分类： 系统运维
2010-08-17 10:48:52
The Hypertext Transfer Protocol (HTTP) is a for distributed, collaborative, hypermedia information systems. HTTP is the foundation of data communication for the .
HTTP functions as a protocol in the computing model. In HTTP, a , for example, acts as a client, while an application running on a computer hosting a functions as a server. The client submits an HTTP request message to the server. The server, which stores content, or provides resources, such as files and images, or generates such content on the fly, or performs other functions on behalf of the client, returns a response message to the client. A response contains completion status information about the request and may contain any content requested by the client in its message body.
A client is often referred to as a (UA). A (spider) is another example of a common type of client or user agent.
The HTTP protocol is designed to permit intermediate network elements to improve or enable communications between clients and servers. High traffic website often benefit from servers that deliver content on behalf of the original, so-called origin server to improve response time. HTTP at network boundaries facilitate communication when clients without a globally routable address are located in by relaying the requests and responses between clients and servers.
HTTP is an protocol designed within the framework of the . The protocol definitions presume a reliable protocol for host-to-host data transfer. The (TCP) is the dominant protocol in use for this purpose. However, HTTP has found application even with unreliable protocols, such as the (UDP) in methods such as the (SSDP).
HTTP are identified and located on the network by (URIs)—or, more specifically, (URLs)—using the http or . URIs and the (HTML), form a system of inter-linked resources, called documents, on the , that led to the establishment of the in 1990 by English physicist .
The original version of HTTP (HTTP/1.0) was revised in HTTP/1.1. HTTP/1.0 uses a separate connection to the same server for every request-response transaction, while HTTP/1.1 can reuse a connection multiple times, to download, for instance, images for a just delivered page. Hence HTTP/1.1 communications experience less latency as the establishment of TCP connections present considerable overhead.
The standards development of HTTP has been coordinated by the (IETF) and the , culminating in the publication of a series of (RFCs), most notably (June 1999), which defines HTTP/1.1, the version of HTTP in common use.
The term was coined by Ted Nelson who in turn was inspired by 's microfilm-based "". (Now Sir) Tim Berners-Lee first proposed the "WorldWideWeb" project — now known as the . Berners-Lee and his team are credited with inventing the original HTTP protocol along with the HyperText Markup Language (HTML) and the associated technology for a web server and a text-based web browser.
The first version of the protocol had only one method, namely GET, which would request a page from a server. The response from the server was always an HTML page.
The first documented version of HTTP was (1991). Developers extended this protocol independently as well as collaboratively by adding additional methods and header fields. officially introduced and recognized HTTP V1.0 in 1996.
Support for pre-standard HTTP/1.1 based on the then developing (called HTTP-NG) was rapidly adopted by the major browser developers in early 1996. By March 1996, pre-standard HTTP/1.1 was supported in , Netscape 2.0, Netscape Navigator Gold 2.01, Mosaic 2.7, Lynx 2.5, and in Internet Explorer 3.0. End user adoption of the new browsers was rapid. In March 1996, one web hosting company reported that over 40% of browsers in use on the Internet were HTTP 1.1 compliant. That same web hosting company reported that by June 1996, 65% of all browsers accessing their servers were HTTP/1.1 compliant. The HTTP/1.1 standard as defined in was officially released in January 1997. Improvements and updates to the HTTP/1.1 standard were released under in June 1999.
An HTTP session is a sequence of network request-response transactions. An HTTP client initiates a request. It establishes a (TCP) connection to a particular on a host (typically port 80; see ). An HTTP server listening on that port waits for a client's request message. Upon receiving the request, the server sends back a status line, such as "HTTP/1.1 200 OK", and a message of its own, the body of which is perhaps the requested resource, an error message, or some other information.
The request message consists of the following:
The request line and headers must all end with
A request line containing only the path name is accepted by servers to maintain compatibility with HTTP clients before the HTTP/1.0 specification in .
HTTP defines nine methods (sometimes referred to as "verbs") indicating the desired action to be performed on the identified resource. What this resource represents, whether pre-existing data or data that is generated dynamically, depends on the implementation of the server. Often, the resource corresponds to a file or the output of an executable residing on the server.
HTTP servers are required to implement at least the GET and HEAD methods and, whenever possible, also the OPTIONS method.[]
Some methods (for example, HEAD, GET, OPTIONS and TRACE) are defined as safe, which means they are intended only for information retrieval and should not change the state of the server. In other words, they should not have , beyond relatively harmless effects such as , , the serving of or incrementing a . Making arbitrary GET requests without regard to the context of the application's state should therefore be considered safe.
By contrast, methods such as POST, PUT and DELETE are intended for actions which may cause side effects either on the server, or external side effects such as or transmission of . Such methods are therefore not usually used by conforming or , which tend to make requests without regard to context or consequences.
Despite the prescribed safety of GET requests, in practice their handling by the server is not technically limited in any way, and careless or deliberate programming can just as easily (or more easily, due to lack of user agent precautions) cause non-trivial changes on the server. This is discouraged, because it can cause problems for , and other automated agents, which can make unintended changes on the server.
Furthermore, methods such as TRACE, TRACK and DEBUG are considered potentially 'unsafe' by some security professionals, because they can be used by attackers to gather information or bypass security controls during attacks. Security software tools such as Tenable Nessus and Microsoft URLScan report on the presence of these methods as being security issues.
Methods PUT and DELETE are defined to be , meaning that multiple identical requests should have the same effect as a single request. Methods GET, HEAD, OPTIONS and TRACE, being prescribed as safe, should also be idempotent, as HTTP is a stateless protocol.
