Client-Side Web TechnologiesIntroduction to HTTP

MIME• Multipurpose Internet Mail

Extensions• Introduced in 1996• Created to extend email to

support:• Text in character sets other than ASCII• Non-text content• Multi-part message bodies• Header info in non-ASCII character sets

http://www.maran.com/dictionary/m/mime/image.gif

MIME Header Fields• MIME-Version

• Declares version of message body format standard in use• Content-Type

• Describes the data contained in the body• Content-Disposition

• Describes how a body part should be presented (e.g. inline or attachment)

• There are others but we won’t discuss them…

MIME Content-Type• Describes the data in the body of a MIME entity• Consists of:

• Top level media type• Declares the general type of data

• Subtype• Specifies a specific format for that type of data

• Parameters that modify the subtype (optional)• Due to expanded use, now known as Internet Media

Types• IANA maintains the list of registered Media Types:

• http://www.iana.org/assignments/media-types

Top-Level Media Types• Text

• Textual information• Image

• Image data• Audio

• Audio data• Video

• Video data• Application

• Some other kind of data (typically binary, to be processed by some application)

• Multipart• Data consisting of multiple entities of independent data types

• Subtypes such as mixed, alternative, byteranges, and form-data (for HTML forms)

MIME Message ExamplesFrom: John Doe <example@example.com>Subject: Hello

MIME-Version: 1.0

Content-Type: text/plain;

This is a message in MIME format.

From: John Doe <example@example.com>

Subject: Hello

MIME-Version: 1.0

Content-Type: multipart/mixed;

boundary=“XXXXboundary”

--XXXXboundary

Content-Type: text/plain;

this is the body text

--XXXXboundary

Content-Type: text/plain;

Content-Disposition: attachment;

filename="test.txt"

this is the attachment text

--XXXXboundary--

Client-Server Model

• Method of computer network programming

• Running software applications are assigned one of two possible roles –client or server

Server Applications

• Receive and handle service requests from clients (often multiple clients)

• Typically run on separate, more powerful machines than clients

• Examples: web server applications like Apache, Tomcat, Node.js, and IIS

Client Applications

• Initiate service requests to servers• Typically run on separate, less powerful

machines than servers• Examples: web browsers like Firefox

and Chrome

HTTP• Hypertext Transfer Protocol• Operates at the Application layer in TCP/IP

and OSI models• Consists of client requests and server

responses

HTTP (continued)• HTTP/1.1

• Standardized in 1999• Most commonly used standard • Defined in IETF RFC[7230 – 7235]• https://tools.ietf.org/html/rfc7230

• HTTP/2.0 • Standardized in 2015• Attempts to solve performance issues with 1.1• Defined in IETF RFC 7540• https://tools.ietf.org/html/rfc7540• Will discuss later in the course

HTTP Request Message• Request-Line

• Method• URI• Protocol version

• Header fields (optional)• Message-Body (optional)

HTTP Response Message• Status-Line

• Protocol version• Status code

• Header fields (optional)• Message-Body (optional)

HTTP Common MethodsMethod Use Action Type*OPTIONS Request information about HTTP methods supported by the

serversafeidempotent

GET Retrieve the resource identified by the request URI safeidempotent

HEAD Identical to GET but with no message-body in response safeidempotent

POST Request that the target resource process the representation enclosed in the request according to the resource's own specific semantics

NOT safeNOT idempotent

PUT Request that the server store the enclosed entity under the request URI (replacing an existing version if it exists)

NOT safeidempotent

DELETE Request that the server delete the resource identified by the request URI

NOT safeidempotent

* Safe actions should retrieve information/resources only; idempotent actions should produce the same results if executed once or multiple times

URI• Uniform Resource Identifier• String of characters used to identify a

resource• Examples:

• ftp://ftp.is.co.za/rfc/rfc1808.txt

• http://www.ietf.org/rfc/rfc2396.txt

• urn:isbn:0451450523

URL• Uniform Resource Locator• URLs are a subset of URIs that also provide

means of locating the resource by describing its primary access mechanism (e.g. http, ftp, etc.)

