Architecture of So-ware Systems HTTP Protocol. Mar8n Rehák

Similar documents
reference: HTTP: The Definitive Guide by David Gourley and Brian Totty (O Reilly, 2002)

HTTP Protocol. Bartosz Walter

Protocolo HTTP. Web and HTTP. HTTP overview. HTTP overview

The Hyper-Text Transfer Protocol (HTTP)

Lektion 2: Web als Graph / Web als System

CS640: Introduction to Computer Networks. Applications FTP: The File Transfer Protocol

HTTP. Internet Engineering. Fall Bahador Bakhshi CE & IT Department, Amirkabir University of Technology

CONTENT of this CHAPTER

Hypertext for Hyper Techs

International Journal of Engineering & Technology IJET-IJENS Vol:14 No:06 44

1. When will an IP process drop a datagram? 2. When will an IP process fragment a datagram? 3. When will a TCP process drop a segment?

Internet Technologies Internet Protocols and Services

No. Time Source Destination Protocol Info HTTP GET /ethereal-labs/http-ethereal-file1.html HTTP/1.

Outline Definition of Webserver HTTP Static is no fun Software SSL. Webserver. in a nutshell. Sebastian Hollizeck. June, the 4 th 2013

Network Technologies

Project #2. CSE 123b Communications Software. HTTP Messages. HTTP Basics. HTTP Request. HTTP Request. Spring Four parts

The Web History (I) The Web History (II)

The Web: some jargon. User agent for Web is called a browser: Web page: Most Web pages consist of: Server for Web is called Web server:

Arnaud Becart ip- label 11/9/11

TCP/IP Networking An Example

Varnish Tips & Tricks, 2015 edition

HTTP Caching & Cache-Busting for Content Publishers

Alteon Browser-Smart Load Balancing

THE PROXY SERVER 1 1 PURPOSE 3 2 USAGE EXAMPLES 4 3 STARTING THE PROXY SERVER 5 4 READING THE LOG 6

Information Extraction Art of Testing Network Peripheral Devices

Demystifying cache. Kristian Lyngstøl Product Specialist Varnish Software AS

Computer Networks. Lecture 7: Application layer: FTP and HTTP. Marcin Bieńkowski. Institute of Computer Science University of Wrocław

By Bardia, Patit, and Rozheh

GET /FB/index.html HTTP/1.1 Host: lmi32.cnam.fr

Research of Web Real-Time Communication Based on Web Socket

Web Services April 21st, 2009 with Hunter Pitelka

Security-Assessment.com White Paper Leveraging XSRF with Apache Web Server Compatibility with older browser feature and Java Applet

World Wide Web. Before WWW

Deployment Guide. Caching (Static & Dynamic) Deployment Guide. A Step-by-Step Technical Guide

HTTP Authentication. RFC 2617 obsoletes RFC 2069

Data Communication I

1 Introduction: Network Applications

Domain Name System (DNS)

Playing with Web Application Firewalls

Internet Technologies. World Wide Web (WWW) Proxy Server Network Address Translator (NAT)

HTTP Response Splitting

Web applications. Web security: web basics. HTTP requests. URLs. GET request. Myrto Arapinis School of Informatics University of Edinburgh

URLs and HTTP. ICW Lecture 10 Tom Chothia

Evolution of the WWW. Communication in the WWW. WWW, HTML, URL and HTTP. HTTP Abstract Message Format. The Client/Server model is used:

Application layer Web 2.0

Table of Contents. Open-Xchange Authentication & Session Handling. 1.Introduction...3


Cache All The Things

Playing with Web Application Firewalls

CloudOYE CDN USER MANUAL

Internet Technologies 4-http. F. Ricci 2010/2011

CDN Operation Manual

Sticky Session Setup and Troubleshooting

WWW. World Wide Web Aka The Internet. dr. C. P. J. Koymans. Informatics Institute Universiteit van Amsterdam. November 30, 2007

Wireless Networks: Network Protocols/Mobile IP

Chapter 27 Hypertext Transfer Protocol

Introduction to ServerIron ADX Application Switching and Load Balancing. Module 6: Content Switching (CSW) Revision 0310

Securing SharePoint Server with Windows Azure Multi- Factor Authentication

CS 5480/6480: Computer Networks Spring 2012 Homework 1 Solutions Due by 9:00 AM MT on January 31 st 2012

B6: GET /started/with/ HTTP Analysis

Web Application Security

Cyber Security Workshop Ethical Web Hacking

CS 188/219. Scalable Internet Services Andrew Mutz October 8, 2015

T14 SECURITY TESTING: ARE YOU A DEER IN THE HEADLIGHTS? Ryan English SPI Dynamics Inc BIO PRESENTATION. Thursday, May 18, :30PM

The HTTP protocol (HyperText Transfer Protocol) Short history of HTTP. The HTTP 1.0 protocol. 07/07/2011(dec'09)

DEPLOYMENT GUIDE Version 1.1. Deploying the BIG-IP LTM v10 with Citrix Presentation Server 4.5

Telephone Related Queries (TeRQ) IETF 85 (Atlanta)

LMS. OSI Layers and the Learning Management System. Over view

Web. Services. Web Technologies. Today. Web. Technologies. Internet WWW. Protocols TCP/IP HTTP. Apache. Next Time. Lecture # Apache.

