14 – even liver 7 nights, summed up the computer network knowledge! (66 in total)

preface

Computer network knowledge, it is the content that interview often examines, also often can involve to in the actual work.

Recently summed up 66 computer network related knowledge points, we have a look at it :(into their own thinking, to solve knowledge points together, discuss the problem)

1. Compare HTTP 0.9 with HTTP 1.0😀

1. Http0.9 is a simple protocol with only one GET method, no header, and the target is used to GET HTML.
2. HTTP1.0 protocol a lot of content: headers, response codes, redirection, errors, conditional requests, content encoding, and so on.

Http0.9 process:

The client, constructs the request, queries the IP address through DNS, establishes the TCP connection with a three-way handshake, initiates the request from the client, the server responds, and disconnects the TCP connection with a four-way wave. (A round trip: the server receives the request, reads the corresponding file, such as HTML, and returns the data to the client.)

Http1.0 process:

The client, constructs the request, queries the IP address through DNS, establishes the TCP connection with a three-way handshake, initiates the request from the client, the server responds, and disconnects the TCP connection with a four-way wave. (Multiple back-and-forth: HTTP1.0 introduces request and response headers. Http0.9 cannot meet the requirements due to the presence of multiple forms of text such as Js, CSS, etc., so introduces Content-Encoding, Content-type, etc.)

Because of the lack of defects, there is Http1.1.

2. About http1.1 and http2😁

In HTTP1.1, browsers no longer need to re-initiate a TCP connection for every request. The new content includes: cache-related header extensions, OPTIONS methods, Upgrade headers, Range requests, compression and transfer encoding, pipelinization, and more. However, this did not meet the current needs of the Web development, so, there is HTTP.2 version.

Http2 solves the problem (pipelining allows clients to send all requests at once, but there are some issues that hinder pipelining: if one request takes a long time, queue blocking affects other requests). Queue header blocking in HTTP.

Using HTTP2 provides a quantified improvement in the user experience of perceiving the effect of most latency over HTTP1.1 when using TCP, as well as improved utilization of TCP connections (the parallel implementation mechanism does not rely on multiple connections to the server)

So need to learn http2, understand more content to master the computer network.

For Http2, you can run an Http2 server, get and install an Http2 Web server, download and install a TLS certificate, and let the browser and server connect via Http2. (Apply for a certificate from a digital Certificate authority).

To understand the http2 protocol, let’s first take a look at what happens to a Web page request, which is what the user renders in the browser.

Resource acquisition steps:

Put to request URL in the queue, whether the URL in the request queue, whether it is over, so as to determine whether a request domain DNS cache, if not resolve domain name, is picked up, a TCP connection to the specified domain name is open, no, you can open a TCP connection, carries on the HTTPS requests, initialization and complete the TLS handshake, Send a request to the URL corresponding to the page.

Receiving the response and page rendering steps:

Receive the request, determine whether the HTML page, parse the HTML, prioritize the page reference resources, and add the reference resources to the request queue. (If a critical resource on the page has been received, render the page), determine whether there is another resource to receive, and continue parsing the render until the end.

3. Use of several HTTP request methods 😂

The first GET method: Sends a request to GET some resource on the server.

The second POST method: submit data or attach new data to the resource specified by the URL.

PUT: Just like POST, it can submit data to the server, but it is different. PUT specifies the location of the resource on the server, while POST does not.

The fourth HEAD method: refers to the HEAD of the requested page.

The fifth DELETE method: DELETE a resource on the server.

The sixth OPTIONS method is used to obtain the methods supported by the current URL. If the request succeeds, the Allow header contains information such as GET,POST, etc.

Seventh TRACE method: Used to fire a remote, application-level request message loop.

The eighth CONNECT method: convert the request connection to the TCP/TP channel.

4. Enter the URL in the address box of the browser to go to 🤣

Briefly, the browser submits the request url to the DNS domain name for resolution, searches for the real IP address, and sends a request to the server. Server to background processing, return data, the browser will receive file data, such as HTML, JS, CSS, images and so on; Then the browser will parse the loaded resources and establish the corresponding internal data structure. Load the parsed resource file, render the page, and complete the display page effect.

🙅 not clear enough to understand code?

So again, in detail, ahem, receiving the URL from the browser, starting the network request thread, making a complete HTTP request, receiving the request from the server side to the corresponding back end receiving the request, and then the back end and the front end HTTP interaction; Among them the caching problem (HTTP cache), the browser after receiving the HTTP packet parsing process, CSS visual format model, JS engine parsing process; Other render page effects.

🙅 : This is where you need to understand the browser kernel: the main rendering engine and JS engine, here to understand your understanding of the browser kernel.

1. The rendering engine is responsible for retrieving the content of the page, organizing the information, and calculating how the page will be displayed, and then output to the display.
2. The JS engine is used to parse and execute javascript to achieve dynamic effects of web pages.

The kernel of a browser interprets the syntax of a web page differently, and therefore renders it differently. In fact, at first there was no clear distinction between rendering engine and JS engine, but later JS engine became more and more independent, so, the kernel preferred rendering engine.

For resource requests/acquirement, resource responses/page rendering, the network bandwidth and device resources will be put pressure, this is the time to consider web performance optimization.

5. Optimize web performance 😃

Among the performance keys:

What is a packet A packet (IP packet) is a series of bytes encapsulated in a fixed structure that defines the packet’s length, transmission details, and other INFORMATION associated with TCP.

Latency: The time it takes an IP packet to get from one network endpoint to another. (The time it takes is the round-trip delay, which is twice the time of the delay)

Bandwidth: As long as the bandwidth is not saturated, the connection between two network endpoints will process as much data as possible at once (so bandwidth can be a performance bottleneck)

Connection time: Round-trip data for establishing a connection between client and server (three-way handshake)

TCP three-way handshake: The client sends a SYN packet to the server. The server returns an ACK packet and a new ACK packet. Then the client returns an ACK packet. (When a TCP connection is established between a client and a server, the client sends a SYN message, the server responds with a SYN+ACK message, and the client responds with an ACK message.)

The SYN is the synchronization sequence number and the handshake information used by TCP/IP to establish a connection. ACK is an acknowledgement character, a transmission control character sent from a receiving station to a transmitting station in data communication. Indicates that the received data has been confirmed. In TCP/IP, if the receiver succeeds in receiving the data, it responds with an ACK. The ACK signal has its own fixed format, length and size, and is sent back to the sender by the receiver.

A three-way handshake:

For the first handshake, when the connection is established, the client sends a SYN packet to the server and enters the SYN_SENT state, waiting for the server to confirm that SYN is the synchronization sequence number.

In the second handshake, the server receives a SYN packet, acknowledges the SYN from the client, and sends a SYN+ACK packet. In this case, the server enters the SYN_RECV state.

During the third handshake, the client receives the SYN+ACK packet from the server and sends an ACK packet to the server. After the PACKET is sent, the client and server enter the ESTABLISHED state (TCP connection succeeds) and the three-way handshake is complete.

After the three-way handshake is complete, the client and server begin to transfer data.

TLS negotiation time (TLS causes additional round trips)

1. When the client initiates an HTTPS connection, transport layer security protocol negotiation is required
2. TLS is used to replace SSL

In addition to the network, there is the page content itself or server performance, such as first byte time TTFB, content download time, start rendering time, document load complete time, etc.

So what is TTFB? It is the time it takes the client from the start of locating to the Web page to receiving the first byte of the response from the body page. It is a measure of the time taken between the browser making the request and receiving its first byte.

The content download time is equal to the last byte arrival time of the requested resource.

Start rendering time, the length of time the client sees the blank page.

5.1 Web Performance Optimization Technology (reducing client network latency and optimizing page rendering performance to improve Web performance)

Optimization techniques:

• DNS query optimization
• Client cache
• Tuning TCP connections
• Avoid redirection
• The cache at the edge of the network
• Conditions of the cache
• Compression and code simplification
• Image optimization

6. Http1.1 😄

• Improved sharding mechanisms for persistent connections and CDN domain names
• Immature HTTP pipelining
• Provide virtual host support
• Perfect support for dynamically generated content
• Introduce cookies and security mechanisms

For the problem with HTTP1, come http2. Where http1 issues:

In most cases, the browser will want to get many resources at the same time, but HTTP1 does not provide a mechanism to request these resources at the same time. If you are using only one connection, you need to make a request, wait for a response, and then initiate the next request.

