ping·aiCSTU · CSE 642 · Foundations · HTTP and HTTPS
Part A · The words

Why learn HTTP

Every web page, API call and model request uses it.

HTTP is the conversation between a client, such as your browser, and a server. The client sends a request. The server sends back a response. Almost every AI app you build is made of these conversations.

When something fails, the status code and the exact error text tell you which side went wrong.

Slide 1 of 14

Read this deck as an article

The same content as the slides above, in one page.

Why learn HTTP

Every web page, API call and model request uses it.

HTTP is the conversation between a client, such as your browser, and a server. The client sends a request. The server sends back a response. Almost every AI app you build is made of these conversations.

When something fails, the status code and the exact error text tell you which side went wrong.

Two places you type

A terminal takes exact commands. A Coding Agent App takes plain-language prompts.

The Terminal

A text window where you type exact commands. The shell inside it runs each command the moment you press Enter.

  • Spelling and spacing must be exact.
  • macOS and Linux use zsh or bash. Upper and lower case matter there: Git is not git.
  • Windows uses PowerShell. It does not care about case in command names, but type them as shown anyway.
  • Names inside a command, such as Linux file paths, branch names and image names, can be case-sensitive in any shell.
  • The two kinds of shell have different commands: ls -la works in zsh and bash, while PowerShell uses Get-ChildItem -Force.

Terminal command, macOS and Linux (zsh or bash, case-sensitive): ls -la

Terminal command, Windows PowerShell (command names are not case-sensitive): Get-ChildItem -Force

A Coding Agent App

It looks like a chatbot, but it does much more: it can read your project files, run commands, edit code and use tools, and it often asks your permission first. Product names and features change fast and differ a lot, so these decks use one group name for all of them.

Examples: Kiro, Claude Code Desktop, GitHub Copilot's desktop app, Google Antigravity, the Codex and ChatGPT desktop apps, OpenCode, Hermes, LangChain's Deep Agents desktop app, and others. Which one you use does not matter here.

  • Plain language is fine. Say what you want, and use the right names for things.
  • Capital letters and small slips are forgiving; the meaning is what counts.
  • It may run terminal commands for you. Read what it proposes, especially anything that deletes files or sends data.
  • Pasting a command into the prompt does not guarantee it runs as typed. Ask for the result you want, or ask the app to explain the command first.
Prompt for a Coding Agent App: “What changed in my project since the last commit? Explain it in plain words.”

The same job, two ways

Terminal command, Any shell: git status

In a terminal you type the exact command. In a Coding Agent App you describe what you want.

Six words, part 1

Each card gives the word, what it means, and a sentence you can say to a Coding Agent App.

Client and server
The client asks; the server answers. Your browser is a client; your backend is a server.
Prompt for a Coding Agent App: “Is this error on the client or the server?”
Request
What the client sends: a method, an address, headers and sometimes a body.
Prompt for a Coding Agent App: “Show me the request this page sends.”
Response
What the server sends back: a status code, headers and usually a body.
Prompt for a Coding Agent App: “What does this response mean?”
URL
The address of a resource, such as https://example.com:443/path?x=1.
Prompt for a Coding Agent App: “Break this URL into its parts.”

Six words, part 2

Method
The kind of request: GET reads, POST sends something new, PUT or PATCH changes, DELETE removes.
Prompt for a Coding Agent App: “Which method should this endpoint use?”
Header
A named piece of extra information sent with a request or response, such as Content-Type.
Prompt for a Coding Agent App: “Which headers does this API require?”
API
Addresses and rules one program uses to talk to another, usually over HTTP.
Prompt for a Coding Agent App: “Call this API and show me the response.”
Body
The data a request or response carries, often JSON.
Prompt for a Coding Agent App: “What JSON body does this request need?”

localhost means this computer: http://localhost:3000 is a server running on your own machine.

Anatomy of a URL

https://api.example.com:443/v1/items?limit=5#top

https://
Scheme The protocol: http or https.
api.example.com
Host Which computer. localhost or 127.0.0.1 means this one.
:443
Port Which door. Usually left out: http is 80, https is 443.
/v1/items
Path Which resource on that server.
?limit=5
Query string Extra settings, as name=value pairs joined by &.
#top
Fragment A spot inside the page. The browser keeps it and does not send it to the server.