In contrast, the POST method is not necessarily idempotent, and therefore sending an identical POST request multiple times may further affect state or cause further side effects (such as ). In some cases this may be desirable, but in other cases this could be due to an accident, such as when a user does not realize that their action will result in sending another request, or they did not receive adequate feedback that their first request was successful. While may show to warn users in some cases where reloading a page may re-submit a POST request, it is generally up to the web application to handle cases where a POST request should not be submitted more than once.
Note that whether a method is idempotent is not enforced by the protocol or web server. It is perfectly possible to write a web application in which (for example) a database insert or other non-idempotent action is triggered by a GET or other request. Ignoring this recommendation, however, may result in undesirable consequences if a assumes that repeating the same request is safe when it isn't.
In HTTP/1.0 and since, the first line of the HTTP response is called the status line and includes a numeric status code (such as "") and a textual reason phrase (such as "Not Found"). The way the handles the response primarily depends on the code and secondarily on the response headers. Custom status codes can be used since, if the user agent encounters a code it does not recognize, it can use the first digit of the code to determine the general class of the response.
Also, the standard reason phrases are only recommendations and can be replaced with "local equivalents" at the web developer's discretion. If the status code indicated a problem, the user agent might display the reason phrase to the user to provide further information about the nature of the problem. The standard also allows the user agent to attempt to interpret the reason phrase, though this might be unwise since the standard explicitly specifies that status codes are machine-readable and reason phrases are human-readable.
In HTTP/0.9 and 1.0, the connection is closed after a single request/response pair. In HTTP/1.1 a keep-alive-mechanism was introduced, where a connection could be reused for more than one request.
Such persistent connections reduce perceptibly, because the client does not need to re-negotiate the TCP connection after the first request has been sent.
Version 1.1 of the protocol made bandwidth optimization improvements to HTTP/1.0. For example, HTTP/1.1 introduced to allow content on persistent connections to be streamed, rather than buffered. further reduces lag time, allowing clients to send multiple requests before a previous response has been received to the first one. Another improvement to the protocol was , which is when a server transmits just the portion of a resource explicitly requested by a client.
HTTP is a protocol. A stateless protocol does not require the server to retain information or status about each user for the duration of multiple requests. For example, when a web server is required to customize the content of a for a user, the may have to track the user's progress from page to page. A common solution is the use of . Other methods include server side sessions, hidden variables (when the current page is a ), and URI-encoded parameters, e.g., /index.php?session_id=some_unique_session_code.
There are currently two methods of establishing a secure HTTP connection: the scheme and the HTTP 1.1 Upgrade header, introduced by . Browser support for the Upgrade header is, however, nearly non-existent, so HTTPS is still the dominant method of establishing a secure HTTP connection. Secure HTTP is notated by the prefix https:// instead of http:// on web URIs.
https is a that is, aside from the scheme token, syntactically identical to the http scheme used for normal HTTP connections, but which signals the browser to use an added encryption layer of SSL/TLS to protect the traffic. SSL is especially suited for HTTP since it can provide some protection even if only one side of the communication is . This is the case with HTTP transactions over the Internet, where typically only the is authenticated (by the client examining the server's ).
HTTP 1.1 introduced support for the Upgrade header field. In the exchange, the client begins by making a clear-text request, which is later upgraded to Transport Layer Security (TLS). Either the client or the server may request that the connection be upgraded. The most common usage is a clear-text request by the client followed by a server demand to upgrade the connection:
Client:
GET /encrypted-area HTTP/1.1
Host:
Server:
HTTP/1.1 426 Upgrade Required
Upgrade: TLS/1.0, HTTP/1.1
Connection: Upgrade
The server returns a 426 status-code because 400 level codes indicate a client failure (see ), which correctly alerts legacy clients that the failure was client-related.
The benefits of using this method for establishing a secure connection are:
A weakness with this method is that the requirement for a secure HTTP cannot be specified in the URI. In practice, the (untrusted) server will thus be responsible for enabling secure HTTP, not the (trusted) client.
Below is a sample conversation between an HTTP client and an HTTP server running on , port 80.
GET /index.html HTTP/1.1
Host:
A client request (consisting in this case of the request line and only one header) is followed by a blank line, so that the request ends with a double , each in the form of a followed by a . The "Host" header distinguishes between various names sharing a single , allowing name-based . While optional in HTTP/1.0, it is mandatory in HTTP/1.1.
HTTP/1.1 200 OK
Date: Mon, 23 May 2005 22:38:34 GMT
Server: Apache/1.3.3.7 (Unix) (Red-Hat/Linux)
Last-Modified: Wed, 08 Jan 2003 23:11:55 GMT
Etag: "3f80f-1b6-3e1cb03b"
Accept-Ranges: bytes
Content-Length: 438
Connection: close
Content-Type: text/html; charset=UTF-8
A server response is followed by a blank line and text of the requested page. The (entity tag) header is used to determine if a cached version of the requested resource is identical to the current version of the resource on the server. Content-Type specifies the of the data conveyed by the http message, while Content-Length indicates its length in bytes. The HTTP/1.1 publishes its ability to respond to requests for certain byte ranges of the document by setting the header Accept-Ranges: bytes. This is useful if the client needs to have only certain portions of a resource sent by the server, which is called . When Connection: close is sent in a header, it means that the will close the connection immediately after the transfer of this response.
| Wikimedia Commons has media related to: |