The pipelined feature in HTTP1 allows a set of requests to be sent at once, but the responses need to be received in the order in which they were sent. So if anything happens during the response, the rest of the work will be blocked, which is called “queue head blocking”, blocking network traffic and rendering of the Web page, and directing the loss of response.

Inefficient use of TCP. As one of the most reliable protocols, TCP’s core is congestion window.

Congestion window is a measure of satellite communication to prevent communication congestion in the Internet. It is a mechanism of combining “congestion avoidance” algorithm and “slow start” algorithm at the beginning. Congestion window is a “congestion avoidance” window. It is a sliding window installed on the sender and the size of the window is no larger than that of the receiver’s confirmation notification window.

A congestion window is a TCP packet that can be sent by the sender before the receiver acknowledges the packet. (For example, if the congestion window is specified as 1, then the sender sends the first packet, and the receiver can only send the next packet after confirming the sent packet.)

Congestion control is used to avoid network overload by preventing excessive data injection into the network. TCP can slow start to explore the appropriate size of the congestion window for the current connection. In other words, when sending data, the sender does not inject a large amount of data into the network at the beginning, but sends a packet for testing. When receiving a confirmation reply, the sender sends an additional unconfirmed packet.

This means to get a confirmation reply, can send two packets, have two confirmation reply, four packets can be sent, in the form of geometric growth quickly reached agreement of congestion window size (contract number limit), then connected into the congestion avoidance phase, this mechanism requires several times back and forth to learn best congestion window size, But the time cost of several round trips is not negligible.

• The size of the congestion window depends on the congestion level of the network and changes dynamically. The sender makes its send window equal to the congestion window. The send window may also be smaller than the congestion window if you consider the reception capability of the receiver.
• The sender controls the congestion window as follows: As long as there is no congestion on the network, the congestion window is enlarged to send more packets. However, as long as the network is congested, the congestion window is reduced to reduce the number of packets injected into the network.

The concept of slow start in TCP is used to explore the appropriate size of the congestion window for the current connection. To find out the current network status of the new connection. “Slow start” means that after the connection is established, each time an acknowledgement is received from the receiver, the control window increases the size of a segment value. When the window value reaches the limit of “slow start”, the slow start will stop working, so as to avoid network congestion.

The TCP transmission control protocol is designed to work even under the worst network conditions, for applications that treat different traffic equally on the same network under conservative assumptions.

Bloated headers. HTTP/1.1 can compress the request, but the headers can’t. It is also relatively common for it to account for the majority (or perhaps all) of requests. (In this case, if you can compress the request header and make the 😙 request smaller, you can reduce the bandwidth pressure and reduce the total system load)

Limited priority setting, that is, if the browser to specify the domain name to open multiple socket request, if the web page some resources will be more important than other resources, increase resources effect in line, will delay the request of other resources, take first priority resources, the resources of the low priority will be done in high resources processing, (in the process, The browser does not make new resource requests) and waits for the high to complete before making the request (which adds to the overall page download time).

The browser does not initiate a new request of a lower priority during the time it takes to request a higher priority resource

Summary: The slow start of HTTP1.1 affects the first load of resources. After TCP establishes a connection, it will start to request transmission, which is slow at first, and then speed up. In order to prevent network congestion, it will make the first rendering time of the page become longer. Start multiple TCP, such as network down, cannot identify the priority of resources, will appear race problem.

7. How to optimize website performance 😅

1. In terms of content, there are fewer Http requests (merging files, CSS sprites, inline images), fewer DNS queries (DNS caches, distributing resources to an appropriate number of host names), and fewer DOM elements.
2. In terms of cookies, you can reduce the size of cookies.
3. For CSS, put the stylesheet at the top of the page; No CSS expressions; use<link>Do not use@import; CSS can be imported from the outside; Compress CSS.
4. For JavaScript, put the script at the bottom of the page; Importing JavaScript from the outside; Compress JavaScript, remove unwanted scripts, and reduce DOM access.
5. Images, can optimize THE CSS Sprite, do not stretch the image in HTML, optimize the image (compression).

8. HTTP status code and meaning 😆

1. If the status code is 1XX, it indicates the information status code. If the status code is 100, it indicates to continue. If the status code is successful, detailed parameters are returned.
2. For the status code of 2XX, 200 indicates that the message is returned normally, 201 indicates that the request was successful and the server created a new resource, and 202 indicates that the server accepted the request but has not yet processed it.
3. For 3xx, redirect, 301 means that the requested page has been permanently moved to a new location, 302 means temporary redirect, 303 means temporary redirect, and always request a new URI using GET. 304 indicates that the requested page has not been modified since the last request.
4. For 4xx, client error, 404, the server cannot understand the request format, the client should not try to make the request again with the same content, 401, the request is not authorized, 403, access is prohibited, 404, cannot find how to match the RESOURCE URI.
5. For 5XX, server error, 500, the most common server side error, 503, the server side is temporarily unable to process requests, possibly due to overload or maintenance.

9. HTTP – Data compression 😉

Content-encoding: gzip is a list of compression formats supported by the browser, including GZIP, Deflate, BR, etc. This allows the server to select a compression algorithm, put it in the Content-Encoding response header, and send the raw data to the browser.

10. HTTP – Block transfer 😊

Block transfer is to split the transferred file into several small pieces, and then distributed to the browser, the browser after receiving the reassembly and recovery.

Each separate contains two parts, block length and block data (length header and data block), the length header is a line of clear text ending in CRLF, data block followed by the length header, also ended with CRLF, and finally with a length of 0 block.

In the response message, the header field transfer-encoding :chunked means that the body of the message is not sent at one time but in many chunks.

In transfer-encoding: Chunked and Content-Length, the two fields are mutually exclusive.

The transmission length of a response message is either known or chunked.

Content-Length: 299

11. HTTP – Range requests 😋

Breakpoint continuingly

To implement this functionality, you need to define the scope of the entity to be downloaded. This scoping send request is called a scoping request.

Accept-ranges: The server uses the HTTP response header accept-Ranges identifier itself to support range requests. The specific value of the field is used to define the unit of the range request.

grammar

Accept-ranges: bytes. The unit of range requests is bytes. Accept-ranges: NoneCopy the code

A scope request is used when only a portion of the data is required, not all of it. It allows the client to use a special field in the request header to indicate that only a portion of the file is fetched.

The request header Range is a special field for HTTP Range requests. The format is “bytes=x-y”, which is a data Range in bytes.

1. 0- indicates the entire file from the beginning to the end of the document.
2. 100- indicates from the 100th byte to the end of the document.
3. “-10” indicates that it starts at the 10th byte reciprocal from the end of the document.

Example:

The Range header field Range is used to specify the Range of resource bytes. The Range formats:5001- 10000.Byte Range: byte =5001- 10000.
5000Range: byte =5001-
0- 3000.Bytes,5001- 10000.Byte Range: byte=- 3000..5001- 10000.
Copy the code

The above picture shows that the server receives the Range field, detects the validity of the Range and returns the status code 416. If your file is only 1000 bytes but the request Range is 20,000-3000, this will result in the status code.

If the file is successfully read and the range is correct, the status code 206 is returned. The server adds a response header field, content-range, that tells the actual offset of the fragment and the total size of the resource.

Finally, the data is sent, the fragment is sent directly to the client using TCP, a range request is processed.

The format is “bytes x-y/length”, which differs from the Range header in that there is no “=”.

Content-Range: bytes 0-4395719/4395720

12. HTTP – multi-segment data 😎

Multiterminal data, that is, using multiple “x-y” in the Range header to get multiple pieces of data at once. A special MIME type, multipart/byteranges, is used when the response packet contains multiple ranges. Multiple range request responses will indicate multipart- Byteranges in the content-type header.

Multi-section data graph: delimit and mark boundary to distinguish different sections

13. What is the difference between cookies, sessionStorage and localStorage? 😍

• Cookies are data stored on a user’s local terminal that a website uses to identify the user
• Cookie data is always carried in the same HTTP request, even when it is not needed, so, passing back and forth between the browser and the server
• SessionStorage and localStorage do not automatically send data to the server and only save it locally

Size of storage

Cookie data size cannot exceed 4K; SessionStorage and localStorage have storage size limits, but they are much larger than cookies and can be up to 5M or more.

Limited time

1. LocalStorage Stores persistent data. Data is not lost after the browser is closed, except when data is proactively deleted
2. SessionStorage Data is automatically deleted after the current browser window closes
3. The cookie is valid until it expires, even if the window or browser is closed

14. Why is it more efficient to use multiple domain names to store web resources? 😘

Because CDN cache is more convenient; Breaking browser concurrency limits; Save cookie bandwidth; Save the number of connections to the main domain name, optimize the page response speed; Prevent unnecessary security issues.

15. Http2.0 content 🥰

Http2 is the second version of the Hypertext transfer protocol. Compared to the text transfer format of the HTTP1 protocol, HTTP2 transmits data in binary format, with a smaller transmission volume and load.

Http2.0 layers, the frame layer (the core part of HTTP2’s multiplexing capability), and the data or HTTP layer (which contains what is traditionally considered HTTP and its associated data).

HTTP2.0:

• Multiplexing mechanism, the introduction of binary frame layer mechanism to achieve multiplexing. The frame layer is a binary protocol based on frames. This facilitates machine analysis. Request and response are interwoven.)
• You can set the priority of the request (the client’s frame layer marks the split block with the priority of the request).
• Header compression Request header compression to increase transmission efficiency.

HTTP/2 is better than HTTP/1.1

• Multiplexed streams
• The head of compression
• Resource priority and dependency Settings
• Server push
• Flow control
• Reset the message

Implementation of multiplexing:

Under a single domain name still can establish a TCP pipes, using a TCP connection, download the entire resources page, just a slow start, and avoid the race, the browser request, on every request of the frame layer division, will play on the same request segmentation piece the same id number, and then through the protocol stack divided all the body sent to the server, Then the request is assembled according to the ID number through the frame layer of the server. The frame layer of the server will split the response data according to the same response body and split the ID to the client, and the client will assemble the response.

For frames in HTTP2, HTTP1 is not frame-based and is text-delimited.

GET/HTTP / 1.1 < CRLF >

Thus, there may be problems with http1 requests or responses:

1. Only one request or response can be processed at a time, and parsing cannot be stopped until it is complete.
2. It is impossible to predict how many inner layers are needed for parsing.

HTTP/1 request and response packets consist of the start line, header, and body, and are separated by newlines. HTTP/2 is easily parsed by splitting request and response data into smaller frames, encoded in binary.

Reference pictures:

Frame structure summary All frames contain a frame header of 9 bytes + the length of the side of the body is different. The structure of the body varies according to the type of frame.

Frame:

16. Http2 – 😗 behind the scenes

Http2, as a binary protocol, has all the advantages of being lightweight, secure and fast. It retains the original HTTP protocol semantics, but for Http2 changes the way data is transferred between systems.

Binary framing layer, where all communication is performed on a single TCP connection that remains open for the entire conversation, is primarily the way the binary protocol breaks communication down into frames that are interwoven in the two-way logic flow between the client and server.

Topology of HTTP/2 connections (showing a connection used to establish multiple streams)

In flow 1, a request message is sent and the corresponding response message is returned.

HTTP / 2 frame structure

The first 9 bytes are consistent for each frame. Parsing only needs to read these bytes to know exactly how many bytes to expect in the entire frame.

Frame header field table:

The name of the	The length of the	describe
length	3 bytes	Indicates the length of the frame payload
type	1 byte	Current Frame Type
Flags	1 byte	Id of a specific frame type
R	1 a	Reserved bit. Do not set it. Otherwise, serious consequences may occur
Stream Identifier	31	Unique ID for each stream
Frame Payload	The length of the variable	The actual frame content. The length is set in the Length field

Note: The stream Id is used to identify the stream to which the frame belongs. A stream is considered a series of frames on a connection that make up a separate HTTP request and response.

The request and response to HTTP1 are divided into the header and the body of the message. Http2 As you can see from the above figure, http2 requests and responses are divided into HEADERS frames and DATA frames.

For comparison: 👇

An important feature of HTTP2 is flow-based flow control. Provides the ability for the client to adjust the transmission speed. The WINDOW_UPDATE frame is used to indicate flow control information.

With multiplexing, clients can make multiple resource requests at once, instead of waiting for the previous response to complete before making a request for a new object, as in HTTP1. So the browser lost the default resource request priority policy in Http1.

17. The browser generates an HTTP request message 😙

HTTP header field

Header field type	meaning
Date	Represents the date on which the request and response were generated
Pragma	Communication options that indicate whether the data is cacheable
Cache-Control	Control information about the cache
Connection	Sets the communication option for whether to continue the TCP connection after sending a response
Transfer-Encoding	Represents the encoding format of the message body
Via	Record the agents and gateways that you pass on the way
Authorization	Identity authentication data
From	Request the email address of the sender
Referer	When you go to the next page by clicking on a hyperlink, the URI of the previous page is recorded here
User-Agent	Information about the client software, such as the name and version
Accept	A data type that a client can support, expressed as a MIME type
Accept-Charset	Character set that the client can support
Accept-Language	Languages that the client can support
Host	The IP address and port number of the server that received the request
Range	This field allows you to specify the range of data to retrieve when you need to retrieve only part of the data, but not all of it
Location	Represents the exact location of information
Server	The name and version number of the server program
Allow	Indicates that the specified URI is supported
Content-Encoding	When the message body is compressed, it represents its encoding format
Content-Length	Indicates the length of the message body
Content-Type	Represents the data type of the message body, as defined by the MIME specification
Expires	Indicates the validity period of the message body
Last-Modified	The last date the data was updated
Content-Language	Represents the language of the message body
Content-Location	Represents the location of the message body on the server
Content-Range	Indicates the range of data contained in the message body when only part of the data is requested

Example HTTP messages:

1. HTTP, hypertext Transfer Protocol.
2. Protocol, the rule definition of communication operation is called protocol.
3. URI, uniform resource identifier.
4. Only one URI can be written in a request message. If you need more than one file, you must send a separate request for each file.

This section describes the basic idea of IP

Indicates the representation of an Ip address

Structure of the IP address – The subnet mask indicates the boundary between the network number and the host number.

The invocation method of the parser

Basic work of DNS server

Query operations between DNS servers

Data flows through a pipe-like structure

18. Learn the basics of the Internet 🙂

• The physical layer
• Data link layer
• The network layer
• The transport layer
• The session layer
• The presentation layer
• The application layer

Computer networks can be scaled into WAN,Wide Area Network, and LAN. A connection from a computer to a switch to a router.

Do you know what kind of development the computer and network have gone through?

1. Batch processing refers to the way in which the user’s programs and data are loaded into cassette tape or tape in advance and read by the computer in a certain order, so that the user’s programs and data can be processed in batches together.

2. Time-sharing system is a system in which multiple terminals are connected to the same computer, allowing multiple users to use a computer at the same time.

3. Computer network

What is the mechanism of TCP/IP, TCP/IP communication protocol collectively, learning this someone must 🙅 do not understand what is the protocol.

But when we touch the program, often hear protocols such as IP, TCP, HTTP and other protocols. Remember that TCP/IP is a collection of IP,TCP,HTTP, etc. Protocol is a kind of “agreement” that needs to be reached when computer and computer communicate through network. These protocols allow devices from different vendors, different cpus, and different operating systems to communicate with each other.

It means that two computers can both support the same protocol and follow it in order to communicate with each other.

Packet switching protocol

Packet switching is a method of splitting big data into smaller units called packets for transmission.

Hierarchical module

Learn about the OSI reference model

OSI will be divided into seven easy-to-understand layers:

Physical layer 2 data Link layer 3 Network layer 4 Transport Layer 5 Session Layer 6 Presentation layer, 7. Application layer

Application layer: protocols for specific applications.

Presentation layer: Conversion of device inherent data formats to network standard data formats.

Session layer: communication management. Responsible for establishing and disconnecting communication connections.

Transport layer: Manages data transfer between two nodes.

Network layer: address management and routing.

Data link layer: transmits and identifies data frames between interconnected devices.

Physical layer: “0”, “1” represents the voltage level, light flicker.

