Web & APIs

How to use this topic

The first eight pages are about the web itself: how a page loads, HTTP in depth, URLs and content types, cookies and sessions, HTTPS in practice, browsers and the same-origin policy, web servers and reverse proxies, and caching. The other nine pages are about APIs: what they are, REST, data formats, authentication, design and documentation, testing, webhooks and real-time APIs, GraphQL and gRPC, and security. How services talk to each other inside a larger system is covered in Software Architecture & Design, and API testing as a craft in Integration and Contract Testing.

Most Python examples start a tiny web server inside the same script on your own computer (127.0.0.1) and then talk to it, so you see real HTTP requests and responses without needing the internet. Commands such as curl are shown with illustrative output. Networking basics (DNS, TCP, ports) are in Networking, and the web attacks themselves in Web Application Security; these pages link there.

Learning path

1. 01How the Web WorksWhat happens between typing an address and seeing a page: URLs, DNS, TCP and TLS connections, HTTP requests and responses, and how the browser turns the answer into a page.Beginner
2. 02HTTP in DepthThe protocol behind every web page and API call: request and response structure, methods and their properties, status codes, headers, and how HTTP/1.1, HTTP/2 and HTTP/3 differ.Beginner
3. 03URLs, Encoding and Content TypesHow data travels inside URLs and bodies: the parts of a URL, percent-encoding and query strings, media types such as text/html and application/json, character sets and form encoding.Beginner
4. 04Cookies, Sessions and StateHow a stateless protocol remembers who you are: cookies and their attributes, server-side sessions, tokens in browsers, third-party cookies and the privacy rules around them.Beginner
5. 05HTTPS and TLS in PracticeWhat the padlock really means: certificates in the browser, the TLS handshake in practice, HSTS, automated certificates with ACME, shrinking certificate lifetimes, and the errors you will meet.Intermediate
6. 06Browsers and the Same-Origin PolicyHow browsers keep websites apart: the DOM and rendering, the same-origin policy, cross-origin resource sharing and preflight requests, content security policy, and the developer tools.Intermediate
7. 07Web Servers and Reverse ProxiesWhat sits on the server side: web servers such as Nginx and Apache, virtual hosts, reverse proxies and load balancers, content delivery networks, and how the client's address survives the trip.Intermediate
8. 08HTTP CachingMaking the web fast without serving stale data: browser and shared caches, Cache-Control, validation with ETag and Last-Modified, CDN caching, and why you sometimes see the old version.Intermediate
9. 09What Is an API?How programs talk to each other: what an application programming interface is, the main styles — REST, RPC, GraphQL, gRPC and webhooks — and the contract between client and server.Beginner
10. 10REST APIsDesigning and using resource-oriented HTTP APIs: resources and URLs, methods and status codes, idempotence, filtering and pagination, versioning, and what REST originally meant.Intermediate
11. 11JSON and Other Data FormatsThe formats APIs exchange: JSON in depth, XML, YAML and others, validating data with JSON Schema, and the classic mistakes with numbers, dates and character encoding.Beginner
12. 12API AuthenticationProving who is calling an API: API keys, HTTP Basic, bearer tokens and OAuth 2.0, mutual TLS, request signing with HMAC, and how to keep credentials safe.Intermediate
13. 13Designing and Documenting APIsBuilding APIs other people want to use: consistent naming, useful error responses with Problem Details, OpenAPI descriptions, versioning and deprecation, and good documentation.Intermediate
14. 14Testing and Debugging APIsFinding out what an API really does: curl, Postman and Bruno, the browser's network panel, reading requests and responses, mock servers and automated API tests.Beginner
15. 15Webhooks and Real-Time APIsGetting updates without asking all the time: polling and long polling, webhooks and how to verify them, WebSockets and server-sent events.Intermediate
16. 16GraphQL and gRPCTwo alternatives to REST: GraphQL's flexible queries with one endpoint and a schema, and gRPC's fast, typed calls with Protocol Buffers — and when each fits.Advanced
17. 17Web and API SecurityProtecting web applications and APIs: the OWASP API Security Top 10, broken object-level authorization, CORS and CSRF in practice, rate limiting and API gateways, and secure defaults.Intermediate

Web & APIs glossary

Short definitions of the terms used in this topic. The full glossary covers every topic.