Server ▪ Effect of typing http://www.vub.be in the browser bar (1) (2) (3) (4) September 29, 2026 use a Domain Name Service (DNS) to get the IP address for www.vub.be (answer 134.184.255.9) create a TCP connection to 134.184.255.9 send an HTTP request message over the TCP connection visualise the received HTTP response message in the browser Beat Signer - Department of Computer Science - [email protected] 2
(2) receive and process HTTP request (3) fetch resource (4) create and send HTTP response (5) logging (1) Worldwide Web Servers, https://news.netcraft.com ▪ The most prominent web servers are nginx, Cloudflare and the Apache HTTP Server ▪ A lot of devices have an embedded web server ▪ printers, WLAN routers, TVs, ... September 29, 2026 Beat Signer - Department of Computer Science - [email protected] 3
Response ▪ ▪ Communication always must be initiated by the client ▪ Stateless protocol (no sessions) ▪ HTTP can be used on top of various reliable protocols TCP is by far the most commonly used one ▪ runs on TCP port 80 by default ▪ ▪ HTTPS scheme used for encrypted connections September 29, 2026 Beat Signer - Department of Computer Science - [email protected] 6
uniquely identifies a resource ▪ There are two types of URIs ▪ Uniform Resource Locator (URL) - contains information about the exact location of a resource - consists of a scheme, a host and the path (resource name) - e.g. https://vub.academia.edu/BeatSigner - problem: the URL changes if resource is moved! • Persistent Uniform Resource Locators (PURLs) [https://archive.org/services/purl/] ▪ Uniform Resource Name (URN) - unique and location independent name for a resource - consists of a scheme name, a namespace identifier and a namespace-specific string (separated by colons) - e.g. urn:ISBN:978-3837027136 September 29, 2026 Beat Signer - Department of Computer Science - [email protected] 7
" " , resource , " " , version; method = "GET" | "HEAD" | "POST" | "PUT" | "TRACE" | "OPTIONS" | "DELETE"; resource = complete_URL | path; version = "HTTP/" , major_version, "." , minor_version; ▪ Methods ▪ ▪ ▪ ▪ ▪ ▪ ▪ GET: get a resource from the server HEAD: get the header only (no body) POST: send data (in the body) to the server PUT: store request body on server TRACE: get the "final" request (after it has potentially been modified by proxies) OPTIONS: get a list of methods supported by the server DELETE: delete a resource on the server September 29, 2026 Beat Signer - Department of Computer Science - [email protected] 9
and responses), request headers, response headers, entity headers and extension headers ▪ Some important headers ▪ Accept - request header defining the Media Type (formerly MIME type) that the client will accept ▪ User-Agent - request header specifying the type of client ▪ Keep-Alive (HTTP/1.0) and Persistent (HTTP/1.1) - general header helping to improve the performance since otherwise a new HTTP connection has to be established for every single webpage element ▪ Content-Type - entity header specifying the body's MIME type September 29, 2026 Beat Signer - Department of Computer Science - [email protected] 11
If-Modified-Since - request header that is used in combination with a GET request (conditional GET); the resource is only returned if it has been modified since the specified date September 29, 2026 Beat Signer - Department of Computer Science - [email protected] 12
request or response body's content (used for appropriate processing) ▪ 7 top-level media types mediaType = toplevel_type , "/" , subtype; ▪ Standard Media Types are registered with the Internet Assigned Numbers Authority (IANA) [RFC-6838] Media Type Description text/plain Human-readable text without formatting information text/html HTML document image/jpeg JPEG-encoded image ... September 29, 2026 ... Beat Signer - Department of Computer Science - [email protected] 13
logging ▪ e.g. developer console window in Chrome (Ctrl+Shift+I or F12) ▪ Simple telnet connection telnet wise.vub.ac.be 80 (press Enter) GET /beat-signer HTTP/1.1 (press Enter) Host: wise.vub.ac.be (press Enter 2 times) ▪ HTTP/2 since May 2015 ▪ inspired by Google’s development of SPDY ▪ HTTP/3 since June 2022 ▪ Uses QUIC and UDP instead of TCP → better performance September 29, 2026 Beat Signer - Department of Computer Science - [email protected] 14
situated between the client and the server acts as a server to the client and as a client to the server ▪ can for example be specified in the browser settings; used for ▪ - firewalls and content filters - transcoding (on-the-fly transformation of HTTP message body) - content router (e.g. select optimal server in content distribution networks) - anonymous browsing, ... September 29, 2026 Beat Signer - Department of Computer Science - [email protected] 15
Proxy Cache Server ▪ A proxy cache is a special type of proxy server can reduce server load if multiple clients share the same cache ▪ often multi-level hierarchies of caches (e.g. continent, country and regional level) with communication between sibling and parent caches as defined by the Internet Cache Protocol (ICP) ▪ passive or active (prefetching) caches ▪ September 29, 2026 Beat Signer - Department of Computer Science - [email protected] 16
