS (formerly SSL) encrypted connection, so traffic is encrypted, integrity-protected, and the server is authenticated by a certificate. Plain HTTP sends everything in cleartext anyone can read.
Common mistakes
- ✗Thinking
HTTPShides only the URL but leaves headers and body in cleartext - ✗Believing plain
HTTPencrypts data on its own withoutTLS - ✗Treating
HTTPSas an unrelated protocol rather thanHTTPoverTLS
Follow-up questions
- →What does the
TLScertificate prove besides enabling encryption? - →Why is the
Hostheader still visible to a network observer underHTTPS?
MiddleTheoryCommonHow do you redirect a browser to another page over HTTP?
How do you redirect a browser to another page over HTTP?
Return a 3xx status with a Location header naming the target URL — 301 permanent (browsers and SEO cache it) or 302 temporary. The browser then issues a fresh request to that URL, falling back to an HTML link.
Common mistakes
- ✗Using a
200with aLocationheader instead of a3xxstatus for redirects - ✗Swapping
301and302— sending a temporary code for a permanent move - ✗Omitting the
Locationheader and expecting the browser to redirect anyway
Follow-up questions
- →Why does a wrongly cached
301cause persistent problems that a302avoids? - →What is the difference between
302,303, and307on method preservation?
MiddleTheoryCommonWhat is REST as an architectural style for web APIs?
What is REST as an architectural style for web APIs?
An architectural style for web APIs: resources addressed by URLs, manipulated with HTTP methods (GET/POST/PUT/DELETE), typically exchanging JSON, leveraging status codes and caching. Key constraints: statelessness and a uniform interface.
Common mistakes
- ✗Calling
RESTa strict protocol or standard rather than an architectural style - ✗Assuming
RESTrequiresXMLand forbidsJSON - ✗Storing per-client server state and breaking the statelessness constraint
Follow-up questions
- →What does the uniform-interface constraint require of a
RESTAPI? - →How does statelessness help a
RESTservice scale horizontally?
JuniorTheoryOccasionalWhat happens end-to-end when you run curl https://avito.ru?
What happens end-to-end when you run curl https://avito.ru?
curl resolves the host to an IP via DNS, opens a TCP connection (three-way handshake), negotiates TLS for https, then sends an HTTP GET request line plus headers. The response travels back down the network stack (IP, link, physical) through any proxy to the server, which builds the body and replies.
Common mistakes
- ✗Forgetting the
DNSlookup that turns the hostname into an IP before any connection - ✗Skipping the
TCPthree-way handshake or theTLSnegotiation forhttps - ✗Thinking the request reaches the server unchanged instead of descending the network layers
Follow-up questions
- →Where in this flow does a reverse proxy like the web server
nginxsit? - →What changes in the steps if the URL is
http://instead ofhttps://?
JuniorTheoryOccasionalHow does DNS resolve a hostname to an IP address?
How does DNS resolve a hostname to an IP address?
DNS (Domain Name System) maps a name like avito.ru to an IP. A resolver walks the hierarchy — root, then TLD (.ru), then the authoritative server — usually over UDP/53, falling back to TCP for large replies. Answers are cached at every level with a TTL, so repeat lookups skip the walk.
Common mistakes
- ✗Thinking
DNSis one flat table rather than a delegated hierarchy - ✗Forgetting that answers are cached at each level with a
TTL - ✗Assuming
DNSruns overTCPby default instead ofUDP/53
Follow-up questions
- →Why does
DNSfall back toTCPfor some responses? - →What does a short versus long
TTLtrade off when an IP changes?
MiddleTheoryOccasionalHow is caching controlled at the HTTP level?
How is caching controlled at the HTTP level?
Via response headers. Cache-Control (and legacy Expires) set lifetime, visibility and revalidation; Last-Modified plus If-Modified-Since cache by date; ETag caches by a content hash. The client revalidates and reuses its copy.
