Free & open · no paywall, ever

IntegrAuth Academy

Identity, security and practical AI — free, from zero. Byte-sized lessons, real diagrams, hands-on labs, zero fluff. Two programs, each with its own exam and certificate.

20 tracks 241 lessons 242 hands-on labs 230+ diagrams 100% free

English is hard? Your browser can translate this page into Tamil, Telugu, Kannada, Malayalam or Hindi. Tech words stay in English so you learn the real names.

How?
  • Chrome on phone: ⋮ menu → Translate
  • Chrome on computer: right-click → Translate to …
  • Edge: the translate icon in the address bar
Identity & API Security Track 0 · The Absolute Basics
0/166 lessons read
THE ABSOLUTE BASICS · LESSON 2

HTTP — how browsers and servers talk

In lesson 1 a browser asked and a server answered. Browsers and servers use one simple language for this, called HTTP. Your goal: read a request and a response and say what each part means.

Key points
  • You send a request. You get a response.
  • The method is a verb: GET reads, POST creates, PUT replaces, DELETE removes.
  • The status code says how it went: 2xx worked, 4xx your mistake, 5xx server's mistake.
  • HTTP forgets you after every request.

A request has four parts

A request is a message to the server. It has up to four parts.

  • The method says what you want to do.
  • The path says which thing you want.
  • The headers are extra notes.
  • The body is data you send. It is not always there.

The response comes back. It has a status code, its own headers, and usually a body. The status code is a number that says how it went. The body holds the page or the data.

The four everyday methods

The method is a verb. It says if you want to read, create, replace or remove something. Think of ordering at a restaurant.

GET — read

"Show me the menu." You only look. A GET should never change anything.

POST — create

"I would like to place an order." You make something new: a booking, a comment, a sign-up.

PUT — replace

"Change my whole order to this." You swap an old thing for a new version.

DELETE — remove

"Cancel my order." You remove something.

The answer is a number

The server answers with a three-digit status code. The first digit tells you the family. You do not need to learn hundreds of codes. Learn the families.

FamilyMeaningExamples
2xxIt worked.200 OK, 201 Created
3xxGo look somewhere else.a redirect to another address
4xxThe request has a problem (your side).401 who are you? · 403 not allowed · 404 not found
5xxThe server has a problem (not your fault).500 something broke

Three codes from the 4xx family appear often in identity work.

  • 401 Unauthorized means "I do not know who you are."
  • 403 Forbidden means "I know who you are, but you may not do this."
  • 404 Not Found means "there is nothing here."
Think of it like…

an envelope. The headers are notes on the outside, like "fragile" or "from Maya". The body is the letter inside. The server reads the outside notes first.

Priya's browserServer1 · GET /flights — I'd like the list2 · 200 OK + the flights list3 · GET /bookings — nothing says who I am4 · 401 — and you are…?
Figure — Request in, response out. A public list comes back as 200. But ask for something personal with nothing to prove who you are, and the server answers 401. The web needs a way to remember you.
Story time

Priya loads the flights page with GET /flights. It works: 200 OK. The page is public, so nobody asks questions. Then she clicks "my bookings". The server answers 401: "Who are you?" A moment ago she logged in. Why does the server not know her now?

Watch out

This is the key problem of online identity. HTTP is stateless. Each request stands alone. The server has no memory of the last one. It forgot Priya as soon as it answered. The next lesson shows the fix.

🧪 Interactive lab — enable JavaScript to play with this one.

🧪 Try it free

See real status codes. Send a request to any address with Redirect Check. You will see the 3xx hops and the final 2xx or 4xx, just like in this lesson.