# HTTP, HTTPS & Web Page Retrieval

- **Track:** Cambridge IGCSE™ Computer Science (0478 / 0984) (CAMBRIDGE IGCSE 0478)
- **Module:** Section 5: The Internet & Security
- **Estimated Duration:** 15 minutes
- **Access:** Open Theory (All-Access for Interactive IDE & Autotests)

---

## Theory & Conceptual Background

HTTP is a protocol for requesting and transferring web resources. HTTPS protects HTTP using TLS. It encrypts data in transit, detects modification and authenticates the requested domain through a certificate chain trusted by the browser.

## What HTTPS does and does not establish

A valid certificate for shop.example authenticates that domain. It does not prove the business is honest. An attacker can obtain a valid certificate for a lookalike domain. Read the full intended domain and treat unexpected requests for passwords or payments with care. Browser security indicators vary; a padlock is not a guarantee against phishing.

A certificate authority checks control of a domain for a domain-validated certificate. Some certificate types involve additional organisation checks, but business-identity checking is not universal. The browser checks the certificate's domain, validity period and trust chain. The handshake establishes symmetric keys for protecting the connection; detailed handshake algorithms are outside this lesson.

## Worked journey: opening a weather page

1. The user enters a URL. The browser identifies its protocol, host and resource path.
2. DNS resolves the host name to an IP address, unless a suitable answer is already cached.
3. The browser establishes a connection; HTTPS also establishes the protected TLS connection.
4. It sends an HTTP request for the resource.
5. The server returns a response containing the page's HTML or another resource.
6. The browser interprets the HTML, requests linked CSS/images/scripts as needed, and renders the page.

DNS locates a server; it does not deliver the whole web page. The browser renders the content; the search engine is not needed when a URL is entered directly.

## Independent explanation

A link in an unexpected email opens an HTTPS page asking for a bank password. Explain why encrypted transport is useful but insufficient to establish that the page belongs to the bank. Name a check that addresses the actual risk.

## Written practice and self-review

Browsers display connection-security information; its icon and presentation vary.

1. Explain the **three core security guarantees** provided by **HTTPS** (Confidentiality / Encryption, Authentication, and Data Integrity).
2. Describe how a web browser uses a **digital certificate** and a **Certificate Authority (CA)** to verify that a web server is authentic.

Write an explanation before checking the theory. Check that each claim answers the question, uses the correct concept and explains why it applies. Discuss uncertain points with a teacher. The structured exercise below checks specific facts; it does not automatically mark this explanation.

---

## Interactive Exercises & Autotest Specifications

### Exercise 1: Concept Check: Apply the distinction (Fill in blank, 30 XP)

**Instructions:**
Work out each answer before submitting. Protocol protecting HTTP in transit: Does HTTPS guarantee an honest business: yes or no? Service resolving a host name before the connection:


**Starter Code:**
```text
{"prompt":"Concept Check: Apply the distinction","template":"1. Protocol protecting HTTP in transit: [blank_1]\n2. Does HTTPS guarantee an honest business: yes or no? [blank_2]\n3. Service resolving a host name before the connection: [blank_3]","blanks":[{"id":"blank_1"},{"id":"blank_2"},{"id":"blank_3"}],"word_bank":["TLS","SSL","yes","no","DNS","FTP","MAC"]}
```


### Exercise 2: Exam-Style Question: Web Protocols & Security Acronyms (Fill in blank, 35 XP)

**Instructions:**
Complete each statement regarding web communication protocols:

1. The unencrypted protocol used to transmit web pages across standard port 80 is **[blank_1]**.
2. The secure protocol that encrypts web traffic across port 443 is **[blank_2]**.
3. The modern cryptographic security protocol that replaced SSL to provide encryption for HTTPS is **[blank_3]**.


**Starter Code:**
```text
{"word_bank":["HTTP","HTTPS","TLS","FTP","HTML","URL"],"template":"1. Unencrypted web protocol: [blank_1]\n2. Encrypted secure web protocol: [blank_2]\n3. Cryptographic protocol securing HTTPS: [blank_3]","prompt":"Exam-Style Question: Web Protocols & Security Acronyms","blanks":[{"id":"blank_1"},{"id":"blank_2"},{"id":"blank_3"}]}
```

**Autotest Expectations:**
- **Correct web protocol acronyms**: `text_exact` -> Expected: `{"blank_1":"HTTP","blank_2":"HTTPS","blank_3":"TLS"}`

### Exercise 3: Application: A lookalike shop (Fill in blank, 30 XP)

**Instructions:**
Work out each answer before submitting. A fraudulent domain has a valid HTTPS certificate. Does that prove the shop is honest: yes or no? HTTPS encrypts data in storage or in transit?


**Starter Code:**
```text
{"prompt":"Application: A lookalike shop","template":"1. A fraudulent domain has a valid HTTPS certificate. Does that prove the shop is honest: yes or no? [blank_1]\n2. HTTPS encrypts data in storage or in transit? [blank_2]","blanks":[{"id":"blank_1"},{"id":"blank_2"}],"word_bank":["yes","no","in transit","in storage","at rest"]}
```