Web

1. 1

   What Is The Web

   Welcome. If you have never thought about what actually happens when you type a URL into a browser, you are in the right place. The web is the world's...

   Client-server modelBrowser as a clientURL structureWhat happens between typing and rendering
   20 min
2. 2

   HTTP vs HTTPS

   Picture yourself on the free wifi at a coffee shop. Someone else on that same network, running nothing more exotic than a packet sniffer, can watch...

   Plaintext HTTPHTTPS as HTTP over TLSConfidentialityIntegrityAuthenticityPadlock UI
   15 min
3. 3

   Request and Response Anatomy

   You already know that a browser sends a request and a server sends back a response. What you have not seen yet is what those two things actually look...

   Request lineHeadersBodyStatus codesMethodsCurl -v
   30 min
4. 4

   Cookies, Sessions, and Tokens

   HTTP has no memory. Every single request you send is treated by the server as if it had never seen you before, even if you sent the exact same...

   Set-CookieHttpOnlySecureSameSiteServer sessionsJWT+1
   25 min
5. 5

   DNS Explained

   You point a domain at a new server, the change goes in, and it works from your laptop and not from your colleague's. Or the site is down for half...

   RootTLDAuthoritative serverRecursive resolverAAAAA+6
   25 min
6. 6

   TLS and Certificates

   TLS is the layer that turns plain HTTP into HTTPS. By the end of this lesson you will know roughly what happens during the handshake, what a...

   TLS handshakeClientHelloServerHelloCertificateKey exchangeCA chain of trust+2
   30 min
7. 7

   CORS

   Your frontend runs on localhost:3000, your API runs on localhost:8000, and the request that works perfectly in curl fails in the browser with a red...

   Same-origin policyOriginPreflight OPTIONSAccess-Control-Allow-OriginAccess-Control-Allow-MethodsAccess-Control-Allow-Headers+1
   30 min
8. 8

   REST API Basics

   You are asked to add an endpoint to an existing API and you freeze on the first decision: is it POST /users/42/deactivate or PATCH /users/42? Both...

   Resources as nounsMethods as verbsStatus codesIdempotencyHATEOASVersioning
   25 min
9. 9

   WebSockets and SSE

   Your feature is "show the new message the instant it arrives". Every tool you have learned so far assumes the client asks first and the server...

   Long pollingWebSocket upgradeFull-duplex framesServer-Sent EventsWhen to pick each
   25 min
10. 10

    Caching and CDNs

    Your homepage takes 900 milliseconds to build, and it builds the same thing for the ten thousandth visitor as it did for the first. Somewhere in that...

    Browser cacheProxy cacheCDN edgeCache-ControlETagIf-None-Match+2
    25 min
11. 11

    Security Headers

    A security review lands on your desk with fourteen items on it, and six of them turn out to be response headers you are not sending. That is the good...

    Content-Security-PolicyStrict-Transport-SecurityX-Content-Type-OptionsX-Frame-OptionsFrame-ancestorsReferrer-Policy+1
    25 min
12. 12

    Rate Limiting and Throttling

    At 09:14 your API starts timing out for everybody. Nothing was deployed. It turns out one customer's integration has a retry loop with no delay in...

    Token bucketLeaky bucketFixed windowWhere to enforce429Retry-After+1
    20 min
13. 13

    Monitoring and Logging

    It is three in the morning and a customer says checkout is failing. You have a name, a rough time, and a system spread across five services....

    Structured logsCorrelation IDsTracesSpansFour golden signalsLog vs metric+1
    20 min
14. 14

    Capstone: A Tiny Web Server

    Every lesson in this course explained a header from the outside. You learned what Cache-Control promises, what Access-Control-Allow-Origin permits,...

    Serving HTTPCache headersCORS headersSecurity headersCurl -v304 Not Modified+1
    40 min

Every lesson, quiz, and tutor reply renders in your language. The AI tutor matches the language you ask in.

See how hiring teams interview engineers on Web, in production-like environments.