Expires - expiration date after which the cached resource has to be refetched ▪ Cache-Control: max-age - maximum age of a document (in seconds) after it has been added to the cache ▪ Cache-Control: no-cache - response cannot be directly served from the cache (has to be revalidated first) ▪ ... ▪ Validators ▪ Last-modified time as validator - cache with resource that has been last modified at time t uses an If-Modified-Since t request for updates ▪ Entity tags (ETag) - changed by the publisher if content has changed; If-None-Match etag request September 29, 2026 Beat Signer - Department of Computer Science - [email protected] 17
▪ reduces server load (client and reverse proxy caches) ▪ transparent to client and server ▪ ▪ Disadvantages additional resources (hardware) required ▪ might get stale data out of the cache ▪ creates additional network traffic if we use an active caching approach (prefetching) but achieve a low cache hit rate ▪ server loses control (e.g. access statistics) since no longer all requests have to be sent to the server ▪ September 29, 2026 Beat Signer - Department of Computer Science - [email protected] 18
Server ▪ Transmit one protocol encapsulated inside another protocol ▪ e.g. HTTP as a carrier for SSL connections ▪ Often used to "open" a firewall to protocols that would otherwise be blocked ▪ e.g. tunnelling of SSL connections through an open HTTP port September 29, 2026 Beat Signer - Department of Computer Science - [email protected] 19
▪ A gateway can act as a kind of "glue" between applications (client) and resources (server) translate between two protocols (e.g. from HTTP to FTP) ▪ security accelerator (e.g. HTTPS/HTTP on the server side) ▪ often the gateway and destination server are combined in a single application server (HTTP to server application translator) ▪ September 29, 2026 Beat Signer - Department of Computer Science - [email protected] 20
(state) tracking solutions ▪ use of IP address - problem: IP address is often not uniquely assigned to a single user ▪ browser login - use of special HTTP authenticate headers - after a login the browser sends the user information in each request ▪ URL rewriting - add information to the URL in each request ▪ hidden form fields - similar to URL rewriting but information can also be in body (POST request) ▪ cookies - the server stores a piece of information on the client which is then sent back to the server with each request September 29, 2026 Beat Signer - Department of Computer Science - [email protected] 21
cookie is a piece of information that is assigned to a client on their first visit list of <key,value> pairs ▪ often just a unique identifier ▪ sent via Set-Cookie HTTP response headers ▪ ▪ Browser stores the information in a "cookie database" and sends it back every time the same server is accessed ▪ Potential privacy issues persistent cookies with long lifetime ▪ third-party cookies for user tracking across different websites ▪ ▪ Cookies can be disabled in the browser settings September 29, 2026 Beat Signer - Department of Computer Science - [email protected] 22
Signer: Cross-Media Technology, DataPhys, ...</title> </head> <body> Beat Signer is Professor of Computer Science at the VUB and director of the WISE laboratory ... </body> </html> ▪ Dominant markup language for webpages ▪ If you never heard about HTML have a look at ▪ https://www.w3schools.com/html/ ▪ More details in lecture 4 and the exercise session September 29, 2026 Beat Signer - Department of Computer Science - [email protected] 23
serve static web pages but content should be changed on the client or server side ▪ Server-side processing Common Gateway Interface (CGI) ▪ Java Servlets ▪ Jakarta Server Pages (JSP) ▪ PHP: Hypertext Preprocessor (PHP) ▪ Node.js ▪ … ▪ ▪ Client-side processing JavaScript ▪ Java Applets ▪ ... ▪ September 29, 2026 Beat Signer - Department of Computer Science - [email protected] 24
Tcl, C, C++, Java, .. Internet HTTP Response Client HTML Pages Server ▪ CGI was the first server-side processing solution transparent to the user ▪ certain requests (e.g. /account.pl) are forwarded via CGI to a program by creating a new process ▪ program processes the request and creates an answer with optional HTTP response headers ▪ September 29, 2026 Beat Signer - Department of Computer Science - [email protected] 25
process has to be started for each request ▪ if the CGI program for example acts as a gateway to a database, a new DB connection has to be established for each request which results in a very poor performance ▪ ▪ FastCGI solves some of the problems by introducing persistent processes and process pools ▪ CGI/FastCGI became more and more replaced by other technologies (e.g. Java Servlets) September 29, 2026 Beat Signer - Department of Computer Science - [email protected] 26
Client HTML Pages Web Server ▪ A Java servlet is a Java class that has to extend the abstract HTTPServlet class ▪ The Java servlet class is loaded by a servlet container and relevant requests (based on a servlet binding) are forwarded to the servlet instance for further processing September 29, 2026 Beat Signer - Department of Computer Science - [email protected] 27
