Request / Response

Understanding the full lifecycle of an HTTP request helps you build better web applications.

Complete Lifecycle

1. URL Resolution
   User enters URL → DNS lookup → IP address resolved

2. TCP Connection
   Three-way handshake:
   Client → SYN → Server
   Client ← SYN-ACK ← Server
   Client → ACK → Server
   Connection established!

3. TLS Handshake (HTTPS)
   ClientHello → ServerHello → Certificate → Key Exchange
   Encrypted tunnel established

4. HTTP Request
   Client sends request method, headers, and body

5. Server Processing
   - Route matching
   - Authentication/authorization
   - Business logic
   - Database queries
   - Response generation

6. HTTP Response
   Server sends status code, headers, and body

7. Browser Processing
   - Check for redirects
   - Handle cookies (Set-Cookie)
   - Parse response body
   - Render content

8. Connection Management
   - HTTP/1.0: Close connection
   - HTTP/1.1: Keep-alive (reusable)
   - HTTP/2: Multiplexed streams

Timing Breakdown

DNS Lookup:        20-120ms
TCP Connection:    20-40ms
TLS Handshake:     20-40ms (new connection)
Request Sending:   ~1ms
Server Processing: Varies (10ms-10s+)
Response Download: Varies by size
DOM Rendering:     10-100ms

Request headers provide metadata about the HTTP request.

Essential Request Headers

Header	Purpose	Example
Host	Target domain	www.example.com
User-Agent	Client software	Mozilla/5.0...
Accept	Preferred response types	text/html, application/json
Accept-Language	Preferred languages	en-US, en;q=0.9
Accept-Encoding	Compression support	gzip, deflate, br
Connection	Connection management	keep-alive
Cookie	Stored cookies	session=abc123
Authorization	Auth credentials	Bearer token123
Content-Type	Body format	application/json
Content-Length	Body size	1234

Request Header Examples

Browser Request:

GET /api/users HTTP/1.1
Host: api.example.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0
Accept: application/json
Accept-Language: en-US,en;q=0.9
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Cookie: session=abc123; theme=dark
If-None-Match: "abc123"

API Request:

POST /api/users HTTP/1.1
Host: api.example.com
Content-Type: application/json
Authorization: Bearer eyJhbGciOiJIUzI1NiIs...
Accept: application/json
Cache-Control: no-cache
X-Request-ID: 123e4567-e89b-12d3-a456-426614174000

{"name": "Alice", "email": "alice@example.com"}

Special Headers

If-Modified-Since: Sat, 01 Jan 2024 00:00:00 GMT
If-None-Match: "etag-value"
→ Used for caching (304 Not Modified)

Origin: https://www.example.com
→ Used for CORS preflight requests

X-Requested-With: XMLHttpRequest
→ Identifies AJAX requests

Response headers provide metadata about the HTTP response.

Essential Response Headers

Header	Purpose	Example
Content-Type	Response body format	text/html; charset=utf-8
Content-Length	Body size in bytes	1234
Content-Encoding	Compression used	gzip
Cache-Control	Caching instructions	max-age=3600
Set-Cookie	Store cookies	session=abc123; HttpOnly
Location	Redirect URL	/new-page
ETag	Resource version	"abc123"
Last-Modified	When resource changed	Sat, 01 Jan 2024
Server	Server software	nginx/1.24.0
X-Content-Type-Options	Prevent MIME sniffing	nosniff

Response Header Examples

Success Response:

HTTP/1.1 200 OK
Content-Type: application/json; charset=utf-8
Content-Length: 1234
Cache-Control: max-age=3600
ETag: "abc123"
Access-Control-Allow-Origin: *
X-Request-Id: 123e4567-e89b-12d3-a456-426614174000

{"id": 1, "name": "Alice"}

Redirect Response:

HTTP/1.1 301 Moved Permanently
Location: https://www.example.com/new-page
Cache-Control: max-age=3600

Error Response:

HTTP/1.1 404 Not Found
Content-Type: application/json

{"error": "Not Found", "message": "User does not exist"}

Security Headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-XSS-Protection: 1; mode=block
Content-Security-Policy: default-src 'self'
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: camera=(), microphone=()