preface

This series started with preparing yourself for an interview. Later found more and more sorting, almost 120,000 characters, finally decided to share to everyone.

In order to share the sorting out, I spent a lot of time, at least three times as much time as ONLY myself. If you like, welcome to collect, follow me! Thank you very much!

The article links

  • Front – end interview check and fill gaps -(1) tremble and throttling
  • (2) Garbage collection mechanism
  • (3) Cross-domain and common solutions
  • (4) Front-end local storage
  • (5) Rendering mechanism and redraw and backflow
  • Front – end interview -(six) browser cache
  • (7) XSS attack and CSRF attack
  • (8) Front-end encryption
  • (9) HTTP and HTTPS
  • Check and fill gaps in front interview –(10) Front authentication
  • (11) Front-end software architecture pattern MVC/MVP/MVVM
  • (12) From the input URL to the page to see the whole process (including three handshake, four wave detailed explanation)
  • Front – end interview leak -(13) memory leak
  • Front – end interview omission and filling -(xiv) algorithm and sorting
  • (15) Event Loop

Collection of articles:

The Index (120,000 character collection) contains more than a dozen other articles in the series written so far. The following new value-added articles will not be added in each link, strongly suggest that the comments like, pay attention to the collection!!!! , thank you! ~

Follow-up Update Plan

Design pattern, front-end engineering, project process, deployment, closed loop, vUE often test knowledge and other contents will be added in the future. If you think the content is good, welcome to collect, follow me! Thank you very much!

Ask for an extrapolation

At present, I am also preparing for job-hopping. I hope you and HR sister can promote a reliable front-end position in Wuhan! Email :[email protected]. Thanks! ~

TCP/IP protocol

Before we talk about HTTP and HTTPS, there’s one thing we need to talk about in advance: the TCP/IP protocol.

In a literal sense, one might think that TCP/IP refers to both TCP and IP protocols. In real life, it sometimes refers to these two kinds of agreements. However, in many cases, it is only the use of IP communication protocol group must be used. Specifically, IP or ICMP, TCP or UDP, TELNET or FTP, and HTTP are among the TCP/IP protocols. They are closely related to TCP or IP and are an essential part of the Internet. The term TCP/IP refers to these protocols in general, so TCP/IP is sometimes called the Internet Protocol group.

Communication over the Internet requires corresponding network protocols. TCP/IP is originally a protocol family developed for the use of the Internet. So the protocol for the Internet is TCP/IP, and TCP/IP is the protocol for the Internet.

For more detailed information, see the following article to familiarize you with the TCP/IP protocol (Network Protocol 2).

TCP (Transmission Control Protocol) : communication between applications

TCP ensures that the packets arrive in the correct order and tries to confirm that the contents of the packets have not changed. TCP uses ports over IP addresses. It allows computers to provide various services over the network. Some port numbers are reserved for different services, and these port numbers are well known.

Service or daemon: On the machine providing the service, there is a program that listens for traffic on a particular port. For example, most E-mail traffic flows out on port 25, and HTTP traffic for WWWW flows out on port 80.

When an application wants to communicate with another application over TCP, it sends a communication request. The request must be sent to an exact address. After the handshake, TCP establishes a full-duplex communication between the two applications, occupying the entire communication line between the two computers. TCP is used to control data transmission from an application to the network. TCP is responsible for splitting data into IP packets before they are transmitted, and then reassembling them when they arrive.

TCP/IP means that TCP and IP protocols work together and have a hierarchical relationship.

TCP is responsible for communication between application software (such as your browser) and network software. IP is responsible for communication between computers. TCP is responsible for splitting the data and loading it into IP packets, which are sent to the receiver via THE IP router, which is responsible for addressing them correctly based on traffic, errors in the network, or other parameters, and then reassembling them when they arrive.

IP protocol (Internet Protocol) : communication between computers

The IP protocol is a mechanism that computers use to communicate with each other. Each computer has an IP. Used to identify the computer on the Internet. IP is responsible for sending and receiving data packets over the Internet. With IP, messages (or other data) are split into small, independent packets and sent between computers over the Internet. IP is responsible for routing each packet to its destination.

