Trang 1
Hyper Text Transfer Protocol (HTTP) www.goupee.com Objective: Understand HTTP (the protocol that makes the Internet possible)
Nội dung tài liệu
Trang 2
Accessing Resources over the Web • <protocol>://<server>/<path> Defines the address (Uniform Resource Locator) Communication Protocol between the client and the server
Trang 3
Hypertext Transport Protocol (HTTP) characteristics • Request-response mechanism: – Transaction is initiated by a client sending a request to server – Server generates a response • Resource Identification – Each HTTP request includes a URI (Uniform Resource Identifier) • Statelessness – The server does not maintain any information about the transaction • Meta data support – Metadata about information can be exchanged in the messages
Trang 4
HTTP Request Format Specifies request method Request Line GET /index.html HTTP/1.0 Specifies resource via URI Header Lines Host: www.content-networking.com & meta data Date: BBBBBBBBBBBB User-Agent: Mozilla/5.0 (en) (WINNT; U) Accept-Language: en-us Carriage Return/Line Feed Message Body Content-length: (Message Payload)
Trang 5
Request Methods • GET – whatever information is identified by the Reuest-URI – Can Get static content and data produced by a program • POST – Submit information to Web Server – Eg: posting to blog, submission of user form… – Information is included in message body – The actual function depends on request URI Example POST/phonebook.cgi.HTTP/1.0 Looks up phone book for the number Date: Could have been also achieved by Get User-Agent: But in that case number would have been in Accept Language: en-us the Resource URL Content Length: 14 Which would have been stored in the log 98490 55266
Trang 6
Request Methods…contd (ii) • HEAD – Servers response does not include message body – Useful for getting resource metadata without transferring the resource – Also useful for debugging , checking for validity, accessibility and modification • PUT – Requests a server store the enclosed data under the supplied Request URL. – Creates the resource if it does not create – Not useful for web publishing (FTP is preferred for security purposes) • DELETE – Removes the Web object – Needs to be carefully used for security reasons
Trang 7
Request Methods…contd (iii) • TRACE method – Invokes a remote appliction layer feedback of the request message – Useful for testing what is being received at the server – Also possible to forward to intermediaries for debugging purposes • OPTIONS – Requests information about communication options available to server
Trang 8
HTTP Response Format Status line with result code and phrase Status line HTTP/1.0 200 OK Specifies server & Header Lines Date: BBBBBBBBBBBB resource meta data Server: Apache/1.3.12 (Unix) Last-Modified: (date) Content Type: text/html Carriage Return/Line Feed Message Body Content-length: (Message Payload)
Trang 9
Result Code and Phrase • 1xx: Informational – Not Done Yet • 2xx: Success – You win • 3xx:Redirection-You lose but try again • 4xx:Client Error – You lose, your fault • 5xx:Server Error – You lose, my bad 200 OK 204 No Content 300 Mutiple Choices 301 Moved Permanently 302 Moved Temporarily 304 Not Modified 400 Bad Request 401 Unauthorized 404 Not Found 500 Internal Server Error
Trang 10
Improvements in HTTP/1.1 • Persistent connections – Keeps the connection open after the server response – Connection can be closed by either client or server • Request Pipelining – Allows a client to send several requests without waiting for a response – Server responds in the same order • Chunked Encoding – Allows sender to break a message into arbitrary sized chunks – Useful for dynamically created response messages
Trang 11
Cookies • HTTP is stateless protocol • Cookies manage state maintenance by shifting the burden to client • Cookies are transmitted in clear text (security issue) Client Server Usual HTTP Request 1st client Client does not request Usual HTTP Response, including header interpret the line Set-cookie: <cookie> cookie string Server is presented with Usual HTTP Request, including header the previously line Set-cookie: <cookie> returned state 2nd client information request Usual HTTP Response
Trang 12
User Authentication • Users browser information remembers credentials and includes them in headers for subsequent requests • Browser typically deletes stored authentication credentials once browser is closed • HTTP allows various authentication mechanisms Client Server Usual HTTP Request 1st client HTTP Response with code 401, including request header line www-authenticate: <string1> User inputs Same HTTP Request, including header credentials line Authorization: <string2> Usual HTTP Response Usual HTTP Request, including header 2ndclient line Authorization: <string2> request Usual HTTP Response
Trang 13
SSL: Secure Web Communications • SSL protocol is application independent • Operates between application layer and transport layer • Application protocols such as HTTP sit on top of it and TCP/IP beneath it • SSL provides:
Trang 14
How SSL Works • The Public Key is a random number generated in pair (the other part of the pair is the private key known only to the server) • Data encrypted by the public key can be decrypted only by using the private key Client Server HTTPS Request SSL Certificate with the Public Key of the Generates a Server random number or Decrypted session key using the Sends Session Key encrypted with the Server which can Server Public Key be Private Key encrypted using the server Response/Request encrypted with public key session key
Trang 15
Ensuring SSL version compatibility • There are different versions of SSL depending on the encryption algorithm used. • The browser sends the versions it supports • The server sends the certificate. The certificate includes: – The identity of the organization to which the web server belongs – The certificate’s expiration date – The public key – The identity of the organization that issued the certificate, known as a certification authority (CA) • Browsers store and recognize certificates issued by a number of well-known CAs.
Trang 16
What it does and what it does not What It Does What it Does Not Data encryption SSL does not protect the data stored on Server authentication the disk. Message integrity Optional client authentication Information getting stolen through pages cached on the browser Stealing confidential information from the browser memory. Since in SSL data is encrypted only during transmission on the network, it is in clear text in the browser memory
Hiển thị 16 trang đầu. Tải tài liệu để xem đầy đủ.
Bình luận (0)
Chưa có bình luận nào. Hãy là người đầu tiên!