Day8 in System Designing

With the transport layer protocol (TCP or UDP) established, we move up to the Application Layer to look at HTTP (Hypertext Transfer Protocol) . This is the universal language of the web, defining exactly how clients and servers structure their messages. 1. HTTP Methods (Verbs) HTTP methods indicate the desired action to be performed on a given resource. Designing clean APIs requires using these correctly based on their properties: Idempotency and Safety . GET : Retrieves data from the server. It is safe (should not modify data) and idempotent (making multiple identical requests returns the exact same result without side effects). POST : Submits data to the server to create a new resource or trigger a process. It is neither safe nor idempotent (sending the same POST request twice will typically create two separate database entries). PUT : Replaces an existing resource entirely, or creates it if it doesn't exist. It is idempotent because replacing an object with the exact same data multiple times leaves the system in the same state. PATCH : Applies partial modifications to a resource (e.g., updating just a user's email address). It is generally not idempotent . DELETE : Removes a resource. It is idempotent because deleting an object that is already gone still results in the object being gone. 2. HTTP Status Codes The server uses three-digit status codes to communicate the outcome of a request back to the client. Category Meaning Common Examples 2xx Success The action was successfully received and accepted. 200 OK : Request succeeded. 201 Created : Resource successfully created via POST/PUT. 3xx Redirection Further action needs to be taken by the client. 301 Moved Permanently : The URL has changed permanently. 304 Not Modified : Cached version is still valid. 4xx Client Error The request contains bad syntax or cannot be fulfilled. 400 Bad Request : Invalid payload syntax. 401 Unauthorized : Lacks valid authentication. 403 Forbidden : Authenticated, but lacks permissions. 404 Not Found : Resource does not exist. 5xx Server Error The server failed to fulfill an apparently valid request. 500 Internal Server Error : The backend code crashed. 502 Bad Gateway : Upstream server/proxy failure. 504 Gateway Timeout : Upstream took too long to respond. 3. HTTPS (HTTP + TLS) Standard HTTP transmits data in clear, unencrypted text. Anyone sitting on the same Wi-Fi network or network hop can read it (a Man-in-the-Middle attack). HTTPS (Hypertext Transfer Protocol Secure) wraps all HTTP data inside a TLS (Transport Layer Security) encryption tunnel. Encryption: Asymmetric encryption (Public/Private keys) is used to safely establish a symmetric session key. All headers, URLs, and body payloads are completely encrypted. Authentication: The server provides an SSL/TLS Certificate verified by a trusted Third-Party Certificate Authority (CA). This proves to the client that the server is actually who it claims to be. 4. The Evolution: HTTP/1.1 vs. HTTP/2 vs. HTTP/3 As modern websites grew to require downloading hundreds of assets simultaneously, the underlying mechanisms of HTTP had to evolve to eliminate network bottlenecks. HTTP/1.1 (The Baseline) How it works: Opens a single TCP connection per request, or serializes them sequentially using Keep-Alive . The Flaw: Head-of-Line (HOL) Blocking . If a large image takes 5 seconds to download, every other asset queued behind it on that connection is completely blocked. HTTP/2 (Multiplexing) How it works: Introduced a binary framing layer that breaks data into small frames, allowing Multiplexing over a single TCP connection. The Benefit: The browser can request HTML, CSS, JS, and images all at the exact same time without waiting for the previous request to finish. The Flaw: It fixed HOL blocking at the application layer, but if a single TCP packet is dropped at the network layer, TCP freezes all streams until that missing packet is retransmitted. HTTP/3 (QUIC-based) How it works: Drops TCP entirely and runs on top of QUIC (which uses UDP ). The Benefit: Resolves TCP-level Head-of-Line blocking. Because QUIC manages streams independently, if a packet belonging to an image stream is dropped, your CSS and JS streams keep downloading completely unaffected. It also integrates the TLS handshake directly into the connection setup, drastically reducing latency. 5. System Design Takeaway When building high-traffic architectures, your edge routing handles these protocol differences: Nginx / Cloudflare / AWS ALBs sit at the perimeter to accept modern HTTP/2 or HTTP/3 connections from users. They perform TLS Termination (decrypting the traffic at the gateway). Inside your internal data center, they route standard, lightweight HTTP/1.1 requests directly to your Node.js or Microservice backends, saving your application servers from processing encryption overhead.