How to modularize communication transmission

Network elements

Nic:

What is a gateway? It is the device in the OSI reference model responsible for transforming and forwarding data from the transport layer to the application layer.

Proxy services:

19. What are the render optimizations? 😝

First, we can disable the use of iframe; second, we can disable the use of GIF images to achieve loading effect, reduce CPU consumption, and improve rendering performance; third, we can use CSS3 code to replace JS animation.

For some small ICONS, you can use base64-bit encoding to reduce network requests, but it is not recommended to use large images because of CPU consumption. The advantage of small ICONS is that they can reduce HTTP requests, avoid cross-domain file, and change takes effect in a timely manner.

The style and script in the header block the page, and the JS and render threads in the Renderer process are mutually exclusive.

20. Learn TCP and IP basics 🤤

The TCP/IP protocol family is a collection of protocols, also known as the Internet protocol family.

In the second half of the 1960s, at the request of the DoD, the United States began to conduct communications technology-related acting, the birth of ARPANET, the development of packet interaction technology, and in 1975, the birth of TCP/IP. In 1983, ARPANET decided to officially enable TCP/IP as the communication protocol.

TCP/IP and OSI reference model

The OSI seven-tier model is too detailed, while the TCP/IP model of the Internet protocol family is divided into four tiers.

TCP/IP model (application layer, transport layer, Internet layer, network interface layer) – Application layer, transport layer, network layer, link layer.

The transport layer allows applications to communicate with each other.

TCP is a connection-oriented transport layer protocol, which ensures the communication between hosts on both ends. UDP is a connectionless transport layer protocol. So, UDP is used in multicast, broadcast and video communication.

The application layer

21. Interview question: How is TCP/IP transmitted over media? 😑

✍ agreements at different levels

Packet header:

Ethernet packet header: IP packet header, TCP packet header, data

IP packet header: TCP packet header, data

TCP packet header: data

In each layer, a header is attached to the data being sent, which contains the necessary information for that layer. (Destination address sent, protocol related information, etc.)

• Package is an totipotency term
• A frame is a unit of a packet in the data link layer
• A unit of packet in a layer above the network layer, such as IP and UDP
• Segment that represents information in a TCP data stream
• Message: a unit of data in an application protocol

The header of the packet, which clearly indicates how the protocol should read the data. Master the packet header. Generally, the information provided for the protocol is the packet header, and the content to be sent is the data.

Send packets, TCP/IP communication flow: 🤔

1. Application processing, sending the communication to start the TCP/IP communication, the application will do the encoding processing, the encoding is equivalent to the OSI presentation layer function.
2. TCP is responsible for establishing connections, sending data, and disconnecting connections. TCP provides reliable transmission of data from the application layer to the peer end. In front of the application layer data, attach a TCP header, which contains the source port number and target port number, sequence number and checksum (to determine whether the data is corrupted). Then attach a TCP header packet and send it to IP.
3. The processing of IP module adds its own IP header to the front end of the TCP header, which includes the IP address of the receiver and the IP address of the sender. If you do not know the MAC address of the receiver, you can use ARP to search for the MAC address of the receiver. If you know the MAC address of the peer, you can send the MAC and IP addresses to the Ethernet driver for data transmission.
4. The Ethernet header contains the MAC address of the receiver, the MAC address of the sender, and the protocol that identifies the Ethernet data of the Ethernet type.

Packets, as they travel through Ethernet data links, are generally appended to Ethernet packet headers, IP packet headers, TCP packet headers, or UDP packets, as well as the application’s own packet headers and data, and finally the packet’s tail.

Layered in – package structure

Packet receiving process 🙄

1. After receiving an Ethernet packet, the host finds the MAC address in the packet header to determine whether it is sent to the host. If not, the host dismisses the MAC address. If yes, the host searches the type field in the Packet header to determine the data type transmitted by the Ethernet protocol.
2. The IP module processes the data, and then the TCP module processes it (whether the data is damaged needs to be determined). Check whether the data is received according to the serial number. When the data is received, a confirmation receipt is sent to the sender. Note that the receipt message does not reach the sender, so the sender will consider it not received and keep sending again and again.
3. Application processing, the receiver application will directly receive the data sent by the sender.

22. Learn about http-http3.0😶

In HTTP2.0, TCP pipelines can also cause packet loss, resulting in queue header blocking (TCP three-way handshake in HTTP2.0, and TSL connection in HTTPS also take more time).

Multiplexing allows all request data to be transmitted over a single TCP connection.

Http3 made a UDP protocol based on QUIC protocol, QUIC although based on UDP, but on the basis of adding a lot of functions. QUIC (Fast UDP Network Connection) is an experimental network transport protocol developed by Google to make web pages transport faster.

For the disadvantages in HTTP is delay, the browser block, in the same domain name, at the same time, only four connections, more than the maximum connection limit of the browser, the following requests will be blocked; DNS query is to resolve the domain name to IP to establish a connection to the IP address of the target server. The DNS cache can reduce the time. To establish a connection, HTTP is based on TCP, three handshakes, each connection can not be reused, so, each request will have three handshakes and slow start, which will affect the delay. (Slow start affects a large number of small file requests)

HTTP is in the application layer of computer network, built on the TCP protocol. Learn about TCP’s three-way handshake to establish a connection and the four-way wave to disconnect a connection, and the RTT delay for each connection.

Whereas HTTP1.0 uses if-modified-since,expires headers for caching, Entity Tag,if-unmodified-since,if-match,if-none-match, and many more alternative cache headers have been introduced in HTTP1.1 to control cache policies.

Http1.0 has to re-establish the connection each time the data is transmitted, increasing the delay. Http1.1 has added keep-alive, which can reuse part of the connection, but still needs to connect in the case of domain name sharding, which costs resources and puts performance pressure on the server.

Http1.1 tries to solve this problem with pipeling, which allows browsers to make multiple requests at once, using the same TCP connection under the same domain name. However, pipeling requests are returned sequentially. Any will wait for the previous request to be processed before returning in order.

In http1.x, the Header carries too much content, which increases the cost of transmission. In the transmission of the content is plain text, and to a certain extent, the security of its data cannot be guaranteed. (In the case of http1.x problems, SPDY protocol is used to solve HTTP /1.1 inefficient issues, reduce latency, compress Header, etc.)

HTTP2 mainly solves the user and the website only uses a connection (with the domain name all communication only uses a single connection to complete, a single connection can carry any number of two-way data flow, data flow is sent in the form of a message, the message is composed of one or more frames).

So, HTTP transmits data in binary format, unlike the text format of HTTP1.x. (binary: Http2 splits request and response data into frames, and they are encoded in binary), concepts for Http2: (Stream, message, frame)

1. A stream, which is a virtual channel in the connection;
2. Messages, which are HTTP messages, requests, and responses;
3. Frame, which is the smallest unit of HTTP2.0 communication.

Multiple frames can be sent out of order and reassembled according to the identifier stream at the beginning of the frame.

With HTTP2, only one TCP connection needs to be used under the same domain name, so when packet loss occurs, the entire TCP will start waiting for retransmission. With HTTP1.1, it is possible to have multiple TCP connections open, which affects one connection (or part of it) while the rest of the TCP connections are transmitted.

HTTP/2 compresses the header to reduce resource consumption and improve performance. (Because in HTTP1, with headers carrying cookies, you might want to repeat the data transfer each time)

So, with the QUIC protocol, integrates the advantages of TCP, TLS, and HTTP/2, and is optimized. So what is QUIC? It is a transport layer protocol that is used to replace TCP, SSL/TLS. On top of the transport layer there is the application layer.

Note that it is a QUIC protocol based on the UDP protocol, used over HTTP3.

New functionality QUIC

QUIC solves the problem of transferring a single data stream to ensure orderly delivery without affecting other data streams. (Solve http2 problem)

Expressed in QUIC connection, a connection of multiple stream, such as the stream1 stream2, stream3, stream4, including stream2 lost (QUIC packet), the rest of the UDP to arrive, the application layer directly read. – There is no need to wait. There is no TCP queue header blocking. The lost packets need to be retransmitted.

Supplement:

1. TCP identifies connections based on IP and port;
2. QUIC identifies connections by ID

QUIC packets are authenticated, except for a few so packets. In this way, authenticated packets are encrypted to reduce security risks.

