HTTP protocol Related

Page Request Process

1. URL Request for browser
2, recursive search DNS server
3. Connect the target IP and establish a TCP connection
4. Sending HTTP requests to the target server
5. The Web server receives the request after processing
6. The Web server returns the corresponding result "invalid, redirect, correct page, etc."
7. The browser receives the HTTP content returned
================================ front-end analytic split line ===========================================
8, start parsing the HTML file, of course, is the top-down, first head, after the body
9, when parsing to the head of the CSS external link, sync to download, if you encounter external JS link is also download "but JS link is not recommended to put in the head, because the delay page first show time"
10, then parse the body part, edge parsing edge began to generate the corresponding DOM tree, while waiting for the CSS file download
11, once the CSS file has been downloaded, then synchronize with the generated DOM node +CSS to generate the render tree
12. Once the rendering tree has a structural model, it will then synchronize to calculate the layout location of the render tree node
13, once calculated the coordinates of the rendering, and then synchronized to start rendering
14, 10-13 step in the process if you encounter a picture jumps past render the following content, waiting for the picture to be downloaded successfully will be returned to render the original picture location
15, the same as 14 steps, if the rendering process occurs when the JS code to adjust the DOM tree structure of the situation, will again again, starting from the modification of the DOM step
16, eventually all nodes and resources will be rendered complete
========================================= analysis End Split Line ==============================================
17. The OnLoad event that starts page after rendering is complete
18, the entire page load complete

Long connection and short connection differences

Short connection
Connection, transfer data, close connection
HTTP is stateless, and the browser and server make a connection every time an HTTP operation is made, but the end of the task interrupts the connection. It is also possible to say that a short connection is when the socket connection is sent and the data is disconnected immediately after it is received.

Long connections
Connect, transfer data--keep connected, transfer data ... , close the connection.
A long connection is when a socket connection is established, regardless of whether it is used or not.

Using connection:keep-alive to set long connections, HTTP 1.1 defaults to persistent connections.
Use KEEP-ALIVE:TIMEOUT=20 to set the connection time-out.
The biggest difference between HTTP1.1 and HTTP1.0 is that it adds support for persistent connections (seemingly the latest http1.0 can display the specified keep-alive)

The configuration of the connector in Tomcat maxkeepaliverequests= "5" Each connection only processes 5 requests, then disconnects, if set-1 disables long connections
keepalivetimeout= "15000" Long connection hold Time

If it is a recommended short connection such as interface, API, concurrency is too large, if it is a dense operation of the background management system recommended long-term connection

HTTP and HTTPS

The HTTP protocol sends content in plaintext, does not provide data encryption in any way, and if an attacker intercepts a transmission message between a Web browser and a Web server, it can read the information directly, therefore, the HTTP protocol is not suitable for transmitting some sensitive information, such as credit card number, password and other payment information.

In order to solve this flaw of the HTTP protocol, we need to use another protocol: Secure Sockets Layer Hypertext Transfer Protocol HTTPS, in order to secure the data transmission, HTTPS on the basis of HTTP added SSL protocol, SSL relies on certificates to verify the identity of the server, and encrypt the communication between the browser and the server.

HTTPS protocol is a network protocol built by Ssl+http protocol which can encrypt transmission and authentication, and is more secure than HTTP protocol.

The main role of HTTPS protocol can be divided into two kinds: one is to establish an information security channel to ensure the security of data transmission, the other is to confirm the authenticity of the website.

The difference between redirect and forward

Forward is the server requests the resource, the server directly accesses the URL of the destination address, reads the response content of that URL, and then sends the content to the browser, the browser does not know where the server sends the content from, so its address bar is the original address.

Redirect is the server based on logic, send a status code, tell the browser to request the address again, in general, the browser will use all the parameters just requested again, so the session,request parameters can be obtained. 301 and 302 are redirected status codes. (General use 301)

The difference between 301 and 302
http://blog.csdn.net/5207/article/details/52668300

The difference between a cookie and a session

The cookie mechanism uses a scheme that maintains state on the client, while the session mechanism uses a scheme that maintains state on the server side.