resp) doPost(HttpServletRequest req, HttpServletResponse resp) init(ServletConfig config) destroy() ▪ Servlet life cycle a servlet is initialised once via the init() method ▪ the doGet(), doPost() methods may be executed multiple times (by different HTTP requests) ▪ finally the servlet container may unload a servlet (upcall of the destroy() method before that happens) ▪ ▪ Servlet container (e.g. Apache Tomcat) either integrated with web server or as standalone component September 29, 2026 Beat Signer - Department of Computer Science - [email protected] 28
is that the whole page (e.g. HTML) has to be defined within the servlet ▪ not easy to share tasks between web designer and programmer ▪ Add program code through scriptlets and markup to existing HTML pages ▪ These JSP documents are then either interpreted on the fly (Apache Tomcat) or compiled into Java servlets ▪ The JSP approach is similar to PHP or Active Server Pages (ASP) ▪ Note that Java Servlets have become more and more an enabling technology (as with JSP) September 29, 2026 Beat Signer - Department of Computer Science - [email protected] 30
functionality often embedded in HTML documents but can also be provided in separate files ▪ JavaScript often used to validate data (e.g. in a form) ▪ dynamically add content to a webpage ▪ process events (onLoad, onFocus, etc.) ▪ change parts of the original HTML document ▪ create cookies ▪ ... ▪ ▪ Note: Java and JavaScript are completely different languages! September 29, 2026 Beat Signer - Department of Computer Science - [email protected] 31
</html> ▪ More details about JavaScript in lecture 6 and in the exercise session September 29, 2026 Beat Signer - Department of Computer Science - [email protected] 32
Servlets ▪ handling post/get requests, database, sessions, … ▪ ▪ Write your entire app in one language ▪ however, server-side and client-side code still separated ▪ Built-in web server (no need for Apache, Tomcat, etc.) ▪ High modularity packages can be added for additional functionality (via npm) ▪ many available frameworks (Express, Passport, Sequelize,…) ▪ HTTP utility methods (sessions, routing, ...) ▪ template engines (Jade, EJS, …) ▪ September 29, 2026 Beat Signer - Department of Computer Science - [email protected] 33
to the client side in the form of Java bytecode and runs in a sandbox executed in the browser using a Java Virtual Machine (JVM) ▪ an applet has to extend the Applet or JApplet class ▪ ▪ Advantages the user automatically always has the most recent version ▪ high security for untrusted applets ▪ full Java API available for trusted signed applets ▪ ▪ Disadvantages requires a browser Java plug-in ▪ only signed applets can get more advanced functionality ▪ - e.g. network connections to other machines than the source machine September 29, 2026 Beat Signer - Department of Computer Science - [email protected] 34
no longer runs within the browser - less problematic security restrictions - less browser compatibility issues ▪ Math and Physics Applet Examples ▪ http://www.falstad.com/mathphysics.html September 29, 2026 Beat Signer - Department of Computer Science - [email protected] 35
framework that is designed to support the development of dynamic websites, web applications, web services and web resources. The framework aims to alleviate the overhead associated with common activities performed in web development. For example, many frameworks provide libraries for database access, templating frameworks and session management, and they often promote code reuse. [https://en.wikipedia.org/wiki/Web_application_framework] ▪ There exist dozens of web application frameworks and we will present various of these frameworks next week September 29, 2026 Beat Signer - Department of Computer Science - [email protected] 36
O'Reilly Media, September 2002 ▪ M. Belshe et al., RFC7540 - Hypertext Transfer Protocol Version 2 (HTTP/2) ▪ http://www.faqs.org/rfcs/rfc7540.html ▪ M. Bishop, RFC9114 - HTTP/3 ▪ https://datatracker.ietf.org/doc/html/rfc9114 ▪ M. Knutson, HTTP: The Hypertext Transfer Protocol (refcardz #172) ▪ https://dzone.com/refcardz/http-hypertext-transfer-0 September 29, 2026 Beat Signer - Department of Computer Science - [email protected] 38
Type Specifications and Registration Procedures ▪ http://www.faqs.org/rfcs/rfc6838.html ▪ HTML and JavaScript Tutorials ▪ https://www.w3schools.com ▪ W. Jason Gilmore, PHP 5.4 (refcardz #23) ▪ https://dzone.com/refcardz/php-54-scalable ▪ Java Servlet Tutorial ▪ https://www.tutorialspoint.com/servlets/ September 29, 2026 Beat Signer - Department of Computer Science - [email protected] 39
signer
terazawa
koheihasebe
shirayanagiryuji
bvr7352
juanmartin2026
pawan_pharm
ainischool
yatabe
shuichikishida
masakiokuda
drpoonamkc
garrettdimon
zakiyama
sarafernandez
samlambert
aarron
uxyall
lara
rabernat
kevinliebholz
reverentgeek
tammyeverts
bethany
![Tunnelling Internet SSL SSL HTTP SSL Client HTTP[SSL] HTTP[SSL] SSL](https://files.speakerdeck.com/presentations/ba54f977055840b9aa0c193390492889/slide_18.jpg){kind=link}
