Topolearn

Learn HTTP & the web

How browsers, servers and APIs talk: URLs, DNS, TLS, requests, caching and more

21 lessons · 4 hours · 4 levels · covers HTTP & the web HTTP/1.1, HTTP/2, HTTP/3 (RFC 9110-9114)

HTTP is the protocol behind every web page and almost every API. This curriculum follows a request from URL and DNS lookup through TCP and TLS to methods, status codes, headers, caching, cookies and CORS, then on to REST design, HTTP/2 and HTTP/3, real-time connections and CDNs. Understanding it makes you better at debugging, API design and web performance in any language.

Sign in free to track progressOfficial docs ↗

How deep do you want to go?

1. EssentialsRead and write simple code, do the everyday basics7 lessons · 1 hour in total
2. PracticalUse it productively at work, with the usual idioms13 lessons · 2 hours in total
3. AdvancedThe less common features, performance and trade-offs18 lessons · 4 hours in total
4. ExpertInternals and the edge cases experts know21 lessons · 4 hours in total

The HTTP & the web tree

HTTP & the webAnatomy of a URLAnatomy of a URLThe request/response cycleTherequest/response c…DNS: finding the serverDNS: finding theserverHTTP methodsHTTP methodsStatus codesStatus codesHeadersHeadersBodies and content typesBodies and contenttypesTCP, TLS and HTTPSTCP, TLS and HTTPSCookies and sessionsCookies and sessionsHTTP caching basicsHTTP caching basicsSame-origin policy and CORSSame-origin policyand CORSAuthentication over HTTPAuthentication overHTTPDesigning REST APIsDesigning REST APIs
Essentials and Practical shown (13 of 21 lessons); the full list is below. Click a lesson to read it.

All 21 lessons, in order

From URL to server

  1. Anatomy of a URL · Essentials · 8 min

    Break a URL into scheme, host, port, path, query and fragment, and know how each part is used and encoded.

  2. DNS: finding the server · Essentials · 10 min

    Follow how a domain name becomes an IP address through resolvers, root, TLD and authoritative servers, and what record types and TTLs do.

Requests and responses

  1. The request/response cycle · Essentials · 10 min

    See what an HTTP request and response actually look like on the wire: a start line, headers, a blank line and an optional body.

  2. HTTP methods · Essentials · 10 min

    Use GET, POST, PUT, PATCH and DELETE for what they mean, and understand safe and idempotent methods.

  3. Status codes · Essentials · 10 min

    Read and choose status codes by class: 2xx success, 3xx redirection, 4xx client errors and 5xx server errors.

  4. Headers · Essentials · 10 min

    Understand request and response header fields: content negotiation, metadata, client hints and custom headers.

  5. Bodies and content types · Essentials · 10 min

    Describe and parse message bodies correctly with Content-Type: JSON, form encodings, multipart uploads, text and binary data.

Connections and protocols

  1. TCP, TLS and HTTPS · Practical · 12 min

    Understand the connection under HTTP: the TCP handshake, the TLS handshake, certificates, and why HTTPS is the default.

  2. HTTP/2 and HTTP/3 · Advanced · 14 min

    Learn how HTTP/2 multiplexes requests over one connection, why HTTP/3 moved to QUIC over UDP, and what that changes for you.

  3. WebSockets and server-sent events · Advanced · 14 min

    Push data from server to client in real time with server-sent events, or open a two-way channel with WebSockets.

  4. Inside TLS 1.3 · Expert · 16 min

    Go through the TLS 1.3 handshake in detail: key exchange, SNI, ALPN, certificate chains, session resumption, 0-RTT and forward secrecy.

State, caching and cross-origin

  1. Cookies and sessions · Practical · 12 min

    Keep state across stateless requests with Set-Cookie, and secure cookies with HttpOnly, Secure, SameSite, Domain, Path and expiry.

  2. HTTP caching basics · Practical · 14 min

    Control browser and proxy caching with Cache-Control, and revalidate efficiently with ETag, Last-Modified and 304 responses.

  3. Same-origin policy and CORS · Practical · 14 min

    Understand why browsers block cross-origin reads, and how servers opt in with Access-Control-Allow-* headers and preflight requests.

  4. Authentication over HTTP · Practical · 12 min

    Send credentials with the Authorization header (Basic, Bearer tokens, API keys) and use 401, 403 and WWW-Authenticate correctly.

Designing HTTP APIs

  1. Designing REST APIs · Practical · 14 min

    Model resources with nouns and URLs, map operations to methods and status codes, and return consistent JSON and errors.

  2. Pagination, idempotency and versioning · Advanced · 14 min

    Handle large collections, safe retries, rate limits and API evolution with cursor pagination, idempotency keys, 429 and versioning.

Security and scale

  1. CDNs, proxies and load balancers · Advanced · 12 min

    See how reverse proxies, load balancers and CDNs sit between users and your servers, and how caching headers control what CDNs keep.

  2. HTTPS everywhere and security headers · Advanced · 14 min

    Harden sites with HSTS, Content-Security-Policy, frame protection, Referrer-Policy and safe cookie defaults.

  3. Advanced caching: Vary, keys and revalidation · Expert · 16 min

    Master cache keys, Vary, stale-while-revalidate, stale-if-error, heuristic freshness and invalidation strategies across browser and CDN layers.

  4. Network performance end to end · Expert · 16 min

    Reason about latency, bandwidth and round trips, and apply connection reuse, compression, early hints, prioritisation and prefetching.