What is the difference between http and https?

Replies

• 

  Yamini L

  HTTP(Hpertext Transfer Protocol) is a protocol used in application layer for transmitting and retrieving information across internet.Http request could be sent and you get a response for that..
  
  HTTPS(hypertext Transfer Protocol Secure) works by transmitting normal http interactions through an encrypted system and the information cannot be accessed by any party other than the client and end server. Two types of encryption layer available are Transport Layer Security (TLS) and Secure Sockets Layer (SSL), both of which encode the data records being exchanged.
  
  Default Port number for HTTP is 80 and for HTTPS it is 443..
• 

  zia.sepsis

  miniy

  HTTP(Hpertext Transfer Protocol) is a protocol used in application layer for transmitting and retrieving information across internet.Http request could be sent and you get a response for that..
  
  HTTPS(hypertext Transfer Protocol Secure) works by transmitting normal http interactions through an encrypted system and the information cannot be accessed by any party other than the client and end server. Two types of encryption layer available are Transport Layer Security (TLS) and Secure Sockets Layer (SSL), both of which encode the data records being exchanged.
  
  Default Port number for HTTP is 80 and for HTTPS it is 443..

  Thanks miny. Nice information
• 

  safwan

  thanks miniy good information.😎
• 

  Sachin Jain

  @miny
  Very nice info but m having some doubt..please clarify it
  How does the receiver know which of the two (SSL or TLS) encyrption is used ?
• 

  Munguti

  @bluderboy, the unique ports used will tell the reciever or server whether its HTTP-port 80 or HTTPS-port 443. This ports are unique and consistent. The also separate services such as mail, DNS and other applications and are used for managing sessions. You should read more on ports
• 

  lovejeet

  and please wat difference both makes if we use them.........................
• 

  lovejeet

  ya, that i got...............so why isn't it dat https should b mostly used??? plz enumerate all the differences on d basis of use n limitations n all............
• 

  Ankita Katdare

  lovejeet

  ya, that i got...............so why isn't it dat https should b mostly used??? plz enumerate all the differences on d basis of use n limitations n all............

  Since it is one of the most important questions that has been left unanswered, I thought I should list down my answer here.
  
  If you want the short point-by-point answer, here we go -
  
  HTTP (or Hyper Text Transfer Protocol)
  

  1. It is an unsecured connection.
  2. There is no encryption.
  3. No certificates are required.
  4. The website URL begins with https://
  5. It uses port 80 for communication.
  6. Operates at Application Layer of the OSI network model.

  HTTPS (or Hyper Text Transfer Protocol Secure)
  

  1. It is an secured connection.
  2. It is an encrypted connection.
  3. No certificates are required.
  4. URL begins with “#-Link-Snipped-#
  5. It uses port 443 for communication
  6. Operates at Transport Layer of the OSI network model.

  If you want the long answer, read on -
  
  HTTP is the name of the protocol used to send & receive information over the internet. It turns out that when thousands of websites were getting built on the internet, many website owners wanted to exchange confidential information across different websites through a server. With HTTP protocol information would be accessed without secure authorisation. Therefore, Netscape corporation decided to create HTTPS, the secure version of HTTP to allow authorisation and secured transactions.
  
  HTTPS is a lot similar to HTTP as it follows the same basic protocols. They operate by a website URL sending information request to server which then responds with the status and a message. The status could be positive or negative depending upon the request.
  
  Since HTTP or HTTPS is a part of the URL, the form of request changes. If HTTPS is used instead of HTTP in a URL, the server knows that an 'encrypted' connection is being requested.
  
  HTTPS connection is typically desired in following scenarios:
  1. Log-in pages of websites
  2. Secure banking related transacations
  3. Corporate log-ins
  4. Websites where confidential information is exchanged between users and admin etc.
• 

  TurtleDove

  Http and Https both are the part of Url, and its uses the same protocol. The only difference between them is https is secured as the data requested or sent is in "ENCRYPTED".
• 

  Stephen B Johnson

  Start wireshark, tcpdump, or whatever packet capture tool you have access to and capture some packet transfers for #-Link-Snipped-# (which will use port 80) and #-Link-Snipped-# (which will use port 443).
  