A single cookie cannot hold more than 4K of data, and many browsers limit a maximum of 20 cookies per site.

The contents of the cookie mainly include: name, value, expiration time, path and domain. The path together with the domain constitutes the scope of the cookie. If you do not set an expiration time, the cookie will be closed for the duration of the browser session. This cookie, which is the lifetime of the browser session, is referred to as a session cookie. Session cookies are generally not stored on the hard disk but are kept in memory, although this behavior is not regulated. If the expiration time is set, the browser will save the cookie to the hard disk, turn it off and open the browser again, and the cookies remain valid until the set expiration time expires. Cookies stored on the hard disk can be shared between different browser processes, such as two IE windows. For cookies stored in memory, different browsers have different ways of handling them.

在cookie中设置了HttpOnly属性，那么通过js脚本将无法读取到cookie信息，这样能有效的防止XSS攻击

The session mechanism is a server-side mechanism that uses a hash-like structure (or perhaps a hash table) to hold information. When a program needs to create a session for a client's request, the server first checks to see if the client's request contains a session ID (called the session ID.), and if it is included, it has previously created a session for this client. The server will follow the session ID to retrieve the session (not retrieved, a new one), if the client request does not include session ID, then create a session for this client and generate a session ID associated with this session, The value of session ID should be a string that is neither duplicated nor easy to be found, and the session ID will be returned to the client in this response to save. This session ID can be saved by using a cookie so that the browser can automatically send the tag to the server in the interactive process. Generally the name of this cookie is similar to Seeesionid. However, a cookie can be artificially banned, and there must be other mechanisms that can still pass the session ID back to the server when the cookie is banned. A technique that is often used is called URL rewriting, which attaches the session ID directly behind the URL path. There is also a technique called form-hidden fields. Is that the server automatically modifies the form, adding a hidden field so that the session ID can be passed back to the server when the form is submitted.

Referer

The Referer header domain allows the client to specify the source resource address of the request URI, which allows the server to generate a fallback list that can be used to log in, optimize the cache, and so on. He also allows the abolition or wrong connection to be traced for maintenance purposes. If the requested URI does not have its own URI address, Referer cannot be sent. If you specify a partial URI address, this address should be a relative address.
Role:
1. Page statistics
2. Resource anti-theft chain

Tell the server which page link I took from, the server can get some information for processing. For example, if you link to a friend from my home page, his server will be able to count the number of users who click on the link on my page to visit his website from HTTP Referer.

Cache-control and expires

Cache-control is consistent with expires, which indicates the validity of the current resource, whether the browser caches data directly from the browser or re-sends the request to the server. But Cache-control more choice, more detailed settings, if set at the same time, its priority is higher than expires.

Last-modified/etag and Cache-control/expires

In the case of configuration Last-modified/etag, the browser accesses the resource of the unified URI again, or sends the request to the server asking if the file has been modified, if not, the server sends only a 304 back to the browser, telling the browser to fetch the data directly from its local cache If modified, the entire data is re-sent to the browser;

Cache-control/expires is different, if the local cache is detected in a valid time range, the browser uses the local copy directly and does not send any requests. When used together, the cache-control/expires priority is higher than last-modified/etag. That is, when the local copy is found within the validity period according to Cache-control/expires, the request is not sent again to the server asking for the modification time (last-modified) or the Entity identity (Etag).

In general, using Cache-control/expires will work with Last-modified/etag, because even when the server sets the cache time, when the user taps the Refresh button, the browser ignores the cache and continues to send requests to the server. At this point Last-modified/etag will be able to take advantage of 304, thus reducing the response overhead.