• The terms URL and URI are often used interchangeably

• Examples:• ftp://ftp.is.co.za/rfc/rfc1808.txt

• http://www.ietf.org/rfc/rfc2396.txt

• urn:isbn:0451450523

HTTP URLs

"http:" "//" host [":" port] [ abs_path ["?" query]]

*If no port given, then 80 is assumed (443 for HTTPS)

Examples:http://www.google.com/calendar?tab=wchttp://localhost:8080/MyWebApp/index.jsp

HTTP Status Code ClassesClass Use Example(s)1xx Information 100 Continue

2xx Success 200 OK

3xx Redirection 301 Moved Permanently304 Not Modified

4xx Client Error 400 Bad Request403 Forbidden404 Not Found405 Method Not Allowed

5xx Server Error 500 Internal Server Error503 Service Unavailable

HTTP General Headers(a subset, there are others)

Header Field Use Example Value(s)Cache-Control Rules that must be used by all

caching mechanismsno-cachemax-age

Connection Specifies options that are desired for a particular connection

closekeep-aliveupgrade

Date Specifies date and time at which message was generated

Tue, 15 Nov 1994 08:12:31 GMT

Transfer-Encoding

Specifies what type of transformation has been applied to the message body

chunked

Upgrade Specifies what additional application layer protocols client can support and would like to use

HTTP/2.0websocket

HTTP Request-Specific Headers(a subset, there are others)

Header Field Use Example Value(s)

Accept Specifies media types that are acceptable for the response

text/htmlimage/png, image/*;q=0.8, */*;q=0.5

Accept-Language

Specifies set of natural languages that are acceptable in the response

en-US, en;q=0.5

Accept-Encoding

Specifies content-codings that are acceptable in the response

gzip, deflate

Range Specifies that a sub-range of the entity be returned

bytes=0-10

Host Specifies the Internet host and port number of requested resource

www.google.com127.0.0.1:8080

Cookie Sends stored cookies to server name=value; name2=value2

User-Agent Specifies information about user agent (e.g. browser) making the request

Mozilla/5.0 (compatible; MSIE 9.0;Windows NT 6.1; Win64; x64; Trident5.0)

HTTP Response-Specific Headers(a subset, there are others)

Header Field Use Example Value(s)

Age Specifies the sender's estimate of the amount of time (in seconds) since the response was generated by the origin server

464500

Accept-Ranges

Indicates the server's acceptance of range requests for a resource

bytesnone

Location Used to redirect recipient to a location other than the request URI

http://www.w3.org/pub/WWW/People.html

Server Specifies information about the software used by the server to handle the request

ApacheMicrosoft-IIS/7.5

Set-Cookie Sends a cookie from the server to the client

name=value; Expires=Wed, 13-Jan-202122:23:01 GMT

name2=value2

HTTP Entity Headers(a subset, there are others)

Header Field Use Example Value(s)

Content-Type

Specifies the media type of the entity-body sent in the response

text/htmlimage/png

Content-Language

Specifies the natural language of the intended audience of the enclosed entity-body

en-USda

Content-Encoding

Specifies what content-codings have been applied to the entity-body

gzipdeflate

Content-Range

Specifies where in the full entity-body the partial body sent should be applied

bytes 0-10/500bytes 0-499/1234

Content-Length

Specifies the size of the entity-body sent in the response in decimal number of OCTETs (i.e. bytes)

11500

Allow Lists the set of methods supported by the resource identified by the request URI (used when a Method Not Allowed response is sent)

GET,HEAD,POST,OPTIONSGET,POST

HTTP Request Message ExampleGET /calendar?tab=wc HTTP/1.1 Host: www.google.comUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS

X 10.7; rv:18.0) Gecko/20100101 Firefox18.0 Accept: text/html,application/xhtl+xml,application/

xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive

HTTP Response Message Example

HTTP/1.1 200 OK Cache-Control: private, max-age=0 Content-Encoding: gzipContent-Type: text/html; charset=UTF-8 Date: Mon, 11 Feb 2013 20:15:16 GMT Expires: -1 Server: gws

<DOCTYPE html><HTML lang=“en”>...</HTML>

Netcat• Network utility for TCP and UDP connections• Originally a UNIX program, now available for

many operating systems• If you are using Mac OS X you should already

have it• If using Windows, you can obtain it here:

http://www.securityfocus.com/tools/139• Netcat is great for creating our own HTTP 1.1

requests

Ncat

• Ncat is a reimplementation of Netcatwith added features

• Supports SSL so we can generate HTTPS requests with it

• Available for Mac OS X and Windows: http://nmap.org/ncat/

Postman

• Tool for working with APIs• Use to make HTTP 1.1 requests• Supports SSL so we can generate

HTTPS requests with it• Available for Mac OS X and Windows• https://www.getpostman.com/• Standalone app or Chrome extension

Wireshark

• Network protocol analyzer• Allows us to capture network traffic• Available for Mac OS X and Windows:

http://www.wireshark.org/