Every time a browser, React application, mobile app, or another service calls an API, it needs a protocol to communicate with the server.
The most common protocol is HTTP. When security is required, we use HTTPS.
1. What is HTTP?
HTTP (HyperText Transfer Protocol) is an application-layer protocol used for communication between clients and servers.
For example:
React Application
↓
HTTP Request
↓
ASP.NET Core API
↓
HTTP Response
A typical request looks like:
GET /api/users/101 HTTP/1.1
Host: api.example.com
Accept: application/json
The server may respond:
HTTP/1.1 200 OK
Content-Type: application/json
{
"id": 101,
"name": "John"
}
2. HTTP Request Structure
An HTTP request mainly contains:
- Method — GET, POST, PUT, DELETE, PATCH
- URL — resource being requested
- Headers — metadata about the request
- Body — data sent to the server, when required
Example:
POST /api/orders HTTP/1.1
Host: api.example.com
Content-Type: application/json
Authorization: Bearer eyJ...
{
"productId": 1001,
"quantity": 2
}
3. HTTP Response
An HTTP response contains:
- Status Code
- Headers
- Response Body
Example:
HTTP/1.1 201 Created
Content-Type: application/json
{
"orderId": 5001,
"status": "Created"
}
4. Important HTTP Status Codes
| Code | Meaning | Example |
|---|---|---|
| 200 | OK | Successful GET |
| 201 | Created | Successful POST |
| 204 | No Content | Successful DELETE |
| 400 | Bad Request | Invalid input |
| 401 | Unauthorized | Missing/invalid authentication |
| 403 | Forbidden | User does not have permission |
| 404 | Not Found | Resource does not exist |
| 409 | Conflict | Duplicate/conflicting operation |
| 429 | Too Many Requests | Rate limit exceeded |
| 500 | Internal Server Error | Unexpected server error |
| 502 | Bad Gateway | Gateway received invalid response |
| 503 | Service Unavailable | Service temporarily unavailable |
5. How HTTP Works
Client
↓
DNS
↓
IP Address
↓
TCP Connection
↓
HTTP Request
↓
Server
↓
HTTP Response
↓
Client
The actual network layers are important for interviews:
Application
HTTP
↓
Transport
TCP
↓
Internet
IP
↓
Network Interface
Ethernet / Wi-Fi
6. Is HTTP Secure?
No.
HTTP normally sends application data without encryption.
For example:
POST /api/login
{
"username": "john",
"password": "MyPassword123"
}
If this communication is intercepted on an unsecured network, the data may be readable.
This is why sensitive applications use HTTPS.
7. What is HTTPS?
HTTPS = HTTP + TLS
HTTPS protects HTTP communication using TLS (Transport Layer Security).
The important point is:
HTTP
+
TLS Security
=
HTTPS
HTTPS provides:
- Confidentiality — attackers should not be able to read the encrypted data.
- Integrity — data should not be modified silently during transmission.
- Authentication — the server's identity can be verified using its certificate.
8. How HTTPS Works
This is one of the most important interview topics.
Suppose a browser calls:
https://api.example.com/users
Before normal HTTP data is exchanged, TLS establishes a secure connection.
sequenceDiagram
participant C as Client
participant S as Server
C->>S: Connect to HTTPS endpoint
S->>C: Server Certificate
C->>C: Validate Certificate
C->>S: TLS Key Exchange
S->>C: Key Exchange Response
C->>S: Finished
S->>C: Finished
C->>S: Encrypted HTTP Request
S->>C: Encrypted HTTP Response
9. What is a TLS Certificate?
A TLS certificate is used to establish the identity of the server.
For example:
https://api.example.com
The server presents a certificate containing information such as:
- Domain name
- Public key
- Certificate issuer
- Validity period
- Digital signature
The browser verifies that the certificate is trusted and matches the requested domain.
10. What is a Public Key and Private Key?
TLS uses asymmetric cryptography during the secure connection establishment.
There are two keys:
- Public Key — can be shared.
- Private Key — kept secret by the server.
The server's private key must never be exposed publicly.
11. What is the Session Key?
This is a very important HTTPS interview question.
HTTPS does not normally encrypt every HTTP request using expensive asymmetric encryption.
