These days, creating a website without HTTPS is unimaginable. But why is that single ‘S’ added to HTTP so important? You’d be surprised how much that ‘S’ protects our data.
HTTPS is a version of HTTP with added ‘encryption’. All communications between the web browser and the server are encrypted, preventing third parties from eavesdropping on the data. In this article, we’ll explain how HTTPS works, why it’s important, and how to implement it.
Differences Between HTTP and HTTPS
The Lifecycle of an HTTP Request
1. Client Sends a Request:
- The browser generates an HTTP request.
- It uses methods like GET, POST, and specifies the requested resource.
2. DNS Lookup:
- Converts the domain name to an IP address.
- The browser queries the DNS server to convert the domain name to an IP address.
3. TCP Handshake:
- The client establishes a TCP connection with the server.
- It goes through a three-step handshake: SYN, SYN-ACK, ACK.
4. HTTP Request Transmission:
- Once the TCP connection is established, the client sends the HTTP request.
5. Packet Routing:
- Data packets are transmitted through various network devices to the server.
- Routers determine the optimal path for the packets.
6. Server Response:
- The server processes the HTTP request and generates a response.
- It includes HTML pages or JSON data in the response body.
7. Content Rendering:
- The browser receives the HTTP response and renders the content on the screen.
- It requests additional resources (images, CSS, JavaScript, etc.).
HTTPS: HTTP + Encryption
TLS Handshake
TLS is the core of HTTPS, allowing the client and server to exchange encryption keys and communicate securely.
1. TLS 1.3 Handshake:
- The client sends the server a list of supported cipher suites and TLS versions.
- The server responds with its chosen cipher suite and TLS version.
- The client verifies the server’s SSL certificate.
- The client generates a pre-master secret and sends it to the server.
- The client and server generate session keys.
- Secure communication is established using the session keys.
Practical Implementation of HTTPS
Proper implementation of HTTPS strengthens our website against hacks and protects users’ personal information. It’s recommended to use the simpler, faster, and more secure TLS 1.3. Enhance security by implementing HTTPS in your project.
Reference: devonperoutky, “Mediocre Engineer’s guide to HTTPS”