How does HTTP differ from HTTPS?
Essence
HTTP carries requests and responses in plain text: any hop on the path (café Wi-Fi, the ISP, a proxy) can read and alter the data. HTTPS is the same HTTP but inside a TLS connection (the term "SSL" is obsolete: SSL 3.0 has been prohibited since 2015). The default port is 443 instead of 80.
TLS provides three properties:
- Confidentiality — traffic is encrypted with a symmetric key negotiated in the handshake.
- Integrity — tampering in transit is detected.
- Server authentication — the server presents a certificate signed by a trusted certificate authority (CA); the client verifies the chain of trust and that the domain matches.
A TLS 1.3 handshake takes one round trip (0-RTT on reconnection), so the overhead compared with HTTP is small, and HTTP/2 and HTTP/3 only run over TLS.
The rest of this answer, with code and interview follow-ups, is in the DevPrep app.
Read the full answer in DevPrep