One request, one response

  • You type a URL or press a button. The browser looks up the host's address and opens a connection to the port.
  • It sends a request: for example GET /v1/items?limit=5 with some headers.
  • The server does its work and sends a response: a status line such as 200 OK, headers, and a body.
  • The browser reads the body (a page, an image, or JSON for the app to use) and shows or uses it.

Open your browser's developer tools and the Network tab to watch real requests and responses.

Methods: what the request wants

GET
Read something Should not change anything on the server. A browser uses GET when you open a page.
POST
Send something new Submit a form or ask a model a question. The data goes in the body.
PUT / PATCH
Replace or change something PUT replaces a whole item; PATCH changes part of it.
DELETE
Remove something Use with care. Check what a delete endpoint does before calling it.

Status codes: how it went

200 OK
It worked 2xx means success.
301 / 302
Go somewhere else 3xx means redirect. The browser follows it.
401 Unauthorized
Not signed in or bad key The server does not know who you are.
403 Forbidden
Signed in, but not allowed You are known; this is not permitted.
404 Not Found
Nothing at that address Check the path and the spelling.
429 / 5xx
Too many requests, or the server failed 429: slow down. 500 and up: the problem is on the server.

4xx means the request needs to change. 5xx means the server had a problem.

Headers worth knowing

Content-Type
What the body is For example application/json or text/html.
Authorization
Proof of who you are Usually holds a key or token. Treat it like a password: never share it or paste it in a prompt.
Accept
What the client can read For example application/json.

Streaming answers from a model use Content-Type: text/event-stream: the server keeps the response open and sends small events as they are ready.

HTTPS: the same conversation, locked

Encrypted
Others on the network cannot read it Passwords, keys and messages are scrambled in transit.
Not tampered with
Others cannot change it on the way What the server sent is what you receive.
Server identity
A certificate says who you reached Your browser checks it; the padlock means the check passed.
localhost
Plain http is normal on your own computer The traffic never leaves your machine. Public sites should always use https.

A padlock tells you the connection is private and the site is who it claims. It does not say the site is trustworthy.

Try it yourself

Run a request from the terminal and read the answer.

macOS / Linux

Terminal command, macOS and Linux (zsh or bash, case-sensitive): curl -i http://localhost:3000

-i prints the status line and headers before the body.
Windows

Terminal command, Windows PowerShell (command names are not case-sensitive): curl.exe -i http://localhost:3000

Use curl.exe so PowerShell does not substitute its own command.
Look at the first line
HTTP/1.1 200 OK The number is the status code.
No page running?
curl: (7) Failed to connect Nothing is listening on that port. Start the app first.

Common problems and the words to use

Connection refused / Failed to connect
No server is listening on that host and port Is the app running? Is the port number right?
404 Not Found
The path is wrong Compare the URL with the route the server defines.
401 Unauthorized
A key is missing or wrong Check the key privately. Never paste it in a prompt.
429 Too Many Requests
You hit a rate limit Wait, send fewer requests, or check your plan.
500 / 502 / 503
The server failed or is unavailable Read the server's log for the real cause.
Timeout
The server took too long It may be down, overloaded, or waiting on another service.

Say it to your Coding Agent App

Give the method, the URL, the status code and the exact error text.

Prompt for a Coding Agent App: “My request to POST /api/chat returns 500. Here is the server log: <paste>. What is the likely cause?”
Prompt for a Coding Agent App: “Show me a curl command to test this endpoint, with the headers it needs but without my real key.”
Prompt for a Coding Agent App: “What is the difference between a 401 and a 403 here?”
Prompt for a Coding Agent App: “Explain this response as if I have never used an API.”
  • Never paste an Authorization header or key into a prompt.

Learn more from the source

Checked against the linked pages on 7 November 2026.

  • MDN's HTTP guide explains requests, responses, headers and status codes.
  • MDN's page on server-sent events explains streaming a response in small pieces.
  • RFC 9110 is the formal specification of HTTP semantics, for when you want the exact rules.