Web Essentials: Clients, Servers, and

Communication
 World Wide Web

Originally, one of several systems for

organizing Internet-based information
 Competitors: WAIS, Gopher, ARCHIE
Distinctive feature of Web: support for
hypertext (text containing links)
 Communication via Hypertext Transport
Protocol (HTTP)
 Document representation using Hypertext
Markup Language (HTML)
2
 World Wide Web

The Web is the collection of machines

(Web servers) on the Internet that provide
information, particularly HTML documents,
via HTTP.
Machines that access information on the
Web are known as Web clients. A Web
browser is software used by an end user to
access the Web.
3
 Hypertext Transport Protocol
(HTTP)
HTTP is based on the request-response
communication model:
 Client sends a request
 Server sends a response
HTTP is a stateless protocol:
 The protocol does not require the server to
remember anything about the client between
requests.
Date: 02-10-2024 4
 HTTP

Normally implemented over a TCP connection

(80 is standard port number for HTTP)
Typical browser-server interaction:
 User enters Web address in browser
 Browser uses DNS to locate IP address
 Browser opens TCP connection to server
 Browser sends HTTP request over connection
 Server sends HTTP response to browser over connection
 Browser displays body of response in the client area of
the browser window
Date: 02-10-2024 5
 HTTP

The information transmitted using HTTP is

often entirely text
Can use the Internet’s Telnet protocol to
simulate browser request and view server
response

Date: 02-10-2024 6
 HTTP
Connect { $ telnet www.example.org 80
Trying 192.0.34.166...
Connected to www.example.com
(192.0.34.166).
Escape character is ’^]’.

{
Send GET / HTTP/1.1
Request Host: www.example.org

{
HTTP/1.1 200 OK
Receive
Date: Thu, 09 Oct 2003 20:30:49 GMT
Response
…

Date: 02-10-2024 7
 HTTP Request

Structure of the request:

 start line
 header field(s)
 blank line
 optional body

Date: 02-10-2024 8
 HTTP Request

Structure of the request:

 start line
 header field(s)
 blank line
 optional body

Date: 02-10-2024 9
 HTTP Request

Start line
 Example: GET / HTTP/1.1
Three space-separated parts:
 HTTP request method
 Request-URI (Uniform Resource Identifier)
 HTTP version

Date: 02-10-2024 10
 HTTP Request

Start line
 Example: GET / HTTP/1.1
Three space-separated parts:
 HTTP request method
 Request-URI
 HTTP version
 We will cover 1.1, in which version part of start line
must be exactly as shown
Date: 02-10-2024 11
 HTTP Request

Start line
 Example: GET / HTTP/1.1
Three space-separated parts:
 HTTP request method
 Request-URI
 HTTP version

Date: 02-10-2024 12
 HTTP Request

Uniform Resource Identifier (URI)

 Syntax: scheme : scheme-depend-part
 Ex: In http://www.example.com/
the scheme is http
 Request-URI is the portion of the requested URI
that follows the host name (which is supplied by
the required Host header field)
 Ex:/ is Request-URI portion of
http://www.example.com/
Date: 02-10-2024 13
 URI

URI’s are of two types:

 Uniform Resource Name (URN)
 Can be used to identify resources with unique names,
such as books (which have unique ISBN’s)
 Scheme is urn

 Uniform Resource Locator (URL)

 Specifies location at which a resource can be found
 In addition to http, some other URL schemes are

https, ftp, mailto, and file

Date: 02-10-2024 14
 HTTP Request

Start line
 Example: GET / HTTP/1.1
Three space-separated parts:
 HTTP request method
 Request-URI
 HTTP version

Date: 02-10-2024 15
 HTTP Request

Common request methods:

 GET
 Used if link is clicked or address typed in browser
 No body in request with GET method

 POST
 Used when submit button is clicked on a form
 Form information contained in body of request

 HEAD
 Requests that only header fields (no body) be returned
in the response
Date: 02-10-2024 16
 HTTP Request