HTTP2-TLS,TCP,IP

Summary QUIC features :(based on UDP) — http3-quic,UDP,IP

1. Multiple data streams
2. TLS
3. Order delivery
4. Quick to shake hands
5. reliability

23. UDP in the network 😛

UPD Is a packet-oriented protocol. UDP hauls packets without splitting or splicing them. At the sending end, the application layer sends data to the UDP protocol at the transport layer.

At the receiving end, the network layer sends the data to the transport layer. UDP only removes the IP packet header and sends the data to the application layer without any splicing operation.

UDP is connectionless, communication does not need to establish and disconnect, UDP is unreliable, do not care about the security of data and other issues, UDP is not congestion control, in the case of poor network conditions may lead to packet loss.

Transmission: UDP supports one to one, one to many, many to many, many to one transmission mode, UDP provides unicast, multicast, broadcast functions.

24. TCP😜 in the network

UDP is not as complex as TCP. The UDP header has less overhead, but the TCP header is much more complex than the UDP header. The UDP header is only 8 bytes, compared to the TCP header of at least 20 bytes.

Sequence number

This sequence number ensures that the packets transmitted by TCP are in order. The peer end can splice packets in sequence by the sequence number

Window Size

Represents the size of the window and how many bytes of data it can receive

Acknowledgement Number

Indicates that the data of the previous sequence number has been received. What is the number of the next byte that the receiver expects to receive

identifier

When ACK=1, the confirmation number field is valid

When SYN=1 and ACK=0, the current packet segment is a connection request packet

When SYN=1 and ACK=1, it indicates that the current packet segment is a response packet that agrees to establish the connection

When FIN=1, the segment is a request packet to release the connection

Performance indicator RTT

Indicates the round trip time between the sender sending data and the peer receiving data

summary

1. Transmission Control Protocol (TCP) is a connection-based Protocol
2. User Data Protocol (UDP) is a connectionless Protocol.

25. Establish a three-way handshake 😕

When the connection starts, both ends are CLOSED. Before the communication starts, both sides create a TCB, enter the LISTEN state, and wait for the client to send data.

The first handshake

The client sends a connection request segment to the server. After the request is SENT, the client enters the SYN-sent state.

Second handshake

After receiving the connection request segment, the server enters the SYN-received state.

The third handshake

After receiving the connection consent reply, the client sends an acknowledgement packet to the server. The client enters the ESTABLISHED state after sending the packet segment, and the server enters the ESTABLISHED state after receiving the reply. In this case, the connection is ESTABLISHED.

Someone asked, why do you need a third handshake when two handshakes are enough to establish a connection?

To prevent invalid connection request segments from being received by the server, causing an error.

26. What are the HTTP request codes? 🤑

When sending a POST request, the server will return this message after the HTTP header has been sent, indicating the acknowledgement, and then send the specific parameter information. 201, the request succeeded and the server created a new resource. 202, the server has accepted the request but is not processing it.

301, the requested page has been permanently moved to the new location; 302. Temporary redirection. 303. Temporary redirects and always requests a new URI using GET. 304. The requested page has not been modified since the last request.

404, the server cannot understand the request; 401. Request not authorized; 403, access forbidden.

27. During an interview, simply talk about the TCP transmission of three handshakes and four waves 😲

Transmission, in order to accurately transmit the data to the target, TCP protocol adopts the three-way handshake strategy. After sending the data packet through TCP protocol, it will confirm to the other party whether the packet is successfully reached. The sender sends a packet with SYN flag to the other party. A packet with the SYN/ACK flag is sent back to acknowledge the arrival of the handshake. The sender then sends another packet with the ACK flag to indicate that the handshake is over.

Flags used during the handshake: SYN and ACK

It takes four waves to disconnect a TCP connection:

First wave

The active closing party sends a FIN(as described above – when FIN=1, the segment is a request to release the connection), sending data that tells the other party (the passive closing party) that it will no longer send data to you. — The active closing party can accept the data.

Second wave

The passively closed party receives the FIN packet and sends an ACK to the other party to confirm the serial number.

Third wave

The passive closing party sends a FIN, the closing party, saying I won’t send you any more data. (You don’t send me data, I don’t send you data)

The fourth wave

Actively disable a party that receives a FIN and sends it to an ACK to confirm the serial number

28. Often said HTTPS🙁

In fact, the HTTP protocol is carried over the TCP protocol, and then add a security protocol layer between HTTP and TCP, SSL or TSL (SSL/TLS protocol transmission, including certificate, uninstall, traffic forwarding, load balancing, page adaptation, browser adaptation, refer transfer, etc.), is often called HTTPS.

29. What is the difference between GET and POST? When to use POST? 😖

1. GET is used to GET information. It uses urls to pass parameters. The number of messages sent is limited.
2. POST is used to modify resources on the server;
3. Generally using POST, when the cache file cannot be used, it sends a large amount of data to the server, sending unknown characters

30. The interview asks about the main features of HTTP 😨

1. Simple and quick
2. flexible
3. There is no connection
4. stateless

31. What are the components of an HTTP message 😟

HTTP packets consist of request packets and response packets

Request message: request line, request header, blank line, request body

Response message: stateful line, response header, blank line, response body

The request packet contains:

1. Request method, 2. Request URL, 3. Message header, 5. Message style

• Request line, request method, request URL, HTTP protocol and version;
• Request headers, a bunch of key-value pairs
• Blank line. When the server parses the request header, it encounters a blank line, indicating that what follows is the request body
• Request body, request data

The response packet contains:

1. Protocol and version, 2, status code and description, 3, response header, 4, response body

• Status line: HTTP protocol and version, status code, and status description
• Response headers
• A blank line
• Response body

32. What HTTP methods do you know 😤

1. The GET method obtains resources
2. The POST method transmits resources
3. The PUT method updates the resource
4. The DELETE method deletes the resource
5. The HEAD method obtains the packet header

33. Persistent link to 😢

In HTTP1.0, the client sends a request to the server every few minutes to see if there is new data. As long as the polling is fast enough, the interaction can take place in real time, but this approach will cause a lot of performance waste on both sides.

For a persistent connection in HTTP1.1, use connection:keep-alive for a persistent connection. The client requests only once, but the server will keep the connection alive, and when it requests again, it avoids reestablishing the connection.

Note that keep-alive does not hold a connection permanently, only for a period of time.

34. Security issues: CSRF and XSS😭

Basic concepts, attack principles, and defense measures of CSRF

Cross-site request forgery (CSRF) : Cross-site request forgery

Understand the CSRF attack: The attacker steals your identity and sends malicious requests in your name.

Send emails, send messages in your name, steal your account, even buy goods, virtual currency transfer… The problems include: personal privacy and property security.

How CSRF works :(to complete a CSRF attack)

• Log in to trusted website A and generate A Cookie locally.
• Visit dangerous website B without logging out of A.

XSS basic concept, cross-domain scripting attacks.

XSS is a vulnerability that occurs in the front end of the Web, so its target is mainly front-end users.

In a cross-domain scripting attack, a malicious attacker inserts malicious script code into a web page and runs the script code in a browser to attack users.

So, there are two conditions to implement XSS attack. First, malicious code is injected into the Web page; second, these malicious code is successfully executed by the browser.

The difference between CSRF and XSS:

1. CSRF needs to log in, get cookies, and exploit vulnerabilities in the site itself to request the site’s API
2. XSS, no login required, inject JS code into the site, execute the code in JS, tamper with the content of the site

35. Network layering in terms of an HTTP request

Hierarchical resolution of an HTTP request:

TCP is a connection-oriented, reliable, byte stream – based transport – layer communication protocol.

Features:

• Based on the connection, the connection needs to be established before data transmission
• Full duplex, two-way transmission
• Byte stream: the data size is not limited, and packets are packaged into segments to ensure orderly receipt. Repeated packets are automatically discarded
• Traffic buffering to resolve the mismatch between the two processing capabilities
• Reliable transmission service, guarantee reachability, through the retransmission mechanism in case of packet loss
• Congestion control to prevent malicious network congestion

TCP connection, source ADDRESS, source port, destination ADDRESS, destination port

From the TCP-IP protocol layer

Sliding Window Protocol and Cumulative Acknowledgement (Delayed ACK)

The size of the sliding window is negotiated with the peer through the TCP three-way handshake and is affected by the network status

36. Analysis of the PRINCIPLE of HTTPS secure encryption channel

What is HTTPS? Because HTTP is inherently “plaintext”, the whole transmission process is completely transparent. Anyone can intercept, modify, or forge the request and response packets in the link, and the data has no credibility.