Common mistakes
- ✗Thinking caching is client-only with no server-sent headers
- ✗Putting
Cache-Controlin the request URL instead of a response header - ✗Confusing date-based
Last-Modifiedwith hash-basedETagvalidation
Follow-up questions
- →What does
Cache-Control: no-cachemean versusno-store? - →Why prefer
ETagoverLast-Modifiedfor resources that change sub-second?
MiddleTheoryOccasionalHow does TCP provide reliable, ordered delivery?
How does TCP provide reliable, ordered delivery?
TCP is a connection-oriented transport protocol: a three-way handshake opens the connection, then data is split into numbered segments that the receiver acknowledges (ACK). Lost segments are retransmitted, sequence numbers restore order, and a sliding window pipelines many segments while congestion control throttles the sender to avoid overrunning the network or receiver.
Common mistakes
- ✗Calling
TCPconnectionless or confusing it withUDP's fire-and-forget model - ✗Thinking
TCPsends one segment at a time instead of using a sliding window - ✗Forgetting congestion control prevents a fast sender from overrunning a slow link
Follow-up questions
- →What does the sliding window achieve that stop-and-wait
ACKcannot? - →Why is the three-way handshake described as an expensive part of
TCP?
MiddleTheoryRareWhat is CGI, and what is its main drawback?
What is CGI, and what is its main drawback?
The Common Gateway Interface — a convention where the server runs an external program per request, passing request data via environment variables and reading the HTTP response from its stdout. Spawning a process per request is slow.
Common mistakes
- ✗Thinking
CGIreuses one persistent process instead of spawning per request - ✗Believing
CGIpasses data only via the URL, not environment variables - ✗Assuming
CGIisPython-specific rather than language-agnostic
Follow-up questions
- →How do the gateway interfaces FastCGI and WSGI fix the per-request process spawn cost?
- →Which environment variables does a
CGIprogram read to parse a request?
MiddleTheoryRareHow do ETag and conditional 304 responses work?
How do ETag and conditional 304 responses work?
The server attaches an ETag validator to a resource; the client echoes it back via If-None-Match on its next request. If the resource still matches, the server replies 304 with an empty body and the client reuses its cached copy; if not, 200 with fresh content.
Common mistakes
- ✗Believing a
304carries the full body instead of being empty - ✗Thinking the
ETagis a path or timestamp rather than a content hash - ✗Forgetting the client echoes the
ETagback viaIf-None-Match
Follow-up questions
- →What is the difference between a strong and a weak
ETag? - →How do
If-None-MatchandIf-Modified-Sinceinteract in one request?
MiddleTheoryRareHow does UDP differ from TCP, and what is a socket?
How does UDP differ from TCP, and what is a socket?
UDP is a connectionless transport: no handshake, no ACK, no retransmission — cheap, low-latency, but unreliable, so it suits voice, video, metrics, and games where a dropped datagram is tolerable. A socket is the OS abstraction for a transport endpoint (a file-like handle): stream sockets ride TCP, datagram sockets ride UDP, plus local Unix sockets.
Common mistakes
- ✗Believing
UDPis reliable or that it acknowledges datagrams likeTCP - ✗Thinking a socket is tied to one protocol rather than an endpoint abstraction
- ✗Forgetting the socket count is bounded by file-descriptor limits and the port range
Follow-up questions
- →Why does a game or video stream prefer
UDPdespite its unreliability? - →What limits how many sockets a single machine can open at once?
SeniorTheoryRareHow do REST and SOAP differ as approaches to web services?
How do REST and SOAP differ as approaches to web services?
REST is an architectural style — any format (JSON/XML/text), HTTP-only, resource-oriented, cacheable. SOAP is a protocol — XML-only, transport-agnostic (HTTP/SMTP), operation-oriented, with built-in WS-Security and ACID transactions.
Common mistakes
- ✗Calling both
RESTandSOAPprotocols, whenRESTis only a style - ✗Claiming
SOAPsupportsJSONand many formats rather thanXML-only - ✗Saying
RESTmandatesXMLand WS-Security, swapping it withSOAP
Follow-up questions
- →When would
SOAP's WS-Security and ACID guarantees justify its overhead? - →Why can
RESTleverageHTTPcaching whileSOAPtypically cannot?