Status Code Daquan

The remainder of this section describes the status codes in HTTP 1.1 in detail. These status codes are divided into five main categories:

100-199 is used to specify certain actions that the client should be corresponding. 200-299 is used to indicate a successful request. 300-399 is used for files that have been moved and is often included in the locator header information to specify the new address information. 400-499 is used to indicate client-side errors. 500-599 is used to support server errors.

continue/(continued)
If the server receives a request with 100-continue in the header, this means that the client asks if the attachment can be sent in a subsequent request. In this case, the server uses (Sc_continue) to allow the client to continue or use 417 (expectation Failed) to tell the client that it does not agree to accept the attachment. This status code is newly added to HTTP 1.1.

101 (switching protocols/Conversion Protocol)
101 (sc_switching_protocols) status code means that the server will change to a different protocol based on the header information on it. This is the new entry in HTTP 1.1.

(ok/Normal)
(SC_OK) means everything is normal. Typically used for corresponding get and post requests. This status code is default to the servlet, and if you do not call the SetStatus method, you will get 200.

201 (created/created)
201 (sc_created) indicates that the server has created a new document in the requested response, and should give its URL in the anchor header information.

202 (accepted/accepted)
202 (sc_accepted) tells the client that the request is being executed, but has not finished processing it yet.

203 (non-authoritative information/unofficial information)
The Status Code 203 (sc_non_authoritative_information) indicates that the document is returned normally, but some response header information may be incorrect because a copy of the document is being used. This is the new entry in HTTP 1.1.

204 (no content/no content)
In the absence of a new document, 204 (sc_no_content) ensures that the browser continues to display the previous document. These status codes are useful for users to reload a page periodically, and you can determine if the previous page has been updated.

205 (reset content/reset content)
Resetting content 205 (sc_reset_content) means that although there are no new documents, the browser will reset the document display. This status code is used to force the browser to clear form fields. This is the new entry in HTTP 1.1.

206 (partial content/local content)
206 (sc_partial_content) is sent when the server completes a partial request that contains the range header information. This is the new entry in HTTP 1.1.

(multiple choices/multiple options)
Sc_multiple_choices indicates that the requested document can be found in multiple places and will be listed in the returned document. If the server has preferred settings, the preferences will be listed in the location response header information.

301 (Moved permanently)
301 (sc_moved_permanently) state refers to the requested document elsewhere; The new URL of the document is given in the location response header information. The browser will automatically connect to the new URL.

302 (found/found)
Similar to 301, just the URL given in the locator header information should be interpreted as a temporary interchange address instead of permanent. Note: In HTTP 1.0, the message is temporarily moved (Moved temporarily) instead of being found, so the constants in HttpServletResponse are sc_moved_temporarily not what we thought sc_found.

Status Code 302 is useful because the browser automatically connects to the new URL that is given in the response header information. This is very useful, and there is a special method for this--sendredirect. Use Response.sendredirect (URL) than call Response.setstatus (response. sc_moved_temporarily) and Response.setheader ("location", url) a few more benefits. First, the Response.sendredirect (URL) method is obviously simple and easy. Second, the servlet automatically creates a page to save the connection for display to browsers that cannot automatically turn. Finally, in the version of Servlet 2.2 (version in Java ee), Sendredirect is able to process relative paths and automatically convert to absolute paths. However, you can only use absolute paths in version 2.1.

If you move the user to another page of the site, you will send the URL using the Encodeurl method in HttpServletResponse. Doing so prevents the continuous use of URL rewrite-based session tracking scenarios. URL rewriting is a way of tracking users who do not use cookies on your website. This is done by appending path information at the end of each URL, but the servlet session trace API automatically takes care of these details. Session tracking is discussed in the Nineth chapter, and the habit of using encodeurl makes it much easier to add session tracking later.

Core Skills
If you turn users to other pages in your site, scheduling session tracking in advance with Response.sendredirect (Response.encodeurl (URL)) is more than just calling Response.sendredirect (URL) is much better.

This status code can sometimes be used in exchange with 301. For example, if you mistakenly access the Http://www.talentdigger.cn/home/link.php?url=aG9zdC9%2BdXNlcg%3D%3D (the path information is incomplete), Some servers will reply to the 301 status code and some reply to 302. Technically, if the initial request is the Get browser is simply assumed to be automatically turned. For more details, see the discussion of status code 307.