With HTTPS, all HTTP requests and responses are encrypted before being sent to the network.

HTTPS = HTTP + SSL/TLS Symmetric encryption: Encryption and decryption using the same key Asymmetric encryption: Public key - Freely distributed, private key - The server keeps the data encrypted by the public key. Only the private key can be used to decrypt the dataCopy the code

Encryption algorithm:

Symmetric key encryption algorithm, encoding, decoding using the same key algorithm

Asymmetric key encryption algorithm, a public key, a private key, the two keys are different, the public key can be disclosed to how to use, the private key is strictly confidential.

Encryption channel establishment:

Digital certificate application and verification

How to Apply:

• Generate its own public and private keys, and the server keeps its own private key
• Submit public key, company and domain name information to CA for authentication
• CA agencies verify the authenticity and legality of the information you submit through a variety of online and offline channels
• If the information is approved, the CA will issue you an authenticated digital certificate, which contains the public key, organization information, CA information, expiry date, certificate serial number, and generates a signature
• Signing procedure: Hash (the plaintext information submitted for the certificate application)= Information digest
• The CA uses the private key of the CA to encrypt the digest. The ciphertext is the digital signature of the certificate

37. HTTPS symmetric encryption, asymmetric encryption, mixed encryption, CA authentication 😨

HTTPS, hypertext transfer security protocol, the target is secure HTTP channel, the application is secure data transfer. Although HTTP protocol is widely used, it has some security defects, mainly the lack of plaintext transmission and message integrity detection.

HTTPS is a network protocol constructed by HTTP and TLS/SSL for encrypted transmission and identity authentication.

Through digital certificates, encryption algorithms, asymmetric keys and other technologies to complete the Internet data transmission encryption, Internet transmission security protection.

HTTPS features:

1. Data confidentiality
2. Data integrity
3. Identity check security

Before data transmission, the client and server authenticate each other based on certificates. The client sends an SSL handshake message to the server for connection, and the server sends the certificate to the client. The client checks the certificate on the server and verifies whether it is issued by a trusted certificate issuing authority. If the certificate is not issued, the client gives the decision of whether to continue the communication to the user. If the check is correct or the user chooses to continue, the client recognizes the identity of the server.

The server asks the client to send a certificate and checks whether the certificate is authenticated. If the authentication fails, the server closes the connection. If the authentication succeeds, the server obtains the client public key from the client certificate.

Principle of HTTP

The browser of the client must first establish a connection with the server through the network. The connection is completed through TCP. The port number of the general TCP connection is 80. After receiving the request, the server provides the corresponding response information.

HTTPS principle

Client will list it supports algorithm and used as a key random number sent to the server, the server list, select a kind of encryption algorithm, from algorithm and it contains the server and a public key certificate is sent to the client, the certificate contains a server for authentication purposes, the server also provides a used to generate random number keys.

The client authenticates the certificate of the server, extracts the public key of the server, generates a random password string called pre_master_secret, encrypts it with the public key of the server, and sends the encrypted information to the server.

The client and server separately calculate the encryption and MAC keys based on the pre_master_secret and the random number of the client and server.

Mixed encryption

Symmetric encryption is used in data transmission, but asymmetric encryption is used to transmit the keys of symmetric encryption. Mixed encryption is more secure, but it is impossible to know whether the data is tampered

CA certification

CA authentication is an electronic authentication service. It refers to the activities of authenticating the authenticity and reliability of an electronic signature.

Features: See Baidu Encyclopedia – Introduction, click to enter

38. HTTP 🥶 HTTPS contrast

HTTP transmission mode: plaintext transmission. Data interaction between websites or related services and users is not encrypted, which is easy to be monitored and tampered with.

HTTPS transfer mode: The SSL layer is added to HTTP for data transmission and encryption.

HTTP authentication: There is no authentication. Users cannot identify the real identity of a website through HTTP.

HTTPS authentication: Multiple authentication by the CA, including domain name management permission authentication.

HTTP cost: There is no use cost, all websites default to HTTP mode.

HTTPS requires a cost and requires an SSL certificate to implement HTTPS.

HTTP connection port: port 80.

HTTPS connection port: port 443.

39. How to securely transmit the certificate? What if the certificate is switched? 😳

In the 40. Http3 QUIC 😵

QUIC is a low latency Internet transport layer protocol based on UDP developed by Google.

1. Avoid presequence packet blocking; 2. Zero RTT connection; 3. FEC forward error correction

The history of HTTP

The difference between HTTP/2 and HTTP/3 connection establishment

TCP/ Establishes a connection with QUIC

Queue head blocking/multiplexing

HTTP/1.1 introduces Pipelining technology that allows multiple requests to be sent simultaneously from a SINGLE TCP connection

Request and response, and Pipelining

HTTP /1.1 queue header blocking

Multiplexing of HTTP/2 solves the queue head blocking problem

Congestion control:

• Slow start
• Congestion avoidance
• The fast retransmission
• Fast recovery

41. Getting started with the HTTP protocol

HTTP An application layer protocol based on TCP/IP. It does not involve packet transmission and is used for communication between a client and a server. Port 80 is used by default. After a TCP connection is established, the client requests a web page from the server. According to the protocol, the server can only respond to a string in HTML format.

Http1.0 can transmit text, transmit images, video, binary files; In addition to GET, there are POST, HEAD, and so on; Each communication requires HTTP headers, status codes, multi-character set support, caching, permissions, etc.

Field: ontent-Type Field

Header information must be ASCII, followed by any data format, field values:

text/plain
text/html
text/css
image/jpeg
image/png
image/svg+xml
audio/mp4
video/mp4
application/javascript
application/pdf
application/zip
application/atom+xml
Copy the code

When the client requests the data, the Accept field is used to indicate which data formats can be accepted.

Accept: */ *Copy the code

The Content-Encoding field indicates the data compression method

Content-Encoding: gzip
Content-Encoding: compress
Content-Encoding: deflate
Copy the code

The accept-encoding field is used when the client requests which compression methods are accepted.

Accept-Encoding: gzip, deflate
Copy the code

Http1.0 is a TCP Connection can only send one request, sent after the end of the close, so, to solve the problem, using a non-standard Connection field, Connection:keep-alive.

HTTP/1.1 introduced persistent connections. TCP connections are not closed by default, can be reused by multiple requests, and do not declare connection: keep-alive.

TCP connections are closed whenever there is a period of no activity. Most browsers allow up to six persistent connections for the same domain name.

Version 1.1 introduces pipelining, which allows multiple requests to be sent simultaneously within the same TCP connection. But again, in order, one request is answered, and then the other request is answered. (But it also saves a lot of time).

Block Transfer Encoding is used whenever the request or response header has a transfer-encoding field

Transfer-Encoding: chunked
Copy the code

What is multitasking? Two-way, real-time communication is called multiplexing.

HTTP2 reuse TCP connection, in a connection, both ends can send multiple requests or responses at the same time, and do not follow the sequence of one to one, to avoid “queue head congestion.”

Http2 introduces a header compressor. Headers are compressed using GZIP or Compress before being sent. The client and server maintain a header table at the same time.

HTTP/2 allows the server to send resources to the client unsolicited (server push)

42. What are cookies 🥴

Cookie is the data (usually encrypted) stored on the user’s local terminal by a website to identify the user’s identity and conduct session tracking, and stored temporarily or permanently by the user’s client computer.

1. Data stored on the user’s local terminal
2. To identify the user
3. Save the file on the local terminal

Cookies are data stored in text files on your computer. When a Web server sends a Web page to the browser, the server does not record the user’s information after the connection is closed. The purpose of cookies is to figure out how to record the user’s information on the client.

Scenario: When a user visits a web page, the user information is recorded in the cookie. When the user visits the page next time, the user access record can be read from the cookie.

Cookies are stored in the form of key-value pairs. When a browser requests a Web page from the server, the cookie of the page is added to the request, and the server uses this method to obtain user information.

