APPLICATION LAYER · HTTP/1.1 MESSAGE
Read what the browser and server say.
Telnet once made HTTP visible, but most public sites now require TLS. This laboratory exposes the plaintext message immediately before encryption and after decryption, so every space, CRLF and empty line can be inspected safely.
MESSAGE COMPOSER
Compose a request; walk through the exchange
Ready to compose
FROM SOCKET TO MESSAGE
What telnet used to reveal—and what HTTPS hides
TCP connection
HTTP/1.1 rides on a byte stream. The connection has addresses and ports, but TCP does not understand request lines or headers.
TLS tunnel
With HTTPS, TLS encrypts the HTTP bytes. Telnet cannot negotiate modern TLS, while the browser sees plaintext before encryption.
HTTP semantics
Method and target express intent; headers carry metadata; the empty line ends the header section; an optional body carries representation data.
MESSAGE ANATOMY
Grammar that students can point to
GET /path HTTP/1.1Request line
Method, one space, request target, one space, protocol version, then CRLF.
Host: warin.meHeader field
A field name, colon, optional whitespace and a value. HTTP field names are case-insensitive.
␍␊Empty line
A second CRLF ends the header section. Omitting it was the classic reason a telnet request appeared to hang.
{"student":"A"}Message body
Content-Length counts body bytes, not JavaScript characters. UTF-8 text can use more than one byte per character.
DO NOT OVERGENERALIZE
This is HTTP/1.1—not every HTTP wire format
| Protocol | Wire representation | Connection behavior | How to inspect |
|---|---|---|---|
| HTTP/1.1 | Text start-line and fields; CRLF delimiters | Persistent by default; pipelining is rare | curl -v, DevTools, Wireshark + TLS keys |
| HTTP/2 | Binary frames with compressed header blocks | Many streams multiplexed on one connection | DevTools, nghttp, Wireshark |
| HTTP/3 | HTTP semantics over QUIC frames | Streams over encrypted UDP-based QUIC | DevTools, qlog, Wireshark |
CLASSROOM INVESTIGATION
Experiments that turn syntax into evidence
- Change GET to POST. Which fields must change when a body appears?
- Enter Thai text in the body. Compare character count with Content-Length bytes.
- Compare 200, 301, 304 and 404. Which responses carry a representation body?
- Use Connection: close and explain who ends the connection after the response.
- Explain why the simulator can show plaintext although the public URL uses HTTPS.
- Capture the same request in Browser DevTools and identify which headers the browser adds automatically.