1
  1. HTTP knows to look for user names and passwords in authorization headers in HTTP requests. So this is at HTTP level.
  2. Is it correct that putting user passwords into message bodies of HTTP requests is at web application level, which is higher than the HTTP level, because HTTP doesn't interpret the content of the message bodies, while web applications do? Does HTTP know to look for user names and passwords or for other specifics in message bodies?
  3. Since user passwords can also be put into cookies and URLs as query strings (although bad idea), I was wondering if these two ways are also at the web application level not at the HTTP level? Does the HTTP protocol also not interpret the contents of cookies and query strings of URL? Does HTTP specify server to look for user names and passwords or for something else in cookies and query strings?

    Specific client and server libraries may parse the contents of cookies and URL query strings. I was wondering if they implement the functionalities as an extra outside of the HTTP protocol?

In summary, does HTTP protocol interpret contents of cookies and query strings in URL, in the same sense that it doesn't interpret message bodies?

My questions come from How does a HTTP client authenticate itself with a HTTP server?

2 Answers 2

1

Let us try to answer the questions one at a time:

  1. Is it correct that putting user passwords ..., while web applications do? Does HTTP know to look for user names and passwords or for other specifics in message bodies?

At the HTTP level, the body is an opaque stream of bytes. But it is common to use HTML form answers to give passwords for form authentication. Then, it is not processed at HTTP level, even if it uses an encoding which is mainly (if not only) used during HTTP exchanges.

  1. Since user passwords can also be put into cookies and URLs as query strings (although bad idea), I was wondering if these two ways are also at the web application level not at the HTTP level? Does the HTTP protocol also not interpret the contents of cookies and query strings of URL? Does HTTP specify server to look for user names and passwords or for something else in cookies and query strings?

The query string is a representation of a mapping field => value, where one field name may be used more that once. The interpretation on the meaning is left to the application.

The content of a cookie is also an opaque bytes data which can only be interpreted at application level. The HTTP protocol only specifies how cookies are exchanged.

In summary, does HTTP protocol interpret contents of cookies and query strings in URL, in the same sense that it doesn't interpret message bodies?

Definitely not. At the HTTP protocol level, the content of cookies, query string and body are all opaque.

1
  • Thanks. Does HTTP separate a URL into different parts: domain, port, parameters, query strings, fragments? Does HTTP protocol interpret all the other parts of a URL than query strings? or does HTTP only interpret IP address and port number?
    – Tim
    Commented Feb 10, 2020 at 10:30
1

I think this depends on the HTTP library that handles the requests, for example, in theory if the content of a POST message is json and the content-type is set to text/html the responsibility of give an error will be from the application (the content ins not text and is json), however depending on the HTTP library this check can be done on the HTTP library, or the check will be on the application that is using the library.

Regarding the parameters of the HTTP, such as the cookies, I think this is responsibility of the HTTP library, but I have seen that in some cases the cookies (for example) where very dependent on the higher level (postgress) and the HTTP library is not able to interpreter/parse all the fields.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .