How does HTTP become tamper-proof on public WiFi?
Per Wikipedia: “HTTPS is HTTP over TLS — handshake negotiates cipher, verifies cert, then encrypts headers and body.”
Like sending letter in locked box — only server has key, postman cannot read.
- ClientHello with ciphers
- Server replies cert + ServerHello
- Client verifies CA chain
- Key exchange derives session key
- HTTP encrypted inside TLS record
- Cert binds domain to key
- TLS terminates at load balancer often
- Mixed http/https leaks
- Session resumption saves RTT
openssl s_client -connect api.example.com:443- Built from: HTTP — HTTPS wraps HTTP
- Related: HTTP Request Response Cycle — cycle includes TLS
- Related: CORS — CORS still applies over HTTPS
- Builds into: HTTP Headers — headers encrypted
- Self-signed cert trusted by client — breaks auth
- Terminating TLS but logging plaintext