303 (see other/for additional information)
This status code is similar to 301 and 302, except that if the initial request is POST, the new document (given in the locator header information) is retrieved as a medicinal get. This status code is newly added to HTTP 1.1.

304 (not modified/for remediation)
When a client has a cached document, it is possible to make a conditional request by providing a If-modified-since header information that indicates that the client only wants the document to be modified after the specified date to be overloaded. 304 (sc_not_modified) means that the buffered version has been updated and the client should refresh the document. Additionally, the server returns the requested document and status Code 200. The servlet generally does not set this status code directly. They implement the Getlastmodified method and let the default service method handle conditional requests based on the remediation date. The routines for this method are given in 2.8 parts (an Example using servlet initialization and page modification dates/A example using servlet initialization and page correction date).

305 (Use proxy/using proxy)
305 (Sc_use_proxy) indicates that the requested document is to be obtained through the proxy server in the location header information. This status code is newly added to HTTP 1.1.

307 (Temporary redirect/temporary redirect)
The browser handles the 307 status with the same rules as 302. The 307 state is added to HTTP 1.1 because many browsers still perform the wrong turn when receiving a 302 response, even if the original message is post. It is only assumed that the browser will redirect at the post request only when the 303 response is received. The purpose of adding this new status code is clear: When the response is 303, the Get and post requests are turned, while in the 307 response the GET request is turned instead of the POST request. Note: For some reason, there are no constants in httpservletresponse that correspond to this state. The status code is newly added to HTTP 1.1.

Attention
There are no Sc_temporary_redirect constants in HttpServletResponse, so you can only display the use of 307 status codes.

(Bad request/error request)
(sc_bad_request) indicates a syntax error in the client request.

401 (unauthorized/not authorized)
401 (sc_unauthorized) indicates that the client accesses a password-protected page when there is no valid identity information in the authorization header information. This response must contain a www-authenticate of the authorization information header. For example, in part 4.5 of this book, the restricting access to Web pages./restricts access to Web pages. ”

403 (forbidden/Forbidden)
403 (Sc_forbidden) means that the server refuses to provide the requested resource unless it has authorization. This state is often caused by a corrupted file or directory license on the server.

404 (not found/found)
404 (Sc_not_found) status each network programmer may have encountered, and he told the client that the address could not find any resources. It is a standard way of saying "no pages visited". This status code is a common response and has a special method in the HttpServletResponse class to implement it: Senderror ("message"). The advantage of using SENDERROR with respect to SetStatus is that the server automatically generates an error page to display the error message. However, the Internet Explorer 5 browser defaults to ignoring the error page you are playing and displays its customized error page, although Microsoft has violated the HTTP specification. To turn off this feature, on the Tools menu, select Internet Options, go to the Advanced tab, and confirm that the "Show friendly HTTP error message" option (in my browser is the bottom 8th option) is not selected. However, few users know this option, so this feature is IE5 hidden and users cannot see the information you return to the user. Other major browsers and IE4 are fully displaying the error page generated by the server. Refer to the examples in figures 6-3 and 6-4.

405 (Method not allowed/methods not allowed)
405 (sc_method_not_allowed) indicates that the request method (GET, POST, HEAD, PUT, DELETE, and so on) is not allowed for certain specific resources. The status code is newly added to HTTP 1.1.

406 (not acceptable/unreachable)
406 (sc_not_acceptable) indicates that the MIME type of the requested resource is inconsistent with the type specified in the Accept header information in the client. See the description of MIME types in Table 7.1 (HTTP 1.1 Response Headers and their Meaning/http 1.1 response header information and their meaning) in part 7.2 of this book. 406 is newly added in HTTP 1.1.

407 (proxy authentication required/Agent Server authentication requirements)
407 (sc_proxy_authentication_required) is somewhat similar to the 401 state, except that this state is used for proxy servers. This state indicates that the client must be authenticated through a proxy server. The proxy server returns a proxy-authenticate response header information to the client, which causes the client to reconnect using the header information with the proxy-authorization request. The status code is newly added to HTTP 1.1.