The IP protocol simply allows computers to send messages to each other, but it does not check whether the messages arrived in the order they were sent and are uncorrupted (only critical header data is checked). In order to provide the message verification function, the transmission control protocol TCP is designed directly on the IP protocol.

The HTTP protocol

concept

HyperText Transfer Protocol (HTTP) is used to Transfer HyperText from a WWW server to a local browser. It can make the browser more efficient and reduce network traffic. It not only ensures that the computer can transfer the hypertext document correctly and quickly, but also determines which part of the transferred document and which part of the content should be displayed first (for example, text before graphics).

HTTP is an application-layer communication protocol between a client browser or other program and a Web server. All hypertext information is stored on the Web server on the Internet, and the client needs to transfer the hypertext information to be accessed through THE HTTP protocol. HTTP contains commands and transmission information. It can be used not only for Web access, but also for communication between other Internet/Intranet application systems. In this way, hypermedia access of various application resources can be integrated.

The web address we enter in the browser address bar is called a Uniform Resource Locator (URL). Just as every home has an address, every web page has an Internet address. When you type a URL into the browser’s address box or click on a hyperlink, the URL determines the address to browse to. The browser uses hypertext transfer Protocol (HTTP) to extract the Web code of the site on the Web server and translate it into a beautiful Web page.

HTTP Protocol Basics

  • The client always initiates the request and the server sends back the response. When the HTTP protocol is applied, one end must play the client role and the other end must play the server role. From just one communication line, the roles of the server side and the client side are defined. The HTTP protocol specifies that the request is sent from the client, and the server responds to the request and returns. In other words, the communication must start with the client, and the server does not send a response until the request has been received.

  • Stateless Protocol HTTP is a stateless protocol. The protocol itself does not save the communication state between request and response. That is, at the HTTP level, the protocol does not persist requests or responses that have been sent. This is in order to handle a large number of transactions faster and ensure the scalability of the protocol, and the HTTP protocol is purposely designed to be so simple. However, with the continuous development of the Web, many of our businesses need to save the communication state. So we introduced cookies. With cookies and HTTP communication, you can manage state.

  • Cookie state Management Cookie technology controls client state by writing Cookie information in request and response packets. The Cookie notifies the client to save the Cookie according to the header field information called set-cookie in the response packet sent from the server. When the client sends a request to the server next time, the client automatically adds the Cookie value to the request packet and sends the request packet. After discovering the Cookie sent by the client, the server will check which client sent the connection request, and then compare the records on the server, and finally get the previous status information.

  • Uris locate resources The HTTP protocol uses URIs to locate resources on the Internet. Because of the specific functionality of URIs, resources can be accessed anywhere on the Internet.

  • In the initial version of the persistent HTTP protocol, TCP connections were broken for each HTTP communication. For example, when using a browser to browse an HTML page that contains multiple images, when sending a request to access the HTML page resources, it will also request other resources contained in the HTML page. As a result, each request causes a fearless TCP connection to be established and disconnected, increasing traffic overhead. To solve the above TCP connection problem, HTTP/1.1 and part of HTTP/1.0 came up with persistent connections. The TCP connection is maintained as long as either end does not explicitly request to disconnect the connection. Designed for multiple request and response interactions after establishing a TCP connection. In HTTP/1.1, all connections are persistent by default.

  • Piped persistent connections make it possible for most requests to be piped. Before sending a request, you had to wait and receive a response before sending the next request. With the advent of pipelining, the next request can be sent without waiting. This allows you to send multiple requests in parallel at the same time, rather than waiting for one after the other. For example, when requesting an HTML page that contains multiple images, using a persistent connection can make the request end more quickly than if it were connected in sequence. Pipelined technology is faster than durable connections. The more requests there are, the more significant the time difference becomes.