  You will see the content using https:// (port 443) is all encrypted.
• 

  Ken Peterson

  HTTP stands for Hypertext Transfer Protocol. This protocol allows communication between different systems. When you type any web address, your browser acts as a client and the computer act as a server. HTTP uses TCP (Transmission Control Protocol), generally over port 80, to send and receive data packets over the web.
  How it functions?
  The client sends a request message to a HTTP server which hosts a website, the server then replies with the response message that contains completion status information, such as “HTTP/1.1 200 OK”.
  
  HTTPS stands for Hypertext Transfer Protocol Secure. This protocol allows a secure communication between different systems. It encrypts all data during the communication. HTTPS also uses TCP (Transmission Control Protocol) to send and receive data packets, but it does so over port 443, within a connection encrypted by Transport Layer Security (TLS).
• 

  yogevo

  This is the awesome website for students like me.
• 

  rajmanisha

  http is a unsecured connection while https is an encrypted secured connection.
• 

  Rahul Jamgade

  Ankita Katdare

  Since it is one of the most important questions that has been left unanswered, I thought I should list down my answer here.
  
  If you want the short point-by-point answer, here we go -
  
  HTTP (or Hyper Text Transfer Protocol)
  

  1. It is an unsecured connection.
  2. There is no encryption.
  3. No certificates are required.
  4. The website URL begins with https://
  5. It uses port 80 for communication.
  6. Operates at Application Layer of the OSI network model.

  HTTPS (or Hyper Text Transfer Protocol Secure)
  

  1. It is an secured connection.
  2. It is an encrypted connection.
  3. No certificates are required.
  4. URL begins with “#-Link-Snipped-#
  5. It uses port 443 for communication
  6. Operates at Transport Layer of the OSI network model.

  If you want the long answer, read on -
  
  HTTP is the name of the protocol used to send & receive information over the internet. It turns out that when thousands of websites were getting built on the internet, many website owners wanted to exchange confidential information across different websites through a server. With HTTP protocol information would be accessed without secure authorisation. Therefore, Netscape corporation decided to create HTTPS, the secure version of HTTP to allow authorisation and secured transactions.
  
  HTTPS is a lot similar to HTTP as it follows the same basic protocols. They operate by a website URL sending information request to server which then responds with the status and a message. The status could be positive or negative depending upon the request.
  
  Since HTTP or HTTPS is a part of the URL, the form of request changes. If HTTPS is used instead of HTTP in a URL, the server knows that an 'encrypted' connection is being requested.
  
  HTTPS connection is typically desired in following scenarios:
  1. Log-in pages of websites
  2. Secure banking related transacations
  3. Corporate log-ins
  4. Websites where confidential information is exchanged between users and admin etc.

  
  Minor Correction and adding few additional points:
  1. https require certificate . It could be issued by CA (Certificate Authority) or Self Signed.
  2.TLS works above the transport layer in the OSI model
  3. port 80 and port 443 are default ports for http and https. However you can change the ports at your will (by admin of the website), provided the ports are free.
  4. Though https is used for secure communication and was believed to be unbreakable, however there are ways by which the data can be read.In this case the user or victim can be tricked easily so that data can be sniffed.
  5. SSLv2 and SSLv3 are broken , so should not be used.
• 

  Radhika Deshpande

  Can we set http and https on same port?

• 

  Kaustubh Katdare

  Interesting question, #-Link-Snipped-# . To the best of my knowledge, running http and https on the same port is *not* possible with Apache. I think that's because there's some port-blocking.

  However, with NGINX, it's possible to run both http and https on the same port. It is likely to require patching; which I'd not recommend as it creates issues at the time of upgrading the web server.

  Here's a solution that I found on the server that seems to work with NGINX:

  Add ssl on; and error_page 497 $request_uri; to your server definition.

  Give it a try; but don't on a live or production server. You're likely to mess things up. Try this on a local installation and let me know what you observe. It'd be something very interesting.