HTTP, HTTPS and TLS

Why defenders read HTTP

Most business apps, APIs and attacks run over the web. Web server logs, proxy logs and web application firewall alerts are all written in HTTP terms. To read them you need to know requests, responses, status codes, headers and cookies.

Requests and responses

HTTP (Hypertext Transfer Protocol) works as request and response. The browser sends a request; the server sends back a response. Each request has a method, a path and headers (extra lines of information).

203.0.113.77 - - [14/Mar/2026:10:21:07 +0530] "POST /login HTTP/1.1" 401 512 "-" "python-requests/2.32"
203.0.113.77 - - [14/Mar/2026:10:21:08 +0530] "POST /login HTTP/1.1" 401 512 "-" "python-requests/2.32"
203.0.113.77 - - [14/Mar/2026:10:21:09 +0530] "POST /login HTTP/1.1" 200 1024 "-" "python-requests/2.32"

HTTPS and TLS

Plain HTTP sends everything as readable text. Anyone on the same café Wi-Fi or along the path could read or change it. HTTPS is HTTP sent inside TLS (Transport Layer Security). TLS gives three things:

• Confidentiality: the traffic is encrypted.
• Integrity: any change on the way is detected.
• Authentication: the server proves who it is with a certificate signed by a trusted certificate authority.

Current versions are TLS 1.2 and TLS 1.3. The old SSL protocols and TLS 1.0 and 1.1 are deprecated (officially retired) and should be turned off. TLS 1.3 is faster and removed many weak options.

In a simplified TLS handshake, the browser says which versions and ciphers it supports, the server answers with its choice and its certificate, the browser checks the certificate, and both sides agree on fresh session keys. After that, all data is encrypted.

$ curl -sI https://shop.example
HTTP/2 200
content-type: text/html; charset=utf-8
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: default-src 'self'
set-cookie: session=4f9c...; Path=/; Secure; HttpOnly; SameSite=Lax

Headers and cookies that protect users

• Strict-Transport-Security (HSTS): tells the browser to use only HTTPS for this site from now on.
• Content-Security-Policy (CSP): limits where scripts can load from, reducing cross-site scripting.
• X-Content-Type-Options: nosniff: stops the browser guessing file types.
• Cookie flags: Secure (only sent over HTTPS), HttpOnly (JavaScript cannot read it, so a script injected by an attacker cannot steal it), SameSite (limits sending the cookie from other sites, which helps against cross-site request forgery).

Common mistakes

• "It has a padlock, so it is safe." TLS protects the connection, not the honesty of the site.
• Leaving TLS 1.0 enabled "for old clients".
• Session cookies without Secure and HttpOnly.
• Ignoring certificate warnings. In a company, a certificate warning on an internal site can mean someone is intercepting traffic.