Lab · Backend Development
Lab: the HTTP behind a PNR-status API
The brief
A railway app asks a backend "what is the status of PNR 4512345678?". Read the raw HTTP request the way a server does, pull out its cookies, build the right response with status code, headers and JSON, and set a safe session cookie.
Why it matters
Frameworks like Express hide these details, but when something breaks (a 400 instead of a 200, a cookie that never arrives, a cached answer that should not be cached) a backend developer has to read the raw request and response. Payment, travel and banking APIs in India are all plain HTTP and JSON underneath.
Skills you practise
- the request line and headers
- URL paths and query strings
- cookies
- status codes 200, 400 and 404
- Content-Type and Cache-Control
- JSON.stringify
- HttpOnly, Secure and SameSite
What you will have at the end
http.js: four tested functions that read an HTTP request and write a correct, safe response for a PNR-status API.
How it is marked (rubric, 100 points)
| Correct behaviourEvery check passes, including missing cookies and bad PNRs. | 50 |
|---|---|
| Understands HTTPYou can point at the request line, headers, empty line and body in a raw request. | 25 |
| Security habitsno-store for personal data; HttpOnly, Secure and SameSite on the session cookie. | 15 |
| Clean codeSmall functions, clear names, no repeated header objects. | 10 |
0/4 steps done
Step 1 of 4
Read a raw request
parseRequest(raw) returns { method, path, query, headers }, with the query as an object and header names in small letters.
An HTTP/1.1 request is plain text. The first line is the request line: method, target and version, separated by spaces. Each header follows on its own line as "Name: value", lines end with \r\n, and an empty line ends the headers.
The target holds the path and the query string; new URL(target, 'http://localhost') splits them for you. Header names are case-insensitive, so store them in small letters, as Node.js does in req.headers.
Run shows what your code prints. Check runs the step's tests. Ctrl+Enter checks too.