You can use JavaScript to create, read, modify, and delete cookies

Use the document.cookie property to create, read, and delete cookies

Create:

document.cookie = "username = dadaqianduan";
Copy the code

Add an expiration time to cookie:

document.cookie = "username = dadaqianduan; expires=xxxxxx";
Copy the code

By default, the cookie belongs to the current page:

document.cookie = "username = dadaqianduan; expires= ; path=/";
Copy the code

Read the cookie

var x = document.cookie;
Copy the code

Modify the cookie

document.cookie = "username = dada; expires=xxx; path=/";
Copy the code

Delete the cookie and change the Expires parameter to the previous time.

document.cookie = "username = ; expires= xxx";
Copy the code

Why are there cookies? Because there is no protocol in HTTP request, HTTP1.x, stateless protocol, the client sends the same request several times, the server can not identify whether the same client sent, in order to solve the stateless, there is a cookie.

Cookies are text files in.TXT format that are temporarily stored on your computer by the server so that the server can identify your computer. When you browse a website, the Web server sends a small piece of information to your computer.

The next time you visit the same site, your Web browser will first look for cookies from the last time it was there and output specific content.

Principle of cookies

The browser requests the server for the first time, and the server responds with a cookie in the request to the browser. The browser requests for the second time to carry a cookie to the server. The server identifies users according to the cookie and can also modify the cookie content.

When domain is used, the cookie of. Baidu.com is bound to the domain name provider. Cross-domain domain names cannot be written into cookies

What are the attributes of cookies

Name, Value, Domain, Path, Expires/Max-Age, Size, HttpOnly, Secure, SameSite

Grasp the HttpOnly in the interview, this attribute is set to true, you can not get the cookie through the JS script, can effectively prevent XSS attacks.

Cookie in HttpOnly and Secure:

Cookies marked as Secure can only be sent to the server with requests encrypted by HTTPS. But there is no guarantee of its safety.

If the HttpOnly attribute is set in the cookie, the JS script will not be able to read the cookie information, effectively prevent XSS attacks, steal cookie content, increase the security of the cookie, but important information is not stored in the cookie.

Because XSS is a cross-site scripting attack, which is a common vulnerability of Web programs, it belongs to the passive attack mode and is used for the client

Set-Cookie: id=a3fWa; Expires=Wed, 21 Oct 2015 07:28:00 GMT; Secure; HttpOnly
Copy the code

SameSite

SameSite cookies prevent cross-site request forgery attacks (CSRF) by allowing a server to request that a Cookie not be sent on a cross-site request.

Example:

Set-Cookie: key=value; SameSite=Strict
Copy the code

SameSite has three values:

None: The browser continues to send cookies under the same site request and cross-site request, and is case insensitive. (All requests from three parties carry cookies)

Strict: The browser sends cookies only when visiting the same site. (All three-party links do not carry cookies)

Lax: Same-site cookies will be reserved for some cross-site sub-requests, such as image loading or frames calls, but will only be sent when the user navigates to the URL from the external site. (Cookies can only be carried on synchronous and GET requests)

Secure cookies can be set only in HTTPS, but cannot be set in HTTP web pages. By default, cookies are sent to the server for HTTPS or HTTP requests.

43. What is a token? 🤬

The token occurs when the client frequently requests data from the server, and the server frequently queries the user name and password in the database, makes a comparison, determines whether the user name and password are correct, and makes corresponding prompts. The token is a string of characters generated by the server to serve as a token for the client to request. During the first login, the server generates a token and returns the token to the client. The client carries the token without the need to carry the user name and password again.

The presence of tokens relieves pressure on the server and reduces frequent database queries.

The advantages of the token

• Stateless and extensible
• security
• Multi-platform cross-domain
• Based on the standard

The process of Token – based authentication

The token is returned to the client. When the client initiates a request, the API carries the token to the server every time. After the filter is passed, the token is verified, and the request data is returned after successful verification. An error code is returned after the verification fails.

44. Cookies, session, token 😷

Cookies, record the visited web site or is on a visit to the site, for the HTTP protocol is stateless, servers don’t know what browser last visited did, also can not connect to track the user’s session, so, a cookie is sent by the server to the client browser to a text file that contains the information web site visits. Cookies are stored on the client to save session information on the client. Because it is stored on the client side, its security cannot be fully guaranteed.

Session is a session between a server and a client in the C/S architecture. It is used to store authentication user information. Session is an HTTP storage mechanism that provides a persistence mechanism. The Session is stored on the server, and the user authenticates the client information. Since it is stored on the server, security is guaranteed.

Token is an authentication mode. It is mainly used for identity authentication.

45. The cross-domain 🤒

The URL of the web page protocol, domain name, port has a different, even cross-domain

Cross domain: json

46. Mind Mapping HTTP summary

47. The field in HTTP 🤠

1. Accept, data format, Request Accept, response, content-type, data format received
2. Accept, compression mode, request accept-encoding, response, content-encoding, what compression mode is used
3. Accept, supported language, request accept-language, response content-language
4. Accept, character set, request accept-charset, response content-type, specified character set
5. Accept, range request, request if-range and range, response accept-Anges and content-range
6. Cookie: Cookie information passed to the server when the request is made
7. Set-cookie: indicates that the response packet header sets the cookie information to be passed to the client
8. Allow, what HTTP methods are supported
9. Last-modified: The last time the resource was modified
10. Expires, which sets the failure date for resource caching
11. Content-language: The entity’s resource language
12. Content-encoding: indicates the encoding format of the entity
13. Content-length: The size of the body of the entity in bytes
14. Content-range, which range of entities to return
15. Content-type: Specifies the content type
16. Accept-ranges, the range requests that are handled
17. Age, tells the client how long ago the server created the response
18. Vary, cache information of the proxy server
19. Location, which specifies the URI after the redirection
20. If-match, the value is the unique identifier of the resource
21. User-agent, passing information such as the name of the browser and User Agent that created the request to the server
22. Transfer-encoding: indicates the body Encoding of transmitted packets
23. Connection, manage persistent connections, keep-alive, close
24. Cache-control: controls the browser’s strong Cache

48. If the interview asks what is the HTTP message structure, can you answer?

For TCP

Start line + header + blank line + entityCopy the code

1. The request message

GET /home HTTP/1.1
Copy the code

2. The response message

HTTP/1.1 200 OK
Copy the code

The blank line is used to separate the header from the entity.

49. What are the methods of making HTTP requests? 🤥

1. The GET method, which is used to obtain resources
2. The POST method is used to submit data
3. The PUT method is used to modify data
4. The DELETE method is used to DELETE resources
5. OPTIONS method for cross-domain requests
6. The HEAD method is used to get meta information about the resource
7. The CONNECT method, used to establish a connection, is used for the proxy server

50. If an interview asks you what you mean by A URI, can you answer it? 🤫

URL Uniform resource Locator, URI, uniform resource identifier. Uris are used to distinguish between different resources on a network.

Uris contain urNs and urls.

URL structure:

Protocol name, user information for logging in to the host, host name and port, request path, query parameters, and an anchor point on the URI to locate the resource.

51. If an interview asks you what you know about HTTP status codes, can you answer them?

Learn about some specific HTTP status codes:

52. If asked about the characteristics and disadvantages of HTTP, can you answer them?

Features are:

1. Flexible and extensible
2. Reliable transport
3. Stateless etc.

The disadvantage is that:

1. stateless
2. Clear transmission
3. Head block problem

53. If asked, tell me your understanding of the Accept field. Can you answer it?

• The data format
• Compression way
• Support language
• Character set

54. Can you answer the question “what is a team leader blocking?” 🤭

In TCP, it is a packet. In HTTP, it is a request.

The solution to HTTP header blocking is concurrent connections and domain name sharding.

55. If asked what you understand about HTTP proxy, can you answer it? 🧐

Proxy server functions: 1, load balancing, 2, security (using the heartbeat mechanism to monitor servers, once found faulty machines will be kicked out of the cluster.) 3. Cache proxy.

