CT320: WWW

Web Browsing

Web browsers use HTTP & HTTPS application-level protocols.
These are TCP protocols on ports 80 & 443.
Use HTTPS!
- HTTP is unencrypted. Anybody can see what you’re doing.
- HTTP is unsigned. Its contents can be replaced or modified anywhere en route, and you wouldn’t know.
  - Downloading software? I hope that nobody in the middle altered it!

Browsing Request

What happens when we fetch a web page?
Let’s fetch this page, https://cs.colostate.edu/~ct320/Fall17/Lecture/WWW.
- Translate www.cs.colostate.edu to an IP address via DNS.
- Make a TCP connection to www.cs.colostate.edu
- Send this:

        GET 320/Fall17/Lecture/WWW HTTP/1.1
        Accept-Encoding: gzip, deflate, br 
        Accept-Language: en-US,en;q=0.9 
        User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/62.0.3202.75 Chrome/62.0.3202.75 Safari/537.36 
        Host: www.cs.colostate.edu

Browsing Response

The response from the web server looks like this:

    HTTP/1.1 200 OK
    Date: Mon, 23 Dec 2024 15:07:25 GMT
    Server: Apache/2.4.6 (Red Hat Enterprise Linux)
    Content-Type: text/html; charset=UTF-8

    <!doctype html>
    <meta charset='utf-8'>
    <title>CT320 | Lecture / WWW</title>
    …

Browsing Security Considerations

The HTTPS payload (request & response) is encrypted, going both ways.
However, IP source & destination numbers are in the IP packet, so everybody knows that I’m talking to www.cs.colostate.edu.
However, nobody knows that I’m asking for the CT320 Perl lecture.
What will be revealed if you fetch https://geriatric-manatee-love.com/dating/tips ?

Private Browsing

Private Browsing

Chrome: Incognito
Firefox: Private
Internet Explorer: InPrivate
What does it actually do?

CT320: Network and System Administration

Fall 2017

WWW

CT320: WWW

Web Browsing

Browsing Request

Browsing Response

Browsing Security Considerations

Private Browsing

Private Browsing