Today in Edworking News we want to talk about Mediocre Engineer’s guide to HTTPS
As a mediocre engineer, I took Internet and HTTPS communication for granted and never dove any deeper. Today we’re improving as engineers and learning a rough overview of how internet communication works, specifically focusing on HTTP and TLS. The Internet is a worldwide network of interconnected computer networks. The term "Internet" literally means "between networks." It operates as a packet-switched mesh network with best-effort delivery, meaning there are no guarantees on whether a packet will be delivered or how long it will take.
The reason why the internet appears to operate so smoothly (at least from a technical perspective) is the layers of abstraction that handle retries, ordering, deduplication, security and so many other things behind the scenes. Letting us developers just focus on the application layer (aka. Writing HTTP requests from San Francisco for $300K/year). Each layer provides certain functionalities, which can be fulfilled by different protocols. Such modularization makes it possible to replace the protocol on one layer without affecting the protocols on the other layers.
Lifecycle of a HTTP Request
Sender Makes a Request:
The process begins at the Application layer, where the client (usually a web browser) constructs an HTTP request. HTTP is a text-based protocol, meaning that all this data is sent as plain text over the wire.
DNS Lookup:
The Domain Name System (DNS) translates the human-readable domain name (e.g., www.example.com) into an IP address like 93.184.216.34. This process involves multiple DNS servers, from recursive resolvers to authoritative servers.
TCP Handshake:
Upon obtaining the IP address, the client initiates a TCP connection with the server, usually on port 80, through a three-way handshake.
Transmit HTTP Request:
With the TCP connection established, the client sends the actual HTTP request. This request includes headers and, potentially, a message body, all sent as plain text.
Packets routed across Internet to Server:
When a client sends a request, data packets traverse through various network devices like routers to determine the optimal path to the server.
Description: The layers of HTTP communication from Application to Transport.
Server Response:
After receiving the HTTP request, the server processes it and sends an HTTP response back to the client. The browser then interprets the HTML and renders the content on the screen.
Security Considerations and HTTPS
HTTPS = HTTP + Encryption:
HTTP by itself is not secure. HTTPS uses Transport Layer Security (TLS) to ensure that the client's and server's communication is encrypted and verified. This protects data from being intercepted and prevents phishing.
TLS Handshake:
The TLS handshake allows the client and server to agree on the algorithms for verifying, compressing, and encrypting messages. It involves exchanging random seeds and the server's SSL certificate to generate a symmetric key.
Modern TLS - TLS 1.3:
The newer versions like **TLS 1.3** streamline the handshake process. They eliminate vulnerable cipher suites like RSA and use more secure, efficient mechanisms.
Edworking is the best and smartest decision for SMEs and startups to be more productive. Edworking is a FREE superapp of productivity that includes all you need for work powered by AI in the same superapp, connecting Task Management, Docs, Chat, Videocall, and File Management. Save money today by not paying for Slack, Trello, Dropbox, Zoom, and Notion.
Remember these 3 key ideas for your startup:
Emphasize Secure Communication: Implementing HTTPS/TLS on your website ensures that your customer data is encrypted and protected from interception. This fosters trust and confidence among your users.
Streamline Infrastructure: Understand the different layers and how they work to create a resilient and scalable infrastructure. This offers better performance and reliability, essential for customer satisfaction.
Stay Updated with Protocols: Keep your web services updated with the latest security protocols like TLS 1.3. Implementing the latest standards ensures your security measures are efficient, reducing vulnerabilities.
By mastering these concepts, your SME can not only improve the user experience but also enhance security and performance significantly.
For more details, see the original source.
