What it means
HTTP defines the meaning of web requests and responses. A request names a method, such as GET or POST, and a target resource. Headers carry additional information, and a body may carry submitted data. The server returns a status code, headers, and sometimes a body. These pieces help practitioners understand what a browser or application actually asked a service to do.
HTTP semantics are separate from transport protection. HTTPS carries HTTP over a protected connection. Encryption does not decide which records a requester may see. That decision belongs to the application, which must validate permissions and handle inputs appropriately for every relevant request.
AN ILLUSTRATIVE SCENARIO
A council permit portal
A council portal lets residents view building permit applications. A browser sends a request for one permit, and the server returns its details. During an authorized test, the team changes the requested permit identifier using two test accounts. Even though both users signed in successfully and use HTTPS, the server must reject access to a private permit owned by the other account. Inspecting the request and response helps separate a transport problem from an application permission failure.
Put it to work
- Use browser developer tools in an authorized test environment to identify the method, path, status code, and relevant headers for one action.
- Map the request to its intended business behavior and permission check, including which account and resource it concerns.
- Test valid and invalid requests with synthetic data; confirm server-side rejection rather than relying on a hidden button in the interface.
curl --head https://example.com/How to check your work
For the same test resource, capture an allowed request and a denied request. The result should match the documented permission rule, and logs should support investigation without recording sensitive credentials.
Connect the ideas
- TLS
A protocol that encrypts and integrity-protects an application conversation and checks a certificate for a name.
- Authorization
The decision about whether a person, device, workload, or anonymous requester may perform a particular action on a resource.
- Session
State linking multiple requests; an authenticated session associates later requests with a previously authenticated identity until it expires or is revoked.
- Log
A record emitted by a system that something happened, which may later be used as evidence.