Structure of the request:

 start line
 header field(s)
 blank line
 optional body

Date: 02-10-2024 17
 HTTP Request

Header field structure:

 field name : field value
Syntax
 Field name is not case sensitive
 Field value may continue on multiple lines by
starting continuation lines with white space
 Field values may contain MIME types, quality
values, and wildcard characters (*’s)
Date: 02-10-2024 18
 Multipurpose Internet Mail
Extensions (MIME)
Convention for specifying content type of a
message
 In HTTP, typically used to specify content type
of the body of the response
MIME content type syntax:
 top-level type / subtype
Examples: text/html, image/jpeg

Date: 02-10-2024 19
 HTTP Quality Values and
Wildcards
Example header field with quality values:
accept:
text/xml,text/html;q=0.9,
text/plain;q=0.8, image/jpeg,

image/gif;q=0.2,*/*;q=0.1
Quality value applies to all preceding items
Higher the value, higher the preference
Note use of wildcards to specify quality 0.1
Date: 02-10-2024 20
 HTTP Request

Common header fields:

 Host: host name from URL (required)
 User-Agent: type of browser sending request
 Accept: MIME types of acceptable documents
 Connection: value close tells server to close
connection after single request/response
 Content-Type: MIME type of (POST) body, normally
application/x-www-form-urlencoded
 Content-Length: bytes in body
 Referer: URL of document containing link that supplied
URI for this HTTP request
Date: 02-10-2024 21
 HTTP Response

Structure of the response:

 status line
 header field(s)
 blank line
 optional body

Date: 02-10-2024 22
 HTTP Response

Structure of the response:

 status line
 header field(s)
 blank line
 optional body

Date: 02-10-2024 23
 HTTP Response

Status line
 Example: HTTP/1.1 200 OK
Three space-separated parts:
 HTTP version
 status code
 reason phrase (intended for human use)

Date: 02-10-2024 24
 HTTP Response

Status code
 Three-digit number
 First digit is class of the status code:
 1=Informational
 2=Success

 3=Redirection (alternate URL is supplied)

 4=Client Error

 5=Server Error

 Other two digits provide additional information


See http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html
Date: 02-10-2024 25
 HTTP Response

Structure of the response:

 status line
 header field(s)
 blank line
 optional body

Date: 02-10-2024 26
 HTTP Response

Common header fields:

 Connection, Content-Type, Content-Length
 Date: date and time at which response was generated
(required)
 Location: alternate URI if status is redirection
 Last-Modified: date and time the requested resource was
last modified on the server
 Expires: date and time after which the client’s copy of
the resource will be out-of-date
 ETag: a unique identifier for this version of the requested
resource (changes if resource changes)
Date: 02-10-2024 27
 Client Caching

A cache is a local copy of information

obtained from some other source
Most web browsers use cache to store
requested resources so that subsequent
requests to the same resource will not
necessarily require an HTTP request/response
 Ex: icon appearing multiple times in a Web page

Date: 02-10-2024 28
Client Client Caching Server

1. HTTP request for image

2. HTTP response containing image

Browser Web
Server

3. Store image

Cache

Date: 02-10-2024 29
Client Client Caching Server

Browser Web
Server
I need that
image
again…

Cache

Date: 02-10-2024 30
Client Client Caching Server

This…

HTTP request for image

Browser Web
HTTP response containing image Server
I need that
image
again…

Cache

Date: 02-10-2024 31
 Client Client Caching Server

Browser Web
Server
I need that
image
again…

Get … or this
image

Cache

Date: 02-10-2024 32
 Client Caching

Cache advantages
 (Much) faster than HTTP request/response
 Less network traffic
 Less load on server
Cache disadvantage
 Cached copy of resource may be invalid
(inconsistent with remote version)

Date: 02-10-2024 33
 Client Caching

Validating cached resource:

 Send HTTP HEAD request and check Last-
Modified or ETag header in response
 Compare current date/time with Expires header
sent in response containing resource
 If no Expires header was sent, use heuristic
algorithm to estimate value for Expires
 Ex: Expires = 0.01 * (Date – Last-Modified) + Date