Chapter 2: Interactive Web Applications

APACHE WEB SERVER. Andri Mirzal, PhD N

Acrobat Connect. Using Connect Enterprise Web Services

Application Layer: HTTP and the Web. Srinidhi Varadarajan

COMP 112 Assignment 1: HTTP Servers

Layer 7 Load Balancing and Content Customization

How to Run an Apache HTTP Server With a Protocol

All You Can Eat Realtime

What is Distributed Annotation System?

Transport Layer Security Protocols

Security Testing is performed to reveal security flaws in the system in order to protect data and maintain functionality.

HTTP State Management

CTIS 256 Web Technologies II. Week # 1 Serkan GENÇ

CIS 551 / TCOM 401 Computer and Network Security. Spring 2007 Lecture 20

Using TestLogServer for Web Security Troubleshooting

Acunetix Website Audit. 5 November, Developer Report. Generated by Acunetix WVS Reporter (v8.0 Build )

Department of Computing Imperial College London. BrowserAudit. A web application that tests the security of browser implementations

Vodia PBX RESTful API (v2.0)

Lecture 8a: WWW Proxy Servers and Cookies

ivoyeur: permission to parse

WHAT IS A WEB SERVER?

Using ADOBE CONNECT 8 Web Services

Transcription:

Architecture of So-ware Systems HTTP Protocol Mar8n Rehák

HTTP Protocol Hypertext Transfer Protocol Designed to transfer hypertext informa8on over the computer networks Hypertext: Structured text with embedded logical links to other texts or resources. Concept dates back to 1960s, previously included in many so-ware products (help systems in par8cular, or Gopher) Specifica8on maintained by the IETF and W3C RFC 2616 Hyperlink included inten8onally

What made it special? Several internal factors have contributed to HTTP dominance HTTP + HTML + Browser combina8on Technical simplicity of the text form (Easy debugging&integra8on!) Elegance of the URI/URL model Simple technical model Unidirec8onal connec8on method Available open source implementa8ons/stacks HTTPS/TLS security model (1994, Netscape) Originally proprietary, opened (RFC 2818) External factors: Explosive increase in available bandwidth thanks to the massive investments in fiber op8cs & new encoding techniques Change of security posture on Internet/Enterprise Networks

Below and Around HTTP Tradi0onal OSI Model 7 - Applica8on HTTP De- Facto HTTP Model Web applica8ons 6 - Presenta8on (JPEG/UTF/ASCII) 5 - Session (RPC/SQL/NFS) 7 - HTTP Content types Cookies/Proxy/Auth 4 - Transport TCP 3 - Network IP 2 Data Link Ethernet 1 - Physical Electrons/Photons 4 - Transport TCP 3 - Network IP 2 Data Link Ethernet 1 - Physical Electrons/Photons

Protocol Versions WorldWideWeb 1989 - Tim Berners Lee HTTP 0.9 1991 ini8al version formally described HTTP 1.0 1996 added addi8onal methods, headers and meta- fields HTTP 1.1 1996 (de- facto)/1997 (official). Introduces persistent connec8ons, improves efficiency and latency HTTP 1.1. updated in 2014 6 RFCs describing the spec HTTP 2.0 2014 approved and wai8ng for publica8on

URI/URL Departure from the name service/service directory concept URL became a standard way how to iden8fy resources, APIs and their methods on internet/intranet Reused in other standards as well hlp://example.com:8080/my/resource?p=12 URL has five parts: 1. protocol: hlp or hlps, 2. hostname or IP address: to locate the host providing the service 3. (TCP) port number: to iden8fy the process bound to the port 4. resource iden8fica8on/filename: to request a specific resource 5. parameters Interpreted by scripts/resources or the server to transfer the informa8on (method/service parameters) https://tools.ietf.org/html/rfc3986

(Simple) HTTP Request(s) for wikipedia.org

HTTP Request Structure GET / HTTP/1.1 Host: microsoft.com Accept: text/html, application/xhtml+xml, */* Accept-Language: en-us User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/ 7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Proxy-Connection: Keep-Alive

