Lesson 2 of 6 · About 6 minutes
Read URLs, headers, and status codes
Learn the concept.
A web exchange is easier to understand when you separate the address, the metadata, and the response. Each answers a different question.
Read three useful status codes
These labels describe the response, not a security verdict.
| Code | Label | Interpretation |
|---|---|---|
| 200 | OK | The request succeeded |
| 401 | Unauthorized | Valid authentication is required |
| 403 | Forbidden | The server refuses access |
Read the visualWhich part of /catalog?topic=security#featured is not sent in the HTTP request target?
The browser handles the fragment locally. The path and query are part of this request target.
Read the address in parts
In https://harbor.example/catalog?topic=security#featured, https is the scheme, harbor.example is the host, /catalog is the path, and topic=security is the query. The fragment featured is handled in the browser and is not sent as part of the HTTP request target.
Look at the metadata
Headers describe a request or response. Accept can indicate desired formats; Content-Type describes the body’s format. Headers and query values are not substitutes for permission checks.
Interpret the status in context
200 means this request succeeded. 401 indicates missing or invalid authentication credentials; 403 means the server refuses access. 404 can mean a resource is absent, or be used to avoid revealing a protected resource.
Put it in context
The lab returns 200 with JSON for book 42 and 404 for book 404. You can see the same request method and host with a different resource path and outcome.
Make a decision.
Explore the practice space, then answer the check-in below. A correct answer lets you save this lesson to your progress.
YOUR PRACTICE SPACE
Try the idea for yourself.
Enable JavaScript to explore this fictional exercise. The explanation and visual above remain available.
Take this with you.
Read the target, headers, and status together before explaining the result.
Next lesson: Cookies, sessions, and staying signed in