HTTP Basics for REST APIs

# CHAPTER 3

HTTP Basics for REST APIs #

1. Introduction #

2. Learning Objectives #

• Explain what HTTP is and how it powers the web.

• Outline the lifecycle of an HTTP request.

• Understand the role of Request and Response Headers.

• Differentiate between the Request Body and Response Body.

• Understand the basic necessity of HTTPS in modern APIs.

3. Beginner-Friendly Explanation #

• The envelope has the destination address and return address (this is like an HTTP Header).

• The letter inside contains your actual message (this is the HTTP Body).

• The mail carrier who transports the envelope is HTTP.

When you type a URL into a browser or send an API request, you are formulating one of these "envelopes" and sending it across the internet. The server receives it, reads the envelope (headers), opens the letter (body), processes it, and mails a response back to you using the exact same system.

4. Real-World Examples #

• HTTP: Every time you visit http://google.com, your browser is sending an HTTP request.

• Headers: When you log into an app, your device might send a header like Authorization: Bearer <token> to prove who you are.

• HTTPS: When you see a "padlock" icon in your browser URL bar, it means you are using HTTPS, a secure, encrypted version of HTTP, ensuring hackers cannot read your "letters" in transit.

5. Detailed Code Examples #

Viewing Request Headers in PHP (api.php):

<?php
// Get all headers sent by the client
$headers = getallheaders();

// We can check for a specific header, like a custom API key
if (isset($headers[&#039;X-Api-Key'])) {
    $apiKey = $headers[&#039;X-Api-Key'];
    echo "You sent an API key: " . htmlspecialchars($apiKey);
} else {
    echo "No API key found in the headers.";
}
?>

6. Request/Response Examples #

The Request (Client to Server):

POST /submit-data HTTP/1.1
Host: api.example.com
User-Agent: Mozilla/5.0
Content-Type: application/json
Content-Length: 36

{
  "message": "Hello from client!"
}

The Response (Server to Client):

HTTP/1.1 201 Created
Date: Mon, 27 Sep 2026 12:28:53 GMT
Server: Apache/2.4.41 (Ubuntu)
Content-Type: application/json

{
  "status": "success",
  "id": 105
}

7. HTTP Examples #

1. 1. Connection: Client establishes a TCP connection with the server.

1. 2. Request: Client sends the HTTP request (method, URL, headers, body).

1. 3. Response: Server processes it and sends an HTTP response (status code, headers, body).

1. 4. Close: The connection is closed (unless Connection: keep-alive is specified).

8. JSON Examples #

Request Body (JSON):

{
  "username": "coder123",
  "password": "securepassword99"
}

Response Body (JSON):

{
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9",
  "expires_in": 3600
}

9. Best Practices #

• Always use HTTPS: Never use plain HTTP for APIs in production. Unencrypted data can easily be intercepted (Man-in-the-Middle attacks).

• Use meaningful headers: Ensure you set Content-Type: application/json when sending JSON, so the server knows exactly how to parse your letter.

• Don't put sensitive data in the URL: URLs are often logged by servers and internet service providers. Put sensitive data (like passwords) in the HTTPS Request Body instead.

10. Common Mistakes #

• Forgetting Content-Type: Sending JSON to a PHP server without setting Content-Type: application/json will result in $_POST being empty, causing immense confusion for beginners.

• Ignoring Headers: Beginners often only look at the body of a response and ignore headers, missing out on important information like rate limits or caching instructions.

11. Mini Exercises #

1. 1. Open up an API testing tool like Postman (or use cURL).

1. 2. Make a GET request to https://httpbin.org/headers.

1. 3. Review the response. httpbin is a service that repeats back the headers you sent to it. Notice how many headers your tool sends automatically!

12. Coding Challenges #

13. MCQs with Answers #

14. Interview Questions #

• Q: Explain the lifecycle of an HTTP request from the moment a user clicks "Submit" to the moment data appears on the screen.

• Q: What is the difference between an HTTP Header and an HTTP Body?

• Q: Why is HTTPS critical for modern REST APIs?

15. FAQs #

Q: Is HTTP only used for websites? A: No, HTTP is used by mobile apps, IoT devices (like smart fridges), desktop applications, and server-to-server communication.

16. Summary #

17. Next Chapter Recommendation #