Understanding proxy caching:

• Pages downloaded by a proxy server are stored;
• A proxy server provides a channel for multiple users;
• Buffered proxies allow a proxy server to reduce the number of requests for the same page on the same website
• Once a user of the proxy server requests a page, the proxy server saves the page to serve the same request from its other users
• Proxy caching, which reduces the time users have to wait for pages to display

What the cache does:

Resource copies stored on the local disk of the proxy server or client. The cache can reduce the access to the source server, thereby saving traffic and communication time.

Example:

Cache-Control: max-age=300;Copy the code

Indicates the time interval. If the request is repeated within 300s, it is obtained in the cache, otherwise it is obtained in the server

Cache-Control:

• Public means that the response can be cached by any intermediate node
• Private indicates that the intermediate node does not allow caching
• No-cache indicates that the cache Control mode of cache-control is not used for pre-verification
• No-store means really not caching anything
• Max-age Indicates the valid time of the current resource

Strong cache: The browser gets data directly from local storage without interacting with the server

Negotiated cache: The browser sends the request to the server, and the browser determines whether the local cache can be used

Learn about strong caching 👍 :

Strong caching focuses on Expires and cache-control

Cache-control Specifies this field: max-age, S-maxAge, public, private, no-cache, no-store.

cache-control: public, max-age=3600, s-maxage=3600 
Copy the code

• Indicates how many seconds elapsed before the resource became invalid
• The priority of S-maxage is higher than that of max-age
• In the proxy server, only S-Maxage is in effect

Public and private

• Public indicates that the resource can be cached by all clients and proxy servers
• Private indicates that the resource can be cached only by the client

When the browser requests a file, the server makes a cache configuration in the response header:

The cache-control of the respone header is displayed

✍ negotiation cache:

The Settings in the Response header

etag: 'xxxx-xxx
last-modified: xx, 24 Dec xxx xxx:xx:xx GMT
Copy the code

56. If the interview asks, “HTTP/2,” can you answer it? 🤓

HTTP/2 uses Huffman encoding to compress integers and strings, achieving a high compression rate of 50%~90%.

Server push

57.B/S Structure definition 😈

Browser-server structure, B/S structure, the client does not need to install special software, only the browser can, the browser through the Web server and database interaction, can easily work in different platforms.

B/S structure simplifies the work of the client, which is produced with the rise of Internet technology, the improvement of C/S technology, but the work of the server side under this structure is heavier, the server performance requirements are higher.

58.URI Uniform resource identifier 👿

A uniform Resource identifier (URI) is a string used to identify the name of an Internet resource. This identity allows users to interact with resources on the network over a specific protocol. The common form of A URI is a uniform resource locator (URL). URN is a uniform resource name. Used to identify resources in a particular command space to complement urls.

59. 👹 HTTP protocol

HTTP hypertext transfer protocol (HTTP) is the most widely used network protocol on the Internet. HTTP was originally designed to provide a way to publish and receive HTML pages. Resources requested over HTTP or HTTPS are identified by uniform Resource Identifiers (URIs)

Main features of THE HTTP protocol

60. Data link 🔪- Data link layer

Data Link Layer: Ethernet, wireless LAN, PPP… (Wireless, fiber…)

• Knowledge of data links plays an important role in understanding TCP/IP and networks
• The protocols at the data link layer define the specifications for the transmission of devices interconnected through the communication media
• At the physical level, the actual communication medium, such as the high and low voltage, the strength of radio waves and other signals, is converted to binary 01
• The data link layer processes data as a set of “frames”
• WLAN
• PPP, point – to – point protocol, that is, 1 – to – 1 computer connection protocol
• ATM, asynchronous transmission mode

A data link is a protocol that allows computers on the Internet to communicate with each other

• MAC addresses are used to identify interconnected nodes on a data link

• Wireless communication is the use of electromagnetic waves, infrared, laser and other ways to transmit data. Generally in the office of the local area network (LAN) in the formation of higher speed connections known as wireless LAN.
• Ip-x-x-x: X-X-X is established on the IP network. The network service provider provides a service that uses MPLS technology to build X-X-X on the IP network.

61. The difference between TCP and UDP

TCP is a connection-oriented, reliable, byte stream – based transport – layer protocol.

UDP is a connectionless transport layer protocol.

TCP is connection-oriented. Before the client and server communicate with each other, TCP requires a three-way handshake to establish a connection, while UDP does not establish a connection

TCP is byte stream oriented and UDP is packet oriented. UDP transmits data based on datagram. TCP inherits the features of THE IP layer. To maintain state, TCP converts each IP packet into a byte stream.

TCP packet format diagram:

• Serial number: Seq Serial number, which is 32 bits. It identifies the byte stream sent from the TCP source port to the destination port. When the initiator sends data, it marks the byte stream
• Confirmation number: INDICATES the Ack number, which is 32 bits. The CONFIRMATION number field is valid only when the Ack flag bit is 1. Ack=Seq+1
• There are six flag bits, such as URG, ACK, PSH, RST, SYN, and FIN

1. URG, urgent means effective
2. ACK, verify that the serial number is valid
3. RST, reset the connection
4. SYN, initiates a new connection
5. FIN, releases a connection
6. PSH, the receiver should deliver the packet to the application layer as soon as possible

62. Three-way handshake to establish connection

TCP three-way handshake process:

The figure shows that the server is in the CLOSED state. The server starts listening to a port and enters the LISTEN state. The client initiates a request and sends SYN,seq=x, and then the state changes to SYN-sent.

The server receives syn and ACK,seq=x, ACK =x+1, and the state changes to SYN-RCVD.

The client sends ack, SEq =x+1, AND ACK =y+1 to the server, and the state changes to Established.

During the connection, the serial number of the TCP packet that needs to be acknowledged by the peer end needs to be consumed. A SYN consumes a sequence number while an ACK does not.

For the connection four handshake is unnecessary, the second handshake will bring a waste of resources, when the packet loss, retransmission, connection closed, when the packet loss reaches the server, the connection will be established by default, but the client and close, so three handshake is ok.

63. Disconnect with four waves

TCP The process of four waves

Three waves. When the server combines the ACK and FIN waves into one wave, a long delay is caused. The client mistakenly thinks that the FIN has not reached the client.

64.TCP sliding window

TCP sliding window:

1. Send window

2. Receiving window

65.TCP congestion control?

TCP connection, congestion Control:

1. Congestion Window (CWND)
2. Slow Start Threshold (SSthresh)

TCP/IP is layer 4

1. The application layer determines the communication activities when providing application services to users.
2. The transport layer provides data transmission between two computers in a network connection to the upper application layer.
3. The network layer processes the data packets that flow across the network.
4. The link layer, which handles the hardware that connects to the network.

• The HTTP protocol is responsible for generating HTTP request packets to target Web servers
• TCP divides HTTP request packets into segments to facilitate communication
• IP protocol responsibility, search each other’s address, side transfer side transmission
• The responsibility of TCP is to reassemble the packet segments received from the other party and the packet segments that arrive. The request packets are reassembled in the original order according to the sequence number

66. Learn about DNS

DNS is a domain name resolution system. Its function is very simple, which is to find the corresponding IP address according to the domain name.

• The NS record, A record, and IP address of the TOP-LEVEL DNS server are obtained from the root DNS server
• The NS record, A record, and IP address of the secondary DNS server are obtained from the top-level DNS server
• Retrieve the IP address of the host name from the secondary DNS server

reference

• Detailed browser segment request basics – Range, to help you understand breakpoint resume basics
• Implementation principle of HTTP/2 protocol multiplexing
• Protocol learning – Summary of HTTP2 frame structure
• Behind the scenes of HTTP/2
• The TCP protocol is the soul of the question, strengthen your network underlying foundation
• https
• Getting Started with HTTP
• HTTP cookies
• [2] ShutdownHTTP series -HTTP packet
• How the Web Is Connected
• Illustrated TCP/IP
• (Intensive reading recommended) HTTP Soul question, strengthen your knowledge of HTTP

Pay attention, don’t get lost

May you meet someone who loves you dearly

Including front-end Vue, JavaScript, data structure and algorithm, practical exercises, Node full-stack first-line technology, closely follow the industry development pace, a love of front-end programmer Dada.

All right folks, that’s all for this post, people who can see here are talented. I will continue to update the following network technology related articles, if you think the article useful, welcome to give a “like”, also welcome to share, thank you!!

Like this article friends, welcome long press the following figure to pay attention to the public number dada front end, watch more exciting content