Web Development Basics
HTTP Basics
Understanding the HTTP protocol, request-response cycle, status codes, and HTTP verbs.
Interview: Foundational web knowledge. Frequently asked in full-stack, frontend, and backend engineering interviews.
HTTP (Hypertext Transfer Protocol) is the foundation of data communication on the World Wide Web. It is a stateless, application-level protocol based on a client-server request-response cycle.
HTTP Request-Response Cycle
A client (e.g. browser or python script) sends an HTTP Request containing a method, a URI path, headers, and an optional body. The server processes this request and returns an HTTP Response containing a status code, headers, and a body.
HTTP Verbs / Methods
- GET: Retrieve resource details. Must be safe and idempotent (should not modify server state).
- POST: Create a new resource on the server. Non-idempotent.
- PUT: Update/Replace an existing resource. Idempotent (running it multiple times leaves the resource in the same state).
- PATCH: Partially update an existing resource. Non-idempotent.
- DELETE: Remove a resource. Idempotent.
HTTP Status Codes
- 1xx (Informational): Request received, continuing process.
- 2xx (Success):
200 OK,201 Created,204 No Content. - 3xx (Redirection):
301 Moved Permanently,302 Found,304 Not Modified. - 4xx (Client Error):
400 Bad Request,401 Unauthorized,403 Forbidden,404 Not Found,429 Too Many Requests. - 5xx (Server Error):
500 Internal Server Error,502 Bad Gateway,503 Service Unavailable.
Interview Insight
Idempotency is a core REST/HTTP concept often tested. An operation is idempotent if executing it multiple times has the same side-effect as executing it once. GET, PUT, and DELETE are idempotent, while POST is not. PATCH is generally not idempotent, as partial updates could append data (like list updates).
Use Cases
REST API Design — Aligning server-side endpoints with correct HTTP methods and status codes.
Web Integration — Communicating between clients and servers using header fields (like Authorization, User-Agent, Accept).
Caching — Designing APIs that return 304 Not Modified status to reduce bandwidth consumption.
Common Mistakes
Using GET for destructive actions — Designing links or APIs that delete or modify records on a GET request, which can be triggered accidentally by search engine crawlers.
Returning incorrect status codes — Returning 200 OK for errors, or not separating 401 Unauthorized (unauthenticated) from 403 Forbidden (authenticated but lacking permissions).
Ignoring header safety — Passing authentication keys in insecure headers or raw URI query strings instead of standard Authorization headers.