Overview
Every time you load a web page, your browser sends an HTTP request to a server. Understanding the anatomy of a request is fundamental to web technology and to web security — most web attacks are, at heart, crafted requests. This lesson breaks down what an HTTP request contains.
Learning objectives
- Describe the structure of an HTTP request.
- Identify the request line, headers, and body.
- Explain the client-server request/response model.
Core concept
HTTP (HyperText Transfer Protocol) is a request/response protocol: a client sends a request, a server returns a response. An HTTP request has three parts:
- Request line — the method, the target path, and the HTTP version, e.g.
GET /index.html HTTP/1.1. - Headers — key/value metadata about the request (host, accepted formats, cookies, user agent, etc.).
- Body — optional data sent with the request (e.g. form fields on a
POST); many requests likeGEThave no body.
How it works
The client opens a connection to the server (typically TCP to port 80 or 443) and sends the request text: the request line first, then headers (each on its own line), a blank line, and then the body if present. The mandatory Host header tells the server which site is being requested (important when one server hosts many sites). The server parses the request and returns a response. HTTP itself is stateless — each request stands alone — so state (like being logged in) is carried in headers such as cookies.
Practical example
Requesting a page looks like:
GET /login HTTP/1.1
Host: example.com
User-Agent: Mozilla/5.0
Accept: text/html
This is a GET for /login on example.com, with headers describing the client and what it accepts, and no body. A form submission would instead use POST and include the form fields in the body.
Cybersecurity relevance
Because requests are just structured text, they can be crafted and manipulated — the basis of most web testing. Tampering with parameters, headers, or the body probes for flaws (injection, access-control issues). The Host, Cookie, and other headers are frequent targets. Learning to read and construct requests precisely is a prerequisite for the web-security and bug-bounty modules, where you analyze and modify them deliberately (against authorized targets only).
Common mistakes
- Forgetting the Host header — it is required in HTTP/1.1 and selects the site on shared servers.
- Assuming all requests have a body — many (like
GET) do not. - Treating HTTP as stateful — it is stateless; state lives in cookies/headers.
Key takeaways
- HTTP is a stateless request/response protocol between client and server.
- A request has a request line (method, path, version), headers (metadata), and an optional body.
- Requests are structured text that can be crafted and manipulated — the foundation of web security testing.
Check your understanding
- What are the three parts of an HTTP request, and which is optional?
- Why is the
Hostheader necessary, and what does "HTTP is stateless" mean for staying logged in?