How HTTP Works · Laravel Blueprint

In one sentence

HTTP is the simple text-based language a browser uses to ask a server for something, and the server uses to answer.

✉️Think of HTTP as a letter with a strict format. The envelope says what you want and where (method + URL), a few lines on top add details (headers), and the server mails back a reply with a short verdict stamped on it, like “200 OK” or “404 Not Found”.

Why it matters

Laravel is an HTTP machine

🧩

Routes speak HTTP

Route::get() and Route::post() are literally HTTP methods. Knowing them makes routing obvious.

🔍

Faster debugging

A 404, a 419 or a 500 each point to a different kind of problem. Read the status code and you already know where to look.

🍪

Logins make sense

HTTP forgets you between requests. Cookies and sessions are how Laravel “remembers” who is logged in.

The big picture

One request, one response

🌐Browserthe client

📨Requestmethod + URL + headers + body

🖥️Serverruns your Laravel app

📬Responsestatus + headers + body

Every page load, form submit and image is one of these round trips. The client always speaks first.

A few words you'll see everywhere in this lesson:

Client: The program making the request, usually a browser, but also a mobile app or a tool like curl.
Server: The computer (and program) that receives the request and sends back a response. Your Laravel app runs here.
Method: A verb that says what the client wants to do: read, create, update or delete.
Status code: A three-digit number at the top of every response that summarises how things went.
Header: A Name: value line with extra information, like the content type or a cookie.

Step by step

Read HTTP like a pro

Each step adds one piece of the puzzle. By the end you'll be able to read a raw HTTP message line by line.

Look at a raw request

HTTP is just text. When you visit https://blog.test/posts/42, your browser sends something like this:


          GET /posts/42 HTTP/1.1
          Host: blog.test
          User-Agent: Mozilla/5.0 (Windows NT 10.0)
          Accept: text/html
          Accept-Language: en-GB
          Cookie: laravel_session=eyJpdiI6...

The first line is the request line: method, path and protocol version. Everything after it is a header. A GET request has no body.

Look at the raw response

The server answers in the same format: a status line, headers, a blank line, then the body (the actual HTML).


          HTTP/1.1 200 OK
          Content-Type: text/html; charset=UTF-8
          Content-Length: 1834
          Cache-Control: no-cache, private
          Set-Cookie: laravel_session=eyJpdiI6...; path=/; httponly

          <!doctype html>
          <html>
            <head><title>My first post</title></head>
            ...

💡 See it yourself

Open your browser's DevTools (F12), go to the Network tab and reload any page. Click a request to see its headers, status and body.

Pick the right method

The method tells the server what kind of action you want. Browsers only send GET (links, typing a URL) and POST (forms) on their own. The others are used by JavaScript, APIs and Laravel's form tricks.

Method	Meaning	Blog example	Safe to repeat?
`GET`	Read something	Show post 42	Yes, changes nothing
`POST`	Create something / submit data	Publish a new post	No, may create duplicates
`PUT`	Replace something entirely	Save the full edited post	Yes, same result each time
`PATCH`	Change part of something	Update just the title	Usually
`DELETE`	Remove something	Delete post 42	Yes, gone is gone

A request with a body, like a form submission, looks like this:


          POST /posts HTTP/1.1
          Host: blog.test
          Content-Type: application/x-www-form-urlencoded
          Content-Length: 41

          title=Hello+HTTP&body=My+first+post&_token=...

Read the status code family

You don't need to memorise every code. The first digit tells you the family, and that alone tells you who to blame.

Family	Meaning	Codes you'll meet
1xx	Informational: “hold on…”	Rare in day-to-day work
2xx	Success	`200 OK`, `201 Created`, `204 No Content`
3xx	Redirect: “look over there”	`301 Moved Permanently`, `302 Found`
4xx	Client error: the request was wrong	`401`, `403`, `404`, `405`, `419`, `422`, `429`
5xx	Server error: your code broke	`500 Internal Server Error`, `503 Service Unavailable`

ℹ️ Laravel-flavoured codes

419: your form is missing its CSRF token (or the page sat open too long).
422: validation failed, usually in an API request.
405: the URL exists, but not for that method (e.g. you sent POST to a GET-only route).

Use headers for the extra details

Headers carry metadata. Some describe the request, others describe the response. Here are the ones you'll bump into most:

📦
Content-Type
What format the body is in: text/html, application/json…

🙋
Accept
What format the client wants back. Laravel returns JSON errors when this is application/json.

➡️
Location
Sent with a 3xx status to say where to go next.

🔑
Authorization
Carries an API token, e.g. Bearer abc123.
Remember: HTTP is stateless

Stateless means every request stands alone. The server doesn't automatically remember that you logged in one request ago. So how do logins work? With cookies.

The server sends a Set-Cookie header once. From then on, the browser automatically sends that value back in a Cookie header on every request to the same site.
```
          ← HTTP/1.1 302 Found
          ← Set-Cookie: laravel_session=abc123; path=/; httponly

          → GET /dashboard HTTP/1.1
          → Cookie: laravel_session=abc123
        
```
Laravel stores your session data on the server and uses that cookie as the key to find it. You'll dig deeper in Sessions & Guards.

Common mistakes

Avoid this, do that

❌ Avoid


          <a href="/posts/42/delete">Delete</a>

A link sends GET, and search bots or link previews can “click” it and delete your data.

✅ Do


          <form method="POST" action="/posts/42">
              @csrf
              @method('DELETE')
              <button>Delete</button>
          </form>

Anything that changes data goes through a form with a non-GET method.

❌ Avoid


          GET /login?email=me@blog.test&password=secret

Query strings end up in browser history, server logs and shared links.

✅ Do


          POST /login
          (email and password in the body, over HTTPS)

Send secrets in a POST body, and always over HTTPS so the text is encrypted.

💡 Pro tip: talk HTTP from the terminal

curl -i prints the status line and headers along with the body. It's great for checking what a URL really returns.


        curl -i https://laravel.com

🏋️ Try it yourself

Open DevTools → Network on any site and find the request for the page itself. Note its method and status code.
Find a Set-Cookie header in a response, then find the matching Cookie header on the next request.
Visit a URL that doesn't exist on that site and check the status code you get.
Run curl -i http://github.com and spot the 3xx status and its Location header.

Recap

Key takeaways

HTTP is plain text: a request (method, URL, headers, body) and a response (status, headers, body).
GET reads; POST, PUT, PATCH and DELETE change things.
Status families: 2xx success, 3xx redirect, 4xx client's fault, 5xx server's fault.
Headers carry metadata such as Content-Type, Location and cookies.
HTTP is stateless; cookies (and Laravel sessions) are how the server remembers you.

Check yourself

Laravel is an HTTP machine

Routes speak HTTP

Faster debugging

Logins make sense

One request, one response

Read HTTP like a pro

Look at a raw request

Look at the raw response

Pick the right method

Read the status code family

Use headers for the extra details

Content-Type

Accept

Location

Authorization

Remember: HTTP is stateless

Avoid this, do that

Key takeaways

Mini quiz