What is a website?
A web browser is an application that can send requests to a server and displays/stores the response data. When you use a browser to send a request, or even when you use curl, it usually provides headers with it. These HTTP request headers are sent to a websites backend server, which then returns response data. But before that, theres a few processes that occur first.
Finding the Server: DNS
When the browser sends a request to access a website (i.e., google.com), it needs to find the web domains server IP address. If that information doesn’t already exist in the browsers cache, it will ask the OS to send a DNS request to the router for the given domain, which will utilize the configured Domain Name System (DNS). By default, your device will most likely use your ISP’s DNS resolver, but you can also explicitly pick DNS providers of your choosing.
Connecting Securely: TCP and TLS
Once the browser receives the actual IP address of the server, it has to send a request to the website. That involves a Transmission Control Protocol (TCP) handshake. When an application sends a request to a web server, it typically uses standards like TCP. There are two standards named HTTP1.1/2 that use TCP underneath. A new transport protocol QUIC (developed by Google engineers more than a decade ago) is used in the newer HTTP3. In order to ensure that the data being exchanged via TCP is secure, Transport Layer Security (TLS) is used. TLS depends on TCP’s reliable byte stream to ensure it encrypts/decrypts correctly. TLS has replaced the older Secure Sockets Layer (SSL) protocol that was used for the same purpose.
Cookies
Browsers also store data sent from websites locally, which are known as cookies. Servers do this by sending Set-Cookie, an HTTP response header.
In essence, this is the HTTP response header a server would send a client:
Set-Cookie: <cookie-name>=<cookie-value>; Domain=<domain-value>
But when we develop applications in the modern age, we typically use frameworks. Here is an example of how Flask (Python) would send cookies:
from flask import Flask, make_response
app = Flask(__name__)
@app.route("/login")
def login():
resp = make_response("Logged in!")
resp.set_cookie(
"session_id",
"abc123",
domain="example.com",
path="/",
max_age=3600, # seconds, maps to Max-Age
secure=True,
httponly=True,
samesite="Lax"
)
return resp
Authentication: IdP and SP
Certain websites require users to authenticate in order to access sensitive information. They accomplish this by using authentication methods. This involves the concepts of Identity Providers (IdP) and Service Providers (SP). IdP proves who a client is while SP is the application/tool the client wants to acess (like a website). The SP will use an IdP to ensure that it accurately grants access to the right user. Two of the most common standards for this, each serving different purposes:
- OpenID Connect (OIDC) - a thin identity layer built on top of OAuth 2.0, used to let applications verify a users identity
- Security Assertion Markup Language (SAML) - an older, XML-based standard used for exchanging authentication & authorization between an IdP and SP, still common in enterprise SSO