Easier to read with cream paper, a tint, more contrast or larger text? Choose your colours and text, once, for every page.

Free lesson

Following a page from request to reply (HTTP)

After this lesson: I can follow a web page from the request to the reply.

45 min lesson3 commandsWeb server hardening lab: fix a weak nginx configuration and check it with curl

What happens when you tap a link

You tap a link to a game's patch notes. Less than a second later, the page is on your screen.

In that second your phone asked another computer for the page, and that computer answered. Today you watch that conversation happen, one line at a time.

By the end of this lesson

Note

I can follow a web page from the request to the reply.

Key words

WordWhat it meansExample
Web servera program that hands out web pages
Requestwhat a browser sends to ask for something
Replywhat the server sends back, also called a response
HTTPthe rules a browser and a server follow to talk
Status codea three-digit number that says how a request went404
Headera line of extra information about a request or a replyServer: nginx

The cells students fill in are left blank in this preview.

Before you start

Note

Press Start the lab on the bar at the top, then wait until it says it is running. The lab is a small bakery website, and your terminal reaches it by the name web. This copy is yours alone and has no way out to the internet. Only send requests to your own copy.

A browser asks and a server answers

A web page lives on a web server. Your browser sends it a request, and the server sends back a reply. Both follow the same rules, called HTTP.

The address of a page is its URL, such as http://web/files/. In the lab you use curl, a program that sends a request and prints the reply as text.

Ask only for the reply's headers

Command
curl -s -I http://web

Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.

Reading the headers

-I asks for the headers and not the page. The first line, HTTP/1.1 200 OK, says the request worked.

Each line after it is a header. Server: nginx/1.27.5 names the server program. Content-Type: text/html says the reply is a web page. Content-Length: 145 says the page is 145 bytes long.

Every reply starts with a status line

The first line of a reply is the status line. It has three parts, split by spaces: the version of HTTP, the status code and a few words for people.

A program only needs the code. The words can be more than one word long, so a program splits the line at the first two spaces only.

Worked example: splitting a status line

Status lineVersionCodeWords
HTTP/1.1 200 OKHTTP/1.1200OK
HTTP/1.1 404 Not FoundHTTP/1.1404Not Found
HTTP/1.1 405 Not AllowedHTTP/1.1405Not Allowed

The cells students fill in are left blank in this preview.

Ask for a page that is not there

Command
curl -s -I http://web/nothing-here | head -n 1

Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.

Status codes come in groups

First digitMeaningExample
2It worked200 OK
3It has moved: look somewhere else301 Moved Permanently
4The request was wrong404 Not Found, 405 Not Allowed
5The server went wrong500 Internal Server Error

The cells students fill in are left blank in this preview.

Ask the server to delete its home page

Command
curl -s -I -X DELETE http://web/ | head -n 1

Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.

A common mistake

Warning

Many people think a 404 means the website is down. A 404 is an answer, so the server is working. It just has no page at that address. When a server is really down, no status code comes back at all.

Going further: a page that moved

Type curl -s -I http://web/files | head -n 1 in the terminal. There is no slash at the end of the address. Which group is the code in?

Then type curl -s -I http://web/files | grep -i "^location". That header tells the browser where to go instead. Why do you think the server sent it?

About this lab and its source: Web server hardening lab: fix a weak nginx configuration and check it with curl

Teaching a class? Set this module for your students with a teacher guide, marked assignments and a lab for every student.