A few years after HTTP appeared, around when W3C was founded in 1994, it was clear that an unencrypted and unauthenticated connection was too much of a liability for a lot of serious stuff, such as e-commerce, which everyone wanted to do on the web. (In those days, mass Deep Packet Inspection was not technically feasible, so the ubiquitous snooping which we have to day was not the main driver.) There were, among the ideas, two secure versions of HTTP proposed, one known as S-HTTP and the other, as HTTP-S. To cut a long story short, HTTP-S prevailed.
Some notes about HTTP/3
HTTP/3 is going to be standardized. As an old protocol guy, I thought I'd write up some comments. Google (pbuh) has both the most popular ...
HTTP Semantics
The Hypertext Transfer Protocol (HTTP) is a stateless application-level protocol for distributed, collaborative, hypertext information systems. This document describes the overall architecture of HTTP, establishes common terminology, and defines aspects of the protocol that are shared by all versions. In this definition are core protocol elements, extensibility mechanisms, and the "http" and "https" Uniform Resource Identifier (URI) schemes. This document updates RFC 3864 and obsoletes RFCs 2818, 7231, 7232, 7233, 7235, 7538, 7615, 7694, and portions of 7230.
Let’s Encrypt Everything
I’ll admit I was late to the HTTPS party. But post Snowden, and particularly after the result of the last election here in the US, it’s clear that everything on the web should be encrypted by default. Why? 1. You have an inalienable right to privacy, both in
HTTP: The Protocol Every Web Developer Must Know—Part 1
Learning the fundamentals of the World Wide Web is crucial, especially if you are planning to build web apps. And HTTP is at the heart of any web application you could build. HTTP stands for...
Requirements for HTTPS for Local Domains
When connecting to servers on their local network, users are surprised to encounter user interfaces that display errors, show insecure connections, and block some HTTP features when missing a secure context. However, obtaining PKIX certificates for those servers is difficult for a variety of reasons. This document explores requirements for authenticating local servers.
Caddy - The Ultimate Server with Automatic HTTPS
Caddy is a powerful, enterprise-ready, open source web server with automatic HTTPS written in Go
Browsers & Standards Work 2026: Call for Community Input
TL;DR: IPFS is planning the next phase of work to make browsers better for the decentralized web – not just IPFS, but any protocol that needs lightweight crypto, peer-to-peer connections, or native browser integration. We need your input on what features matters most. Background: What We’ve Accomplished Over the past 5 years, sustained collaboration with Igalia has delivered real improvements to all major browsers: Ed25519 in WebCrypto API - Shipped in Chrome 137 (May 2025), now available in...
Why you should care about HTTPS, even if you have nothing to hide | Ben Balter
HTTPS protects more than passwords and credit cards. It prevents censorship by making selective content blocking impossible.
WWW
Even though HTTP is a simple protocol and the basic HTML is a simple format, the current standards are bloated and only a few web browser engines are able to support them at the commonly required level.
Web-based cryptography is always snake oil
Nowadays, there is an epidemic of web applications purporting to offer “end-to-end” encryption. Examples might range from a file upload service, which allows you to upload and share files of arbitrary size and promises “end-to-end encryption”; or a web-based password safe service which claims that it can't see your passwords because they're encrypted; or a web-based cryptocurrency wallet.
Filling the remaining gap between WebSocket, WebRTC and WebTranspor
Existing web platform facilities for network communication include WebSocket and WebRTC. Each mandates a specific protocol, ensures TLS, and respects the Same Origin Policy. The proposed WebTransport is similar in these respects.
Who Shapes Web Standards? Uncovering the Main Topics of Interest in the W3C
GitHub - Thomvanoorschot/boring_tls: A memory-safe TLS/SSL library for Zig, providing both client and server implementations built on Google's BoringSSL for secure, high-performance encrypted communications.
A memory-safe TLS/SSL library for Zig, providing both client and server implementations built on Google's BoringSSL for secure, high-performance encrypted communications. - Thomvanoorschot/...
How HTTP/2 Works and How to Enable It in Go
HTTP/2 solves head-of-line blocking at the application layer by multiplexing multiple streams over a single TCP connection. While HTTP/1.1 requires requests to be processed sequentially, HTTP/2 allows parallel processing through independent streams, each with its own ID. The Go standard library supports HTTP/2 out of the box when using HTTPS, and with some configuration, it can work over plain HTTP too
