HTTPS Under the Hood

Spohsv

1 min read

·

Feb 7, 2026

--

Listen

Share

What is HTTP?

HTTP (HyperText Transfer Protocol) is the foundation of data communication on the web.

What does HTTP do?

It defines how data is exchanged between a client (browser, mobile app) and a server, including:

• Request methods (GET, POST, PUT, DELETE, etc.)
• Headers and status codes
• Cookies and session handling
• Caching rules
• Request and response bodies

The Problem with HTTP

With plain HTTP, data is sent in clear text:

Client ── plaintext ──> Server

Anyone who can see the network traffic can:

• Read sensitive data (passwords, form inputs)
• Steal session cookies
• Modify responses (inject ads or malware)
• Perform Man-in-the-Middle (MITM) attacks

In short: HTTP is fast, but not safe.

How HTTPS Fixes This

HTTPS = HTTP + TLS (Transport Layer Security)

Client ── encrypted ──> Server

HTTPS provides three critical security guarantees:

1. Confidentiality

All data is encrypted.
Eavesdroppers only see meaningless bytes.

2. Integrity

Data cannot be altered in transit without being detected.

3. Authentication

You are communicating with the real server, verified using digital certificates issued by trusted Certificate Authorities (CAs).

🤝 HTTPS Handshake (high level)
Client → Server: Hello (supported ciphers)
Server → Client: Certificate + public key
Client:
— Verifies certificate (CA)
— Generates session key
— Encrypts it using server public key
Server:
— Decrypts using private key
Secure symmetric encryption begins

After this, all HTTP data is encrypted.