HTTP Working Process

  • 1. Address resolution

If use the client browser requests this page: localhost.com: 8080 / index. HTM to decompose the protocol name, host name, port, part such as object path, for our this address, analytical results are as follows:

Protocol name: HTTP Host name: localhost.com Port: 8080 Object path: /index.htm Copy codeCopy the code

In this step, the domain name system (DNS) is required to resolve the domain name and obtain the IP address of the host.

  • 2. Encapsulate HTTP request packets

Combine the above part with the information of the machine itself and encapsulate it into an HTTP request packet

  • 3. Encapsulate a TCP packet and establish a TCP connection (TCP three-way handshake)

Before the HTTP work begins, the client (Web browser) first establishes a connection with the server through the network. This connection is completed through TCP, which, together with the IP protocol, builds the Internet, namely the well-known TCP/IP protocol family. Therefore, the Internet is also called the TCP/IP network. HTTP is an application-layer protocol at a higher level than TCP. According to rules, connections can be made to protocols at a higher level only after low-level protocols are established. Therefore, a TCP connection must be established first. This is port 8080.

  • 4. The client sends a request command to the server

After the TCP connection is established, the client sends a request to the server. The format of the request is uniform resource identifier (URL), protocol version number, followed by MIME information including request modifiers, client information, and content.

  • 5. The server responds

After receiving the request, the server will give the corresponding response information in the format of a status line, including the protocol version number of the message, a success or error code, followed by MIME information including server information, entity information and possible content.

An entity message is when the server sends the header to the browser, it sends a blank line to indicate the end of sending the header, and then it sends the actual data requested by the user in the format described in the Content-type reply header.

  • 6. The server closes the TCP connection

Normally, once the server returns the request to the client, it closes the TCP Connection. Then, if the client or server adds the line Connection:keep-alive to its header, the TCP Connection will remain open after it is sent. The client can continue to send requests over the same connection. Staying connected saves the time needed to establish a new connection for each request and saves network bandwidth.

HTTP packet structure and header

The knowledge involved in this part is particularly tedious, limited by space, here will not repeat. Refer to chapters 4, 5, and 6 of this article for a very detailed explanation.

HTTP request method

GET: Obtains the resource specified by the URL. DELETE: deletes a file. HEAD: Obtains the header of the packet. Compared with GET, the packet body is not returned. CONNECT: A tunnel must be established for the communication with the proxy server. The tunnel is used for TCP communication. SSL and TLS are used to encrypt data and then transmit it over the network tunnel.Copy the code

The HTTP status code

The full instructions are in the novice tutorial.

HTTP shortcomings

  • Communication is in plain text, which is easy to eavesdrop
  • If the identity of the communicating party is not verified, it may be disguised
  • The integrity of the packet cannot be proved and may be tampered with

The HTTPS protocol

concept

Hypertext Transfer Protocol Secure (Abbreviated: Hypertext Transfer Protocol Secure) HTTPS, often called HTTP over TLS, HTTP over SSL, or HTTP Secure, is a transport protocol for Secure communication over computer networks.

HTTPS communicates over HTTP, but uses SSL/TLS to encrypt packets.

The main purpose of HTTPS development is to provide identity authentication for web servers and protect the privacy and integrity of exchanged data.

In short: HTTPS is a secure version of the HTTP protocol by creating an SSL encryption layer over HTTP and encrypting the transmitted data.

HTTPS has one more LAYER of TLS/SSL protocol than HTTP

TLS/SSL Is a Transport Layer Security protocol between TCP and HTTP. It does not affect the original TCP and HTTP. Therefore, you do not need to modify the HTTP page to use HTTPS.

HTTPS principle

It’s a lot of detail. Here I summarize briefly:

  • The client requests and verifies the public key from the server. This phase uses asymmetric encrypted transmission (RSA), where the server issues the digital certificate to the client. The digital certificate includes the public key and digital signature. The client verifies the data after obtaining it.
  • In asymmetric encryption transmission, the two ends negotiate to generate a conversation key.
  • The two parties use the dialogue key to communicate symmetrically.