Methods A Method must be specified for any request. Commonly used methods are specified below. Other exist (TRACE), but are not typically used GET retrieve the informa8on (resource) described by URI HEAD retrieve the header of the informa8on described by URI, without the actual content POST modifies the informa8on on the server PUT uploads/overwrites the resource on the server (API) DELETE removes the resource on the server (API) CONNECT opens a tunnel (proxy/persistent connec8on)

Method proper8es Safe methods: (must) never change the state of the resource accessed. No side- effects in the func8onal sense. GET, HEAD Idempotent methods. Repe88ve calls should result in iden8cal result and state. Allows refresh/caching. GET, HEAD, PUT, DELETE

HTTP is stateless Efficiency achieved through simplicity, and parallelism allowed by statelessness. Low level inefficiency (payload encoding, repe88ve transfer of informa8on) simplifies the servers and clients enough to achieve high- level efficiencies of scale. So, how do we handle state when we need it?

Header Fields: Cookies According to RFC 6265

Header Fields: Cookies Provide informa8on to the server about the reques8ng en8ty and the context of the request. And can carry state. The use of cookies transfers the responsibility for state management from server to user (browser). Cookies are the most complex header fields separate RFC 6265. Typical cookie size has increased from small (one token) to very large, with actual state stored in the cookie Cookie types: Session cookies: Iden8fy one session and/or carry the informa8on relevant for a single session, e.g. shopping basket. Persistent cookies: valid across sessions (persistent). Expira8on date provided by server. Set-Cookie: lang=en-us; Expires=Wed, 09 Jun 2021 10:18:14 GMT RFC 6265

Cookie structure Server - > Client Set- Cookie: SID=31d4d96e407aad42; Path=/; Secure; HPpOnly Set- Cookie: lang=en- US; Path=/; Domain=example.com Client - Server Cookie: SID=31d4d96e407aad42; lang=en- US Scope (domain/path): Determines which sites are allowed to read/modify the cookie Path=/; Domain=example.com Send this back for all subdomains of example.com Secure: Only transmit this over HTTPS (simplified) HPpOnly: Do not allow the use from javascript/apps

User Agent user- agent: determines the user agent used by the client Most o-en, this is a browser. Should have been formaled as product/version but this has shi-ed due to server- side logic Mozilla/5.0 became a near- universal browser UA prefix for compa8bility reasons Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Win64; x64; Trident/6.0) This is a browser A decent browser But an IE 10.0 On Win 7 64 bit Layout engine details

Host Header server sharing and load balancing Mandatory since HTTP 1.1, even if request line contains the full host info Allows the (non- dedicated) server to dis8nguish which domain is the request directed towards. Allows co- loca8on, easier load balancing and request rou8ng on the applica8on layer. Important for HTTPS, where the requests are o-en to IP addresses/shared load- balancers Example: GET /pub/www/ HTTP/1.1 Host: www.example.org

Other Headers Accept Headers may specify the type of the content/language/encoding/compression the client is willing to accept Accept: text/html, applica8on/xhtml+xml, */* Accept- Language: en- US Accept- Encoding: gzip, deflate Proxy- Connec8on: Keep- Alive

HTTP Response HTTP/1.1 200 OK Server: Apache X-Powered-By: HHVM/3.3.1 Cache-control: s-maxage=3600, must-revalidate, max-age=0 X-Content-Type-Options: nosniff Vary: Accept-Encoding X-Varnish: 12043230 11839648, 2606063287, 3164310615 3161137176 Date: Wed, 08 Apr 2015 08:07:03 GMT X-Cache: cp1055 hit (12521), cp4018 miss (0), cp4009 frontend hit (32068) Transfer-Encoding: chunked Content-Type: text/html; charset=utf-8 Last-Modified: Sat, 04 Apr 2015 21:23:59 GMT Age: 2184 Via: 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 [proxyxyz]: 80 (Cisco-WSA/8.5.0-497) Connection: keep-alive Length: unspecified [text/html]

HTTP Response Headers do contain a large volume of informa8on/fields Key fields are: Status: Success/Error Code Content- type: What is being returned - > Informs the client how to interpret/parse the content. Connec8on keep alive op8ons for performance op8miza8ons. Reduc8on of latency

Status Code Status code reflects the outcome of the request. Category breakdown: 2XX Success 200:Success, 3XX Redirect: 301: Permanent 4XX Client Error 5XX Server Error

Header Fields (some) Server: Name and version of the server Content- type: MIME type of the content, according to IANA classifica8on. Typically follows type/subtype;parameters palern, e.g.: text/html; charset=utf-8 image/jpeg application/pdf application/rss+xml application/soap+xml application/javascript or text/javascript