Chapter 3 · Web Applications
3-2 Web Application Communication Methods
When you click a link or press search, your device does not hold the whole website — it asks a distant computer for it. Your browser is the client that makes the request; a server somewhere answers with a response. That exchange, run by shared rules called protocols, is how every web application talks.
Guiding question
How do the client and server communicate to make a web application work, and what rules and messages do they use?
Learning outcome. Explain the client and server model and the difference between HTTP and HTTPS, describe how HTTP requests and responses work, and explain the role of an API in exchanging data.
With a partner. Look at the address bar of any site you both use. Does it start with http:// or https://? Now think of the last time a page failed to load — what did it say? Keep that message in mind; by the end of this lesson you will be able to say whose fault it was.
1 · Client and server
Client … the side that requests data or processing from the server.
Web browsers and smartphone apps fall into this category.
Server … the side that receives requests from clients, processes them, and returns responses.
A web application works by the client sending a request and the server returning a response. That is the whole shape, and everything else in this lesson is a detail of one of those two messages.
2 · HTTP and HTTPS
HTTP (HyperText Transfer Protocol) … a communication protocol for exchanging data between clients (browsers and apps) and servers.
HTTPS (HTTP Secure) … a communication protocol that adds TLS encryption to HTTP. Because the communication content is encrypted, the risk of its being read by third parties is reduced.
Websites whose URLs begin with https:// use HTTPS communication — which is why the padlock matters on any page where you type something private.
A wording you will meet: this page says TLS, and so does the book’s Point! box — but the book’s own Solution and Exercise write SSL/TLS. They mean the same protection. TLS is the modern version of the older SSL, and the two names are still often printed together. Do not be thrown if an exam paper uses either.
HTTP requests and responses
Requests sent from the client to the server include an HTTP method, which says “what kind of operation is wanted.”
| Method | Role | Examples |
|---|---|---|
| GET | Retrieve data from the server | Displaying a web page, retrieving search results |
| POST | Send data to the server | Sending login information, submitting form contents |
Responses returned from the server include a number saying how the processing turned out, called a status code.
200
Success
The request was processed successfully.
404
Page not found
The specified URL does not exist.
500
Server error
A problem occurred on the server side.
404 and 500 are not the same problem.
404 means you asked for something that is not there — often a typed or old address. The server is fine. 500 means the server itself went wrong — you asked correctly and it failed to answer. One you can fix by checking the address; the other you cannot fix at all.
Pick what the user did. The top line is the request leaving with its method; the bottom line is the response coming back with its status code. Everything in this lesson is one of those two lines.
Going out — the method. You only want to LOOK at something, so nothing is being sent up — the method is GET.
You know that GET retrieves and POST sends. But what actually differs between them? The answer is not about intention — it is about where the data is written, and everything else follows from that one fact.
With GET, the data is written into the address itself:
https://shop.example.com/search?q=running+shoes&size=42
Everything after the ? is the data. It is visible in the address bar, and it travels as part of the address.
With POST, the address stays plain and the data travels in the body of the request — the part underneath, which is not displayed anywhere.
The book’s wording, which is what an exam wants: GET requests data from the server; POST sends data to the server. (p.63)
🧮 Four consequences, all from that one difference
- 1
A URL is shown in the address bar. So GET data is visible to anyone looking at the screen.
Why this step: This is why a password must never be sent by GET. It is not a rule to memorise — it follows from where the data was put. Somebody standing behind you would simply read it.
- 2
A URL is saved in browser history, and often in the server’s logs and any proxy in between.
Why this step: So GET data leaves copies in places nobody thinks about, and it can sit in a log file for years. A search term is fine there. A national ID number is not.
Most people slip here: HTTPS does not fix this. Encryption protects the address in transit, but the browser and the receiving server both still record it — encryption is about who can read it on the way, not who keeps it at the ends.
- 3
A URL can be bookmarked, copied and shared — and it will produce the same result again.
Why this step: This is a genuine advantage, and the reason searches use GET. Sending someone a link to a set of search results is only possible because the search terms are IN the link.
- 4
A URL can be reloaded, and the browser will happily repeat it without asking.
Why this step: And here is the danger the other way round. If “buy this” were a GET, then refreshing the page, or pressing back, would order it again. This is why browsers warn you before resubmitting a POST — and why anything that CHANGES something should be a POST.
- 5
The rule that generates all four: GET to read, POST to change.
Why this step: Reading is safe to repeat, safe to share and safe to log, so putting it in the address costs nothing and buys shareable links. Changing something is none of those things. Every detail above is a consequence of that single choice.
/delete?id=42 — a change, but done with GET because a link was convenient. It worked fine for months, because only logged-in staff could see those links and they only clicked them deliberately.Then a search-engine crawler was let in. A crawler does exactly one thing: it follows every link it finds. It followed all of them, and the system dutifully deleted every record, because each request was perfectly valid and came from a logged-in session.
Nothing was hacked. The system did precisely what it was built to do. The mistake was using a method meaning “fetch this, it is safe to repeat” for an action that was neither.
A well-documented early web incident, repeated many times since.
API (Application Programming Interface)
API … a system for exchanging data between different pieces of software.
