HTTP Protocol, ASP.NET Core & Web Communication

TAKEAWAYS:

• HTTP is a stateless, text-based protocol where clients (browsers) send requests and servers (like ASP.NET Core) return responses with status codes (200, 404, 500).
• ASP.NET Core leverages HTTP to handle routing, middleware pipelines, and RESTful API design, while HTTPS adds encryption via TLS/SSL.
• Key HTTP methods (GET, POST, PUT, DELETE) map directly to CRUD operations in web apps, with headers (e.g., Content-Type, Authorization) controlling behavior.
• ASP.NET Core’s Startup.cs configures middleware (e.g., UseRouting(), UseEndpoints()) to process HTTP requests in a pipeline.
• Real-world apps like eSewa use HTTP to authenticate users via OAuth tokens, while Daraz relies on REST APIs for inventory updates.
• Performance and security trade-offs exist: HTTP/2 multiplexes requests, but HTTPS adds latency due to TLS handshakes.

1. HTTP: The Foundation of Web Communication

HTTP (HyperText Transfer Protocol) is the stateless, client-server protocol that powers the web. Unlike TCP (which ensures reliable data delivery), HTTP focuses on request-response cycles for fetching resources (HTML, JSON, images). It runs on top of TCP (port 80 for HTTP, 443 for HTTPS).

How HTTP Works: A Step-by-Step Trace

sequenceDiagram
    participant Client as Browser (User)
    participant Server as ASP.NET Core App
    Client->>Server: GET /products HTTP/1.1\nHost: api.daraz.com\nAccept: application/json
    Server-->>Client: HTTP/1.1 200 OK\nContent-Type: application/json\n{"products": [...]}

Key Components of an HTTP Request/Response:

Worked Example: Daraz Order Placement

1. User clicks "Buy Now" → Browser sends:

   POST /api/orders HTTP/1.1
   Host: api.daraz.com
   Content-Type: application/json
   Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
   {"productId": 123, "quantity": 2, "userId": 456}
   

2. ASP.NET Core validates the token (JWT), checks inventory, and returns:

   HTTP/1.1 201 Created
   Location: /api/orders/789
   {"orderId": 789, "status": "Processing"}
   

2. HTTP vs. HTTPS: Security and Performance Trade-offs

How HTTPS establishes a secure connection between a browser and ASP.NET Core server (Image: Fleshgrinder and The People from The Tango! Desktop Project., Public domain, via Wikimedia Commons) Caption: The 4-step TLS handshake (ClientHello → ServerHello → Key Exchange → Symmetric Encryption).

Real-World Impact:

• eSewa uses HTTPS to secure payment tokens (e.g., Authorization: Bearer <JWT>).
• Ncell’s myNcell app encrypts SMS-based transactions to prevent interception.

3. ASP.NET Core’s Role in HTTP Processing

ASP.NET Core is a cross-platform framework that handles HTTP requests via:

1. Middleware Pipeline: A chain of components (e.g., routing, authentication) that process requests sequentially.
2. Routing: Maps URLs to controller actions (e.g., GET /products → ProductsController.Index()).
3. Endpoints: Define how HTTP methods (GET/POST) trigger logic.

Middleware Pipeline in ASP.NET Core

flowchart TD
    A["Request\n(HTTP GET /home)"] --> B["UseRouting\nMatches pattern"]
    B --> C["UseAuthentication\nChecks JWT/OAuth"]
    C --> D["UseAuthorization\nValidates roles"]
    D --> E["UseEndpoints\nInvokes controller"]
    E --> F["Response\n(HTTP 200 OK)"]

Code Example: Configuring Middleware in Program.cs

var builder = WebApplication.CreateBuilder(args);
var app = builder.Build();

// Middleware order matters!
app.UseRouting();
app.UseAuthentication();
app.UseAuthorization();
app.MapControllerRoute(
    name: "default",
    pattern: "{controller=Home}/{action=Index}/{id?}");
app.Run();

Worked Example: NTC’s Website (HTTP → ASP.NET Core)