Limited by space, I won’t go into it. Or it would be too much. Here I recommend a few articles for your comprehensive understanding:

  • Understand HTTPS principles in an easy-to-understand way: Article
  • Detailed explanation of SSL/TLS principle: article
  • Description of PKI system and certificate: article

The difference between HTTP and HTTPS

  • HTTP is a plaintext transmission, HTTPS is encrypted over SSL\TLS
  • The HTTP port number is 80 and the HTTPS port number is 443
  • For HTTPS, you need to apply for a certificate from the CA. Generally, there are few free certificates and you need to pay a fee
  • HTTP connections are simple and stateless; HTTPS is a network protocol based on SSL and HTTP for encrypted transmission and identity authentication. It is more secure than HTTP.

HTTPS provides the following functions:

  • The data is encrypted and an information security channel is established to ensure the data security during transmission
  • To the web server for real identity authentication

HTTPS shortcomings

  • The HTTPS handshake phase is time-consuming, increasing page loading time by nearly 50% and power consumption by 10% to 20%.
  • HTTPS connection caching is not as efficient as HTTP, resulting in high traffic costs for high-traffic sites.
  • HTTPS takes up much more resources on the server, and it costs more to support websites with more visitors. If HTTPS is used entirely, the average cost of VPS based on the assumption that most computing resources are idle will go up.
  • SSL certificates cost money, the more powerful the certificate fee is higher, personal sites, small sites do not need to generally do not use.
  • SSL certificates usually need to be bound to AN IP address, and cannot be bound to multiple domain names on the same IP address. IPv4 resources cannot support this consumption. (SSL has extensions to partially solve this problem, but it is troublesome, and requires browsers and operating systems to support this extension. This feature is almost useless).

HTTPS Access Optimization

CDN access

The delay increased by HTTPS is mainly the transmission delay (RTT). The characteristic of RTT is that the closer the node is, the smaller the delay will be. The CDN is naturally closest to the user. The CDN node can maintain a persistent connection with the service server, reuse sessions, and optimize link quality to greatly reduce the delay caused by HTTPS.

Session cache

As mentioned earlier, even with HTTPS session caching, the latency is at least 1*RTT, but at least the latency has been reduced to half of the previous, a significant delay optimization; In addition, the HTTPS connection based on the session cache does not require the server to decrypt the pre-master information using the RSA private key, which saves CPU consumption. If service access connections are centralized and the cache hit ratio is high, the HTTPS access capability is significantly improved. The cache hit ratio of the current TRP platform is greater than 30% during the peak period. The access resources of 10K /s can actually carry 13K /s access, which is very impressive.

Hardware acceleration

A dedicated SSL hardware accelerator is installed for the access server. Similar to a GPU, it releases CPUS and provides higher HTTPS access capabilities without affecting service programs. A hardware acceleration card can provide 35K decrypting ability, which is equivalent to 175-core CPU and at least equivalent to 7 24-core servers. Considering the overhead of other programs of the access server, a hardware card can achieve the access ability of nearly 10 servers.

Remote decryption

The local access consumes too many CPU resources, nic and hard disk resources. In this case, transfer the RSA decryption computing task that consumes the most CPU resources to another server. In this way, the access capacity of the server can be fully utilized, and the bandwidth and NIC resources can be fully utilized. The remote decryption server can be selected as a machine with low CPU load to realize machine resource reuse, or it can be a server optimized for high computing performance. Currently, it is also one of the solutions used by CDN for large-scale HTTPS access.

SPDY/HTTP2

The previous methods improve HTTPS access performance by reducing transmission delay and single machine load respectively, but they are all based on the optimization method proposed on the basis of not changing THE HTTP protocol. SPDY/HTTP2 takes advantage of TLS/SSL to improve HTTPS access performance by modifying the protocol. Improve download speed and so on.

Thanks and Reference

  • HTTP and HTTPS details
  • Talk about HTTPS. Be careful!