Art of Codeartofcode
Lesson 9 of 18

3. Client and Server

1
The picture to keep in your head
2
3.1 What exactly are a client and a server?
3
3.2 What's a request and a response?
4
3.3 What happens when you type a URL and press Enter?
5
3.4 What do GET, POST, PUT, PATCH and DELETE mean?
6
3.5 What do status codes tell you?
7
3.6 What goes in the headers and what goes in the body?
8
3.7 What's the difference between TCP and UDP?
9
3.8 How does HTTPS keep the conversation private?
10
3.9 Why do keep-alive, HTTP/2 and HTTP/3 make things faster?
11
3.10 What does "stateless" mean, and why do we want it?
12
3.11 How do cookies, sessions and tokens remember who you are?
13
Memory card and where the analogy breaks
14
Practice: five levels
15
Interview questions
16
Solutions
17
Sources
18
Code lab
3. Client and Server

3.8 How does HTTPS keep the conversation private?

3 min read+10 XP

In the restaurant: Before you hand over your order and card, you check the waiter's staff badge, so you know they really work here. Then everything goes in a sealed envelope only the kitchen can open.

In the system: HTTPS is HTTP inside TLS (Transport Layer Security). TLS gives three things:

  1. Identity: the server shows a certificate, signed by a certificate authority your device already trusts, proving it really is shop.example.com. That's the badge.
  2. Privacy: everything is encrypted, so anyone in between (public Wi-Fi, your ISP) sees scrambled bytes.
  3. Integrity: if anyone changes the bytes on the way, the other side notices.

How it works, simplified:

  • During the TLS handshake, client and server use public-key cryptography to agree on a shared secret key without ever sending it in the open.
  • After that, they encrypt everything with that shared key using fast symmetric encryption.
  • TLS 1.3, the current version, does the full handshake in one round trip (TLS 1.2 needed two).

What it doesn't hide: the IP addresses, roughly how much data moves, and usually the website's name (sent during the handshake). The path, headers and body are hidden.

Memory code: "Check the badge, then seal the envelope." Certificate first, encryption after.