1. User visits ntc.gov.np → Browser sends:

   GET /services/electricity-bill HTTP/1.1
   Host: ntc.gov.np
   

2. ASP.NET Core routes to ServicesController.Bill() and returns:

   HTTP/1.1 200 OK
   Content-Type: text/html
   <html>...</html>
   

4. HTTP Methods and CRUD Operations

Worked Example: Khalti’s Payment API

[HttpPost("payments")]
public IActionResult ProcessPayment([FromBody] PaymentRequest request)
{
    if (!ModelState.IsValid) return BadRequest();
    var result = _paymentService.Process(request);
    return CreatedAtAction(nameof(GetPayment), new { id = result.Id }, result);
}

• Request:

  POST /api/payments HTTP/1.1
  Content-Type: application/json
  {"amount": 500, "userId": 123, "method": "khalti"}
  

• Response (201 Created):

  HTTP/1.1 201 Created
  Location: /api/payments/abc123
  {"transactionId": "abc123", "status": "Pending"}
  

5. HTTP Status Codes: What They Mean

6. Headers: Controlling HTTP Behavior

Headers add metadata to requests/responses. Key headers in ASP.NET Core:

Worked Example: NEPSE API with Headers

GET /api/stock-prices HTTP/1.1
Host: api.nepse.com.np
Accept: application/json
Authorization: ApiKey xxxxx-yyyy-zzzz

• Response:

  HTTP/1.1 200 OK
  Content-Type: application/json
  Cache-Control: max-age=300
  {"stocks": [...]}
  

7. HTTP/2 and Performance Optimizations

HTTP/2 improves performance via:

• Multiplexing: Multiple requests over a single connection (reduces latency).
• Header Compression: Uses HPACK to shrink headers.
• Server Push: Proactively sends resources (e.g., CSS/JS files).

Comparison: HTTP/1.1 vs. HTTP/2

Real-World Use:

• YouTube uses HTTP/2 to stream videos faster.
• Google’s ASP.NET Core apps leverage multiplexing for search results.

In the Real World

1. eSewa’s API

   • Uses HTTP + JWT tokens for authentication:

     POST /api/payments
     Authorization: Bearer <JWT>
     

   • ASP.NET Core validates tokens via UseAuthentication() middleware before processing payments.

2. Daraz’s Order System

   • Relies on RESTful HTTP methods:
     • GET /products → Fetch inventory.
     • POST /orders → Create an order (with Content-Type: application/json).
   • ASP.NET Core routes these to controllers like OrdersController.

3. Ncell’s myNcell App

   • HTTPS secures SMS-based transactions (e.g., POST /api/topup).
   • Status codes handle failures:
     • 402 Payment Required → Insufficient balance.
     • 503 Service Unavailable → Network downtime.

Exam Tip

1. Memorize HTTP Methods and CRUD:

   • GET = Read, POST = Create, PUT = Update, DELETE = Delete.
   • Exam Question: "Which HTTP method would you use to update a user’s profile in ASP.NET Core?" Answer: PUT /api/users/{id} with [HttpPut] attribute.

2. Middleware Order Matters:

   • Always configure in this order: UseRouting() → UseAuthentication() → UseAuthorization() → UseEndpoints().
   • Exam Question: "Why does UseAuthentication() fail if placed after UseEndpoints()?" Answer: Endpoints are invoked before authentication checks.

3. Status Codes Are Common:

   • Know 200, 201, 401, 404, 500 and when to return them.
   • Exam Question: "What status code should ASP.NET Core return if a user tries to access /admin without a role?" Answer: 403 Forbidden (after UseAuthorization rejects the request).

4. Real-World Scenarios:

   • Expect questions like: "How would you design an HTTP API for a Khalti-like payment system?" Answer:
     • Use POST /payments with Authorization: Bearer <JWT>.
     • Return 201 Created on success, 402 Payment Required on failure.
     • Secure with HTTPS (TLS 1.2+).

5. ASP.NET Core Configuration:

   • Know how to add middleware in Program.cs and map routes.
   • Exam Question: "Write the code to enable JWT authentication in ASP.NET Core." Answer:

     builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
         .AddJwtBearer(options => { /* Configure issuer/signing key */ });
     app.UseAuthentication();