Date: 02-10-2024 34
 Character Sets

Every document is represented by a string of

integer values (code points)
The mapping from code points to characters is
defined by a character set
Some header fields have character set values:
 Accept-Charset: request header listing character sets that
the client can recognize
 Ex: accept-charset: ISO-8859-1,utf-8;q=0.7,*;q=0.5
 Content-Type: can include character set used to represent
the body of the HTTP message
 Ex: Content-Type: text/html; charset=UTF-8
Date: 02-10-2024 35
 Character Sets

Technically, many “character sets” are

actually character encodings
 An encoding represents code points using
variable-length byte strings
 Most common examples are Unicode-based
encodings UTF-8 and UTF-16
IANA maintains complete list of Internet-
recognized character sets/encodings
Date: 02-10-2024 36
 Character Sets
Typical US PC produces ASCII documents
US-ASCII character set can be used for such
documents, but is not recommended
UTF-8 and ISO-8859-1 are supersets of US-
ASCII and provide international compatibility
 UTF-8 can represent all ASCII characters using a single
byte each and arbitrary Unicode characters using up to 4
bytes each
 ISO-8859-1 is 1-byte code that has many characters
common in Western European languages, such as é
Date: 02-10-2024 37
 Web Clients

Many possible web clients:

 Text-only “browser” (lynx)
 Mobile phones
 Robots (software-only clients, e.g., search engine
“crawlers”)
 etc.
We will focus on traditional web browsers

Date: 02-10-2024 38
 Web Browsers
First graphical browser running on general-
purpose platforms: Mosaic (1993)

Date: 02-10-2024 39
Web Browsers

Date: 02-10-2024 40
 Web Browsers

Primary tasks:
 Convert web addresses (URL’s) to HTTP
requests
 Communicate with web servers via HTTP
 Render (appropriately display) documents
returned by a server

Date: 02-10-2024 41
 HTTP URL’s
http://www.example.org:56789/a/b/c.txt?t=win&s=chess#para5

host (FQDN) port path query fragment

authority Request-URI

Browser uses authority to connect via TCP

Request-URI included in start line (/ used
for path if none supplied)
Fragment identifier not sent to server (used
to scroll browser client area)
Date: 02-10-2024 42
 Web Browsers

Standard features

Save web page to disk
 Find string in page

Fill forms automatically (passwords, CC numbers, …)

Set preferences (language, character set, cache and
HTTP parameters)

Modify display style (e.g., increase font sizes)

Display raw HTML and HTTP header info (e.g., Last-
Modified)

Choose browser themes (skins)

View history of web addresses visited

Bookmark favorite pages for easy return
Date: 02-10-2024 43
 Web Browsers

Additional functionality:
 Execution of scripts (e.g., drop-down menus)
 Event handling (e.g., mouse clicks)
 GUI for controls (e.g., buttons)
 Secure communication with servers
 Display of non-HTML documents (e.g., PDF)
via plug-ins

Date: 02-10-2024 44
 Web Servers

Basic functionality:
 Receive HTTP request via TCP
 Map Host header to specific virtual host (one of many
host names sharing an IP address)
 Map Request-URI to specific resource associated with
the virtual host
 File: Return file in HTTP response
 Program: Run program and return output in HTTP response

 Map type of resource to appropriate MIME type and use

to set Content-Type header in HTTP response
 Log information about the request and response
Date: 02-10-2024 45
 Web Servers

httpd: UIUC, primary Web server c. 1995

Apache: “A patchy” version of httpd, now the
most popular server (esp. on Linux platforms)
IIS: Microsoft Internet Information Server
Tomcat:
 Java-based
 Provides container (Catalina) for running Java servlets
(HTML-generating programs) as back-end to Apache or
IIS
 Can run stand-alone using Coyote HTTP front-end
Date: 02-10-2024 46
 Web Servers

Some Coyote communication parameters:

 Allowed/blocked IP addresses
 Max. simultaneous active TCP connections
 Max. queued TCP connection requests
 “Keep-alive” time for inactive TCP connections
Modify parameters to tune server
performance