In web applications the frontend often sends requests to the backend through an API and receives data back. Data exchanged through an API is often written in a format called JSON (JavaScript Object Notation) — a data format that is easy for people to read and easy for computers to process.
Think of an API as a service window. You do not walk into the back office and help yourself; you go to the window, ask in the agreed way, and are handed what you asked for. Because the window never changes shape, two completely different programs — written by different people, in different languages — can still work together.
How the real paper is built
The ministry sets half multiple choice and half written answer in every subject. The two halves are not the same skill. In the multiple-choice half you have to spot the wrong options quickly — and the wrong options are built out of the mistakes students really make. In the written half nobody gives you the answer to recognise; you have to produce it, in your own words, with a reason.
Practise both. Being good at one half and weak at the other costs you exactly half the paper.
- client
- — the side that requests data or processing.
- server
- — the side that processes requests and returns responses.
- HTTP method
- — says what is wanted — GET or POST.
- status code
- — reports the result — 200, 404, 500.
- API
- — lets different software exchange data.
- JSON
- — a readable data format.
Worked Example
(1) Mark each statement with ○ if it is true or × if it is false.
A The client is the side that requests data or processing from the server, and the server is the side that returns the response.
B HTTPS is a communication protocol that adds encryption to HTTP.
C The GET method is for sending data to the server.
D Status code 404 indicates that the page is not found.
(2) Match each description (a–c) with the choice that fits: A HTTP, B API, C HTTPS.
a A communication protocol for exchanging data between web browsers and servers
b A system for exchanging data between different pieces of software
c A communication protocol that adds encryption to HTTP
1 · Answer the following questions.
2(1) · Which pairing of status code and meaning is NOT appropriate?
Mark each statement with ○ if it is true or × if it is false.
200 — The request was processed successfully
404 — Page not found
500 — The request was processed successfully
500 — A problem occurred on the server side
Read “NOT appropriate” carefully. Three of these four are correct, and the question wants the wrong one. Marking every true statement ○ and the false one × gets you there safely — the × is the answer.
2(2) · Which most appropriately describes an API?
Mark each statement with ○ if it is true or × if it is false.
A technology for adjusting the appearance of web pages
A system for exchanging data between different pieces of software
A technology for encrypting data and sending it safely
An HTTP method for retrieving data from the server
Think as an Engineer — Investigate & Decide
A school in your city wants a web app where students log in, view their timetable, and download a PDF. You plan how the client and server communicate.
1 · Choose the method.
For three actions — loading a student’s grade history, submitting the login form, and requesting today’s schedule from another school system — say whether GET or POST fits, and for the last one say whether an API is involved.2 · Choose the protocol.
Decide whether the login should use HTTP or HTTPS, and give the reason.3 · Decide.
Recommend the communication design and give two reasons. In pairs, compare your method choices and agree together on which action must use POST. Give evidence for your answer.
The third action is the interesting one. Asking another school’s system for data is exactly what an API is for — two separate pieces of software, built by different people, exchanging data through an agreed window. The first two actions stay inside your own app; only the third has to reach across.
In a New Context
Lesson Question — Answered
The lesson asked how the client and server communicate and what rules and messages they use. A web application works when a client — a browser or app — sends a request and a server processes it and returns a response. They communicate through a protocol: HTTP carries the messages, and HTTPS adds SSL/TLS encryption so the content is not easily intercepted.
Each request carries an HTTP method saying what is wanted — GET to retrieve, POST to send — and each response carries a status code reporting the result, such as 200 for success or 404 for not found. Often the frontend and backend exchange data through an API, frequently in the JSON format, which is easy for both people and computers to read. Communication in a web application is therefore an organised exchange of requests and responses, shaped by protocols, methods, status codes and APIs.
1 · Quiz yourself first.
Cover the Point! sections and say, out loud: what a client is, what a server is, what GET and POST each do, and what 200, 404 and 500 each mean. Then do the questions.
2 · Read the passage and fill in the blanks.
A web application operates by communication between a ( a ), which requests data or processing from the server, and a ( b ), which receives the request, processes it, and returns a response. This communication uses a protocol called ( c ). The protocol that adds SSL/TLS encryption to ( c ) is called ( d ).
3(1) · For each operation, which HTTP method is used?
Match each description with the choice that fits it.
Displaying a web page
Entering an ID and password into a login form and submitting them
Displaying search results
Submitting the contents of a contact form
One word decides it. If the sentence contains displaying, showing or retrieving, it is GET. If it contains submitting, sending or entering, it is POST.
3(2) · Which most appropriately describes HTTPS?
Mark each statement with ○ if it is true or × if it is false.
A method for retrieving data from the server
A system for exchanging data between different pieces of software
A communication protocol that adds SSL/TLS encryption to HTTP
A status code indicating that a problem has occurred on the server side
Reflect: When a page fails to load, which status code would help you most to understand why, and what would it tell you?
Challenge: Name one app you use and describe one request it sends and the response it expects.
Sign In to Keep Going
You've reached the end of the free preview. Sign in — and upgrade to Plus or Pro — to keep going with Programming and Artificial Intelligence.
Full Access
Unlock all 30 lessons