Interactive guide · 4 chapters · ~12 min read

HTTP · Interview & Revision

Fast recall material for interviews and refreshers — questions, condensed notes, a self-check quiz, and a cheat sheet you can scan in under a minute.

Mangesh MandlikLast updated: 1 November 2026

01 · Practice

Interview Questions

Q: What happens when you type a URL into a browser and press enter?

DNS resolution → transport connection setup (TCP for HTTP/1.1 or HTTP/2, QUIC for HTTP/3) → TLS handshake for HTTPS → browser sends the HTTP request → server processes it (routing, auth, business logic, data access) → server sends the response → browser parses HTML, fetches subresources, and renders. It is a common way to test whether you can reason end-to-end across the web stack, so be ready to zoom into any step.

Q: What's the difference between PUT and PATCH?

PUT replaces the entire resource with the request body — sending a partial PUT should logically clear the omitted fields. PATCH applies a partial update — only the fields present in the body change.

Q: Why is HTTP stateless, and how do we build stateful features on top of it?

HTTP is stateless at the protocol level: each request is self-contained, and the protocol itself does not keep a built-in session. Stateful features such as logins and carts are layered on via cookies or tokens, with the actual application state stored server-side or encoded in a signed token.

Q: Explain the TLS handshake at a high level.

ClientHello (supported ciphers/versions) → ServerHello + certificate → client validates the certificate chain against trusted CAs and checks the hostname → both sides derive a shared symmetric session key via a key exchange (e.g. ECDHE) → all further traffic is encrypted with that session key.

Q: How would you design a caching strategy for a single-page app?

Hash every built asset's filename and set Cache-Control: public, max-age=31536000, immutable on them; set Cache-Control: no-cache on the HTML entry point so it's always revalidated; this makes deploys instant and correct without manual purging.

Q: What's the difference between a load balancer and a reverse proxy?

A reverse proxy decides what to do with a request (routing, TLS termination, caching); a load balancer specifically decides which backend instance handles it. Tools like nginx and Envoy often do both.

02 · Condensed

Revision Notes

Methods: GET (read, safe), POST (create/act, side effects), PUT (replace), PATCH (partial update), DELETE (remove), HEAD (headers only), OPTIONS (CORS preflight).

Status codes: 2xx success · 3xx redirect · 4xx client error (fix the request) · 5xx server error (a retry may help for idempotent requests if the failure is transient).

Caching: Cache-Control: max-age = no network round trip at all. ETag/If-None-Match = revalidate cheaply with a 304. Version asset URLs instead of purging caches.

Cookies: HttpOnly blocks JS access (XSS mitigation), Secure requires HTTPS, SameSite controls cross-site sending (CSRF mitigation).

TLS: confidentiality + integrity + server authentication. TLS 1.3 = 1-RTT handshake, 0-RTT on resumption.

Protocol evolution: HTTP/1.1 (no multiplexing; browsers open several parallel connections) → HTTP/2 (binary framing + multiplexing over one TCP connection, removing HTTP/1.1 request queueing) → HTTP/3 (QUIC over UDP, so packet loss on one stream does not stall every other stream on that connection).

Scaling: a reverse proxy often terminates TLS and routes; a load balancer spreads traffic across healthy instances via health checks; horizontal scaling adds replicas rather than one bigger machine.

03 · Self-check

Quiz

1. Which status code means the client should not retry without changing the request?

4xx — the request itself is malformed, unauthorized, or points to something that doesn't exist. Retrying identically will usually fail again (408 and 429 are the exceptions, retryable after a delay). 5xx means the server failed and a backoff retry is reasonable.

2. Which HTTP version introduced multiplexing over a single TCP connection?

HTTP/2. HTTP/3 kept multiplexing but replaced TCP itself with QUIC to also fix transport-level head-of-line blocking.

3. What does `Cache-Control: no-cache` actually mean?

Counter-intuitively, it does not mean "don't cache" — it means "cache it, but revalidate with the server before using it every time." no-store is the directive that means never cache at all.

4. Why shouldn't a cookie storing a session id skip the HttpOnly flag?

Without HttpOnly, any JavaScript running on the page (including injected via an XSS bug) can read document.cookie and steal the session id — hijacking the user's session entirely.

5. What's the main difference between a 301 and a 302 redirect?

301 means the move is intended to be permanent, so clients and search engines may update stored references and cache that redirect aggressively. 302 means the move is temporary, so the original URL remains the canonical one. If method preservation matters, compare 307/308, which explicitly preserve the original HTTP method.

04 · At a glance

Cheat Sheet

textStatus code families

1xx  Informational   100 Continue
2xx  Success          200 OK · 201 Created · 204 No Content
3xx  Redirection      301 Moved Permanently · 302 Found · 304 Not Modified
4xx  Client Error     400 Bad Request · 401 Unauthorized · 403 Forbidden
                      404 Not Found · 429 Too Many Requests
5xx  Server Error     500 Internal Server Error · 502 Bad Gateway
                      503 Service Unavailable · 504 Gateway Timeout

textCommon headers

Request:
  Host, User-Agent, Accept, Content-Type, Authorization, Cookie,
  If-None-Match, If-Modified-Since, Accept-Encoding

Response:
  Content-Type, Content-Encoding, Cache-Control, ETag,
  Set-Cookie, Location, Strict-Transport-Security, Content-Security-Policy

textProtocol evolution, one line each

HTTP/1.1  — no multiplexing; browsers open parallel TCP connections
HTTP/2    — binary framing + multiplexed streams on one TCP connection
HTTP/3    — QUIC over UDP, avoiding TCP-level head-of-line blocking between streams