HTTP & HTTPS

HTTP & HTTPS interview questions

What does it mean that HTTP is stateless?

The server keeps no memory of previous requests — each must carry everything needed to serve it. Sessions are simulated with cookies or tokens, which is why authentication is an application concern rather than a protocol one.

What's the difference between a safe and an idempotent method?

Safe means no state change — GET, HEAD. Idempotent means repeating it has the same effect as doing it once — GET, PUT, DELETE. POST is neither, which is why resubmitting a form can create duplicates.

Why they ask: The distinction matters for retries: idempotent requests are safe to retry automatically.

PUT or PATCH — what's the difference?

PUT replaces the resource entirely and is idempotent. PATCH applies a partial change and is not necessarily idempotent, since an operation like 'increment' produces a different result each time.

What do the five status code classes mean?

1xx informational, 2xx success, 3xx redirection, 4xx client error, 5xx server error. The 4xx/5xx split is about blame — whether the request was wrong or the server failed to handle a valid one.

301 or 302 — which and why does it matter?

301 is permanent and gets cached by browsers and search engines, transferring link equity; 302 is temporary and shouldn't be cached. Using 301 by mistake is painful because clients keep following it long after you change your mind.

What's the difference between 401 and 403?

401 means unauthenticated — the server doesn't know who you are, and credentials might help. 403 means authenticated but not permitted — it knows who you are and the answer is still no.

What did HTTP/2 and HTTP/3 each fix?

HTTP/2 added multiplexing of many streams over one connection plus header compression, fixing HTTP/1.1's one-request-at-a-time limit. HTTP/3 moved to QUIC over UDP to remove the TCP-level head-of-line blocking HTTP/2 still suffered.

What does the TLS handshake accomplish?

Three things: it authenticates the server via its certificate chain, negotiates cipher suites, and establishes a shared symmetric key using asymmetric cryptography. Bulk traffic then uses fast symmetric encryption.

Why does TLS use asymmetric cryptography only for the handshake?

Asymmetric operations are orders of magnitude slower. It's used to establish a shared secret safely, after which symmetric encryption handles the actual data efficiently.

What does a certificate actually prove?

That a certificate authority the client trusts vouches for the binding between a public key and a domain name. It proves identity, not that the site is safe — a phishing site can hold a perfectly valid certificate.

Why they ask: A good security-awareness question: HTTPS means private, not trustworthy.

What problem does CORS solve?

Browsers block cross-origin requests by default under the same-origin policy. CORS lets a server opt in with response headers naming which origins, methods and headers are allowed. It's enforced by the browser, not the server.