• 参考链接：
  https://en.wikipedia.org/wiki/List_of_HTTP_header_fields
  https://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol#HTTP_session
  HTTP headers

• Apple 官方文档
  Networking Overview
  URL Loading System
  Introduction to CFNetwork Programming Guide
  Introduction to Stream Programming Guide for Cocoa

---

Http 协议的格式

pasted-image.png

Request message

The request message consists of the following:

• a request line (e.g., GET /images/logo.png HTTP/1.1, which requests a resource called <tt style="font-family: monospace, monospace;">/images/logo.png</tt> from the server.)
• request header fields (e.g., Accept-Language: en).
• an empty line
• an optional message body

The request line and other header fields must each end with <CR><LF> (that is, a carriage return character followed by a line feed character). The empty line must consist of only <CR><LF> and no other whitespace.^[15] In the HTTP/1.1 protocol, all header fields except Host are optional.

A request line containing only the path name is accepted by servers to maintain compatibility with HTTP clients before the HTTP/1.0 specification in RFC 1945.^[16]

---

pasted-image-2.png

Response message

The response message consists of the following:

• a status line which includes the status code and reason message (e.g., HTTP/1.1 200 OK, which indicates that the client's request succeeded.)
• response header fields (e.g., Content-Type: text/html)
• an empty line
• an optional message body

The status line and other header fields must all end with <CR><LF>. The empty line must consist of only <CR><LF> and no other whitespace.^[15] This strict requirement for <CR><LF> is relaxed somewhat within message bodies for consistent use of other system linebreaks such as <CR> or <LF> alone.^[33]

pasted-image-3.png

---

QQ20180130-154706@2x.png

---

HTTP/1.0

• 缺点： 每个TCP连接只能发送一个请求。发送数据完毕，连接就关闭，如果还要请求其他资源，就必须再新建一个连接。TCP连接的新建成本很高，因为需要客户端和服务器三次握手，并且开始时发送速率较慢（slow start）。所以，HTTP 1.0版本的性能比较差。

HTTP/1.1

• 引入了持久连接（persistent connection），即TCP连接默认不关闭，可以被多个请求复用，不用声明Connection: keep-alive。客户端和服务器发现对方一段时间没有活动，就可以主动关闭连接。不过，规范的做法是，客户端在最后一个请求时，发送Connection: close，明确要求服务器关闭TCP连接。
• 还引入了管道机制（pipelining），即在同一个TCP连接里面，客户端可以同时发送多个请求。这样就进一步改进了HTTP协议的效率。
• 缺点: 虽然1.1版允许复用TCP连接，但是同一个TCP连接里面，所有的数据通信是按次序进行的。服务器只有处理完一个回应，才会进行下一个回应。要是前面的回应特别慢，后面就会有许多请求排队等着。这称为"队头堵塞"（Head-of-line blocking）。

HTTP/2

• 复用TCP连接，在一个连接里，客户端和浏览器都可以同时发送多个请求或回应，而且不用按照顺序一一对应，这样就避免了"队头堵塞"。

• 二进制协议、双向的、实时的通信（Multiplexing）

---

HTTP连接

HTTP协议即超文本传送协议(Hypertext Transfer Protocol )，是Web联网的基础，也是手机联网常用的协议之一，HTTP协议是建立在TCP协议之上的一种应用。
HTTP连接最显著的特点是客户端发送的每次请求都需要服务器回送响应，在请求结束后，会主动释放连接。从建立连接到关闭连接的过程称为“一次连接”。
1）在HTTP 1.0中，客户端的每次请求都要求建立一次单独的连接，在处理完本次请求后，就自动释放连接。

2）在HTTP 1.1中则可以在一次连接中处理多个请求，并且多个请求可以重叠进行，不需要等待一个请求结束后再发送下一个请求。

由于HTTP在每次请求结束后都会主动释放连接，因此HTTP连接是一种“短连接”，要保持客户端程序的在线状态，需要不断地向服务器发起连接请求。通常 的做法是即时不需要获得任何数据，客户端也保持每隔一段固定的时间向服务器发送一次“保持连接”的请求，服务器在收到该请求后对客户端进行回复，表明知道 客户端“在线”。若服务器长时间无法收到客户端的请求，则认为客户端“下线”，若客户端长时间无法收到服务器的回复，则认为网络已经断开。

---

HTTP header fields

Headers can be grouped according to their contexts:

• General header: Headers applying to both requests and responses but with no relation to the data eventually transmitted in the body.
• Request header: Headers containing more information about the resource to be fetched or about the client itself.
• Response header: Headers with additional information about the response, like its location or about the server itself (name and version etc.).
• Entity header: Headers containing more information about the body of the entity, like its content length or its MIME-type.

屏幕快照 2019-01-22 上午11.34.45.png 屏幕快照 2019-01-22 上午11.29.54.png 屏幕快照 2019-01-22 上午11.30.14.png

---

断点续传相关：

屏幕快照 2019-01-22 上午11.32.34.png 屏幕快照 2019-01-22 上午11.32.41.png

---

Http 和 Https 对比

Http 和 Https 对比.png

Https 就是在会话层加入了SSL（Secure Sockets Layer）协议的Http协议

SSL Handshake

屏幕快照 2019-01-22 上午11.49.17.png

1、 Browser connects to a web server (website) secured with SSL (https). Browser requests that the server identify itself.

2、Server sends a copy of its SSL Certificate, including the server’s public key.

3、Browser checks the certificate root against a list of trusted CAs and that the certificate is unexpired, unrevoked, and that its common name is valid for the website that it is connecting to. If the browser trusts the certificate, it creates, encrypts, and sends back a symmetric session key using the server’s public key.

4、Server decrypts the symmetric session key using its private key and sends back an acknowledgement encrypted with the session key to start the encrypted session.

5、Server and Browser now encrypt all transmitted data with the session key.

---