Instead, TLS establishes a shared symmetric encryption key for the connection.
This is commonly referred to as the session key.
The basic idea is:
Asymmetric Cryptography
↓
Secure Key Establishment
↓
Shared Session Key
↓
Symmetric Encryption
↓
HTTP Data
Symmetric encryption is much faster, so it is suitable for encrypting large amounts of application data.
12. Who Creates the Session Key?
A common interview misconception is:
"The server sends the session key to the browser."
That is not the correct way to think about modern TLS.
In modern TLS, the client and server perform a key exchange, typically using ephemeral Diffie-Hellman mechanisms such as ECDHE.
Both sides independently derive the shared secret.
sequenceDiagram
participant C as Client
participant S as Server
C->>S: ClientHello + key share
S->>C: ServerHello + key share
C->>C: Derive shared secret
S->>S: Derive shared secret
Note over C,S: Both derive the same session keys
C->>S: Encrypted HTTP data
S->>C: Encrypted HTTP response
The important interview answer is:
The session keys are derived by both parties from the TLS key exchange; the server does not simply send the session key across the network in plaintext.
13. Why Use Symmetric Encryption After the Handshake?
Asymmetric cryptography is computationally expensive.
Symmetric encryption is much faster for continuous data transfer.
| Cryptography | Main Purpose |
|---|---|
| Asymmetric | Authentication and secure key establishment |
| Symmetric | Encrypting application data efficiently |
So the simplified model is:
Certificate
↓
Server Authentication
↓
TLS Key Exchange
↓
Session Keys
↓
Fast Symmetric Encryption
↓
HTTP Communication
14. Complete HTTPS Flow
sequenceDiagram
participant B as Browser
participant S as HTTPS Server
B->>S: TCP Connection
B->>S: TLS ClientHello
S->>B: TLS ServerHello + Certificate
B->>B: Validate Certificate
B->>S: Key Exchange Information
S->>B: Key Exchange Information
B->>B: Derive Session Keys
S->>S: Derive Session Keys
B->>S: Encrypted HTTP Request
S->>S: Decrypt Request
S->>B: Encrypted HTTP Response
B->>B: Decrypt Response
15. HTTP vs HTTPS
| Feature | HTTP | HTTPS |
|---|---|---|
| Encryption | No TLS encryption | TLS encryption |
| Authentication | No server authentication through TLS | Certificate-based server authentication |
| Data Integrity | Not protected by TLS | Protected by TLS |
| Default Port | 80 | 443 |
| Use Case | Non-sensitive communication | Modern web/API communication |
16. HTTPS Does Not Encrypt Everything
A common misunderstanding is that HTTPS hides everything.
HTTPS protects the contents of the HTTP communication, but network metadata can still exist.
For example, DNS lookups, IP addresses, connection timing, and other metadata can be observable depending on the network and technologies being used.
HTTPS should therefore be understood primarily as protection for the communication between the client and server, not as complete anonymity.
17. HTTP in ASP.NET Core
A simple ASP.NET Core API:
[ApiController]
[Route("api/users")]
public class UsersController : ControllerBase
{
[HttpGet("{id}")]
public IActionResult GetUser(int id)
{
return Ok(new
{
Id = id,
Name = "John"
});
}
}
A client can call:
GET https://api.example.com/api/users/101
ASP.NET Core receives the HTTP request and executes the appropriate endpoint.
18. HTTPS Redirection in ASP.NET Core
ASP.NET Core applications can redirect HTTP requests to HTTPS.
var builder = WebApplication.CreateBuilder(args);
var app = builder.Build();
app.UseHttpsRedirection();
app.MapControllers();
app.Run();
For example:
http://api.example.com/users
can be redirected to:
https://api.example.com/users
19. HTTPS Behind a Load Balancer
This is very common in production architectures.
The client may establish HTTPS with a load balancer, while the load balancer forwards the request to an application server.
flowchart LR
A[Browser / React App] -->|HTTPS| B[Load Balancer]
B -->|HTTPS or HTTP| C[ASP.NET Core API]
C --> D[(SQL Server)]
Whether traffic between the load balancer and backend is HTTP or HTTPS depends on the architecture and security requirements.