Date: 02-10-2024 47
 Web Servers

Some Catalina container parameters:

 Virtual host names and associated ports
 Logging preferences
 Mapping from Request-URI’s to server
resources
 Password protection of resources
 Use of server-side caching

Date: 02-10-2024 48
 Tomcat Web Server

HTML-based server administration

Browse to
http://localhost:8080
and click on Server Administration link
 localhost is a special host name that means
“this machine”

Date: 02-10-2024 49
Tomcat Web Server

Date: 02-10-2024 50
Tomcat Web Server

Date: 02-10-2024 51
Tomcat Web Server

Date: 02-10-2024 52
 Tomcat Web Server

Some Connector fields:

 Port Number: port “owned” by this connector
 Max Threads: max connections processed
simultaneously
 Connection Timeout: keep-alive time

Date: 02-10-2024 53
Tomcat Web Server

Date: 02-10-2024 54
 Tomcat Web Server

Each Host is a virtual host (can have

multiple per Connector)
Some fields:
 Host: localhost or a fully qualified domain name
 Application Base: directory (may be path relative
to JWSDP installation directory) containing
resources associated with this Host

Date: 02-10-2024 55
Tomcat Web Server

Date: 02-10-2024 56
 Tomcat Web Server

Context provides mapping from Request-URI

path to a web application
Document Base field is directory (possibly
relative to Application Base) that contains resources
for this web application
For this example, browsing to
http://localhost:8080/
returns resource from
c:\jwsdp-1.3\webapps\ROOT
 Returns index.html (standard welcome file)
Date: 02-10-2024 57
 Tomcat Web Server

Access log records HTTP requests

Parameters set using AccessLogValve
Default location: logs/access_log.* under
JWSDP installation directory
Example “common” log format entry (one line):
www.example.org - admin
[20/Jul/2005:08:03:22 -0500]
"GET /admin/frameset.jsp HTTP/1.1"

200 920 Date: 02-10-2024 58

 Tomcat Web Server

Other logs provided by default in JWSDP:

 Message log messages sent to log service by web
applications or Tomcat itself
 logs/jwsdp_log.*: default message log
 logs/localhost_admin_log.*: message log

for web apps within /admin context

 System.out and System.err output (exception
traces often found here):
 logs/launcher.server.log

Date: 02-10-2024 59
 Tomcat Web Server

Access control:
 Password protection (e.g., admin pages)
 Users
and roles defined in
conf/tomcat-users.xml
 Deny access to machines
 Useful for denying access to certain users by denying
access from the machines they use
 List of denied machines maintained in

RemoteHostValve (deny by host name) or

RemoteAddressValve (deny by IP address)
Date: 02-10-2024 60
 Secure Servers

Since HTTP messages typically travel over

a public network, private information (such as
credit card numbers) should be encrypted to
prevent eavesdropping
https URL scheme tells browser to use
encryption
Common encryption standards:
 Secure Socket Layer (SSL)
 Transport Layer Security (TLS)
Date: 02-10-2024 61
 Secure Servers
I’d like to talk securely to you (over port 443)

HTTP Here’s my certificate and encryption data HTTP

Requests Requests

Here’s an encrypted HTTP request

TLS/ Here’s an encrypted HTTP response TLS/ Web

Browser
SSL SSL Server

Here’s an encrypted HTTP request

HTTP HTTP
Responses Here’s an encrypted HTTP response Responses

Date: 02-10-2024 62
 Secure Servers
Man-in-the-Middle Attack
Fake Fake
DNS www.example.org
Server 100.1.1.1
What’s IP
address for 100.1.1.1 My credit card number is…
www.example.org?

Real
Browser www.example.org

Date: 02-10-2024 63
 Secure Servers
Preventing Man-in-the-Middle
Fake Fake
DNS www.example.org
Server 100.1.1.1
What’s IP
address for 100.1.1.1 Send me a certificate of identity
www.example.org?

Real
Browser www.example.org

Date: 02-10-2024 64