408 (Request timeout/requests timeout)
408 (sc_request_timeout) is the length of time that the server waits for a client to send a request. The status code is newly added to HTTP 1.1.

409 (conflict/conflict)
This state is typically used with a put request, and the 409 (sc_conflict) state is often used when attempting to upload an incorrect version of a file. The status code is newly added to HTTP 1.1.

410 (gone/no longer exists)
410 (Sc_gone) tells the client that the requested document is no longer present and does not have an updated address. The 410 status differs from 404,410 in cases where the instruction document has been removed and 404 is used for unknown reasons. The status code is newly added to HTTP 1.1.

411 (length required/requires data lengths)
411 (sc_length_required) indicates that the server cannot process the request (assumed to be a POST request with an attachment) unless the client sends Content-length header information indicating the size of the data sent to the server. The status is newly added to HTTP 1.1.

412 (precondition failed/prerequisite error)
The 412 (sc_precondition_failed) status indicates that some of the prerequisites in the request header information are incorrect. The status is newly added to HTTP 1.1.

413 (Request entity Too large/) 413 (sc_request_entity_too_large) tells the client that the requested document is now larger than the server wants to handle now. If the server thinks it can be processed over a period of time, it will contain a retry-after response header information. The status is newly added to HTTP 1.1.

414 (Request URI Too long/requested URI too long)
The 414 (Sc_request_uri_too_long) state is used when the URI is too long. The "URI" referred to here refers to the content after the host, domain name, and port number in the URL. For example, in url--http://www.y2k-disaster.com:8080/we/look/silly/now/, the URI refers to/we/look/silly/now/. The status is newly added to HTTP 1.1.

415 (media Format not supported by unsupported media type/)
415 (Sc_unsupported_media_type) means that the format type of the attachment requested by the server does not know how to handle it. The status is newly added to HTTP 1.1.

416 (requested range not satisfiable/request range not satisfied)
416 indicates that the client contains a request that the server cannot satisfy the range header information. The status is newly added to HTTP 1.1. Strangely, there is no corresponding constant in the httpservletresponse of the Servlet 2.1 API to represent that state.

Attention
In the specification of Servlet 2.1, the class HttpServletResponse does not sc_requested_range_not_satisfiable such constants, so you can only use 416 directly. This constant is included after the servlet version 2.2.

417 (expectation failed/expected failure)
If the server gets a expect request header message with a 100-continue value, this means that the client is asking if an attachment can be sent in a later request. In this case, the server will also use that State (417) to tell the browser that the server does not receive the attachment or use the (sc_continue) status to tell the client that the attachment can continue to be sent. The status is newly added to HTTP 1.1.

(Internal server error/internal servers error)
(Sc_internal_server_error) is a common "server error" state. This state is often caused by CGI programs (hopefully not!). is caused by a servlet that is not functioning correctly or that returns a malformed header information.

501 (not implemented/not implemented)
The 501 (sc_not_implemented) state tells the client server that the functionality required in the request is not supported. For example, a client executes a command that is not supported by a server such as put.

502 (Bad gateway/wrong gateway)
502 (Sc_bad_gateway) is used to act as a proxy or gateway server, which indicates that the receiving server received an error response from the remote server.

503 (Service unavailable/services not available)
The Status Code 503 (sc_service_unavailable) indicates that the server is unable to respond because it is maintained or overloaded. For example, if some threads or database connection pools are not already idle, the servlet returns this header information. The server can provide a Retry-after header information to tell the client when it can try again.

504 (Gateway timeout/gateways Timeout)
This state is also used to serve as a proxy or gateway server, which indicates that the receiving server has not received a timely response from the remote server. The status is newly added to HTTP 1.1.

505 (HTTP version not supported/is not supported)
The 505 (sc_http_version_not_supported) status code means that the server does not support the HTTP version indicated in the request. The status is newly added to HTTP 1.1.

Reference documents

http://blog.csdn.net/melody_day/article/details/53559054

HTTP protocol Related