In many production environments, TLS is terminated at the load balancer and the backend communication is separately secured where required.
20. TLS Termination
TLS termination means decrypting HTTPS traffic at a component such as a load balancer, reverse proxy, or API gateway.
flowchart LR
A[Client] -->|HTTPS| B[Load Balancer]
B -->|Decrypt TLS| C[HTTP Request]
C --> D[ASP.NET Core API]
The load balancer can then route the request to the correct backend service.
A production architecture may instead use:
flowchart LR
A[Client] -->|HTTPS| B[Load Balancer]
B -->|HTTPS| C[API Service]
C -->|HTTPS| D[Microservice]
This provides encryption across the internal network as well.
21. HTTP Keep-Alive
Creating a TCP connection for every HTTP request can be expensive.
HTTP persistent connections allow multiple requests to reuse an existing connection.
sequenceDiagram
participant C as Client
participant S as Server
C->>S: TCP Connection
C->>S: HTTP Request 1
S->>C: HTTP Response 1
C->>S: HTTP Request 2
S->>C: HTTP Response 2
C->>S: HTTP Request 3
S->>C: HTTP Response 3
This reduces connection establishment overhead.
22. HTTP/1.1 vs HTTP/2 vs HTTP/3
| Version | Important Concept | Transport |
|---|---|---|
| HTTP/1.1 | Persistent connections, text-based protocol | TCP |
| HTTP/2 | Multiplexing, binary framing, header compression | TCP |
| HTTP/3 | Built on QUIC | UDP |
You do not need to memorize every protocol detail for most interviews. Remember the major architectural difference:
HTTP/1.1 → TCP
HTTP/2 → TCP + Multiplexing
HTTP/3 → QUIC over UDP
23. HTTP vs HTTPS — Interview Answer
If the interviewer asks "What is the difference between HTTP and HTTPS?", a good answer is:
HTTP is an application-layer protocol for client-server communication. HTTPS is HTTP secured using TLS. TLS provides encryption, integrity protection, and server authentication. During the TLS handshake, the client validates the server certificate and both sides establish shared session keys. After that, application data is encrypted using efficient symmetric cryptography.
24. Common Interview Questions
What is HTTP?
HTTP is an application-layer protocol used for communication between clients and servers.
What is HTTPS?
HTTPS is HTTP running over TLS, providing confidentiality, integrity, and server authentication.
Why does HTTPS use certificates?
Certificates help the client verify the identity of the server and contain the server's public key and certificate information.
Does the server send the session key to the client?
Not as a plaintext key. Modern TLS uses a key exchange from which both parties independently derive shared session keys.
Why not use asymmetric encryption for all HTTP data?
Asymmetric cryptography is computationally expensive. Symmetric encryption is much faster for bulk data transfer.
What is TLS termination?
It is the process of decrypting HTTPS traffic at a load balancer, reverse proxy, API gateway, or similar component.
What is the default HTTP port?
Port 80.
What is the default HTTPS port?
Port 443.
Does HTTPS mean the API is secure?
No. HTTPS protects communication in transit. The application still needs authentication, authorization, input validation, secure secrets, rate limiting, logging, and other security controls.
25. Key Takeaways
- HTTP is used for client-server communication.
- HTTPS is HTTP secured with TLS.
- HTTPS normally uses port 443.
- TLS provides confidentiality, integrity, and authentication.
- The server presents a TLS certificate.
- The certificate helps the client authenticate the server.
- Modern TLS uses a key exchange to derive shared session keys.
- Symmetric encryption is used for efficient application-data encryption.
- TLS can terminate at a load balancer or reverse proxy.
- HTTPS protects data in transit; it does not automatically secure the entire application.
Interview Flow to Remember
flowchart TD
A[Client] --> B[HTTPS Request]
B --> C[TLS Handshake]
C --> D[Server Certificate]
D --> E[Certificate Validation]
E --> F[Key Exchange]
F --> G[Shared Session Keys]
G --> H[Symmetric Encryption]
H --> I[Encrypted HTTP Request]
I --> J[Server]
J --> K[Encrypted HTTP Response]
K --> H
One-line memory trick:
Certificate authenticates → Key exchange establishes shared keys → Symmetric encryption protects HTTP data.