Phase 1: Programming & Fundamentals

TLS, HTTPS & data encryption in transit

Beginner ~3 min read
Think of it this way A friendly analogy. Read this if the technical version feels dense. Show Hide

Imagine you want to send a secret note to your friend in class, but you don't want anyone else – especially the teacher – to read it if they intercept it. If you write your note on a plain piece of paper, anyone who picks it up can read exactly what you wrote. That's kind of like how information used to travel on the internet with something called HTTP. It was like sending a postcard; everyone could see the message. This isn't great when your note contains a secret plan, or in the internet's case, your password or credit card number!

To make sure your note stays secret, you and your friend could agree on a super-secret code. Before you even write the real message, you’d have a quick, silent "secret agreement" (like a special wave or signal) to confirm it's really them and decide on the secret code you'll use. Then, you write your note in that secret code, scrambling all the words so it looks like gibberish to anyone else. Only your friend, who knows the code, can unscramble it and read the actual message. This whole clever system of using a secret code and checking who you're talking to is what we call TLS (Transport Layer Security) on the internet.

When you see a website address start with HTTPS (Hypertext Transfer Protocol Secure), that "S" means it's using this TLS secret note system. It’s like saying, "Every message we send here will be written in our super-secret code." So, when you log into a game, buy something online, or send a message to a friend, HTTPS makes sure your private information is scrambled up before it leaves your computer and stays scrambled until it reaches the correct website server, which then knows how to unscramble it. It also makes sure you’re sending your secrets to the real website, not a tricky fake one.

Knowing about TLS and HTTPS is super helpful because it helps you understand how the internet keeps your secrets safe. When you start building your own websites or apps, you'll want to make sure they use HTTPS. That way, you'll be giving your users the peace of mind that their information is protected, just like ensuring your secret notes only ever get read by your intended friend.

When your browser or application communicates with a web server, data is typically sent using HTTP. However, standard HTTP transmits information as plain text, meaning anyone intercepting the communication could read it – like sending a postcard where everyone can see the message. This is a huge security risk for sensitive data like passwords, credit card numbers, or personal information. To solve this, we use TLS (Transport Layer Security), which is a cryptographic protocol designed to provide secure communication over a network. Think of TLS as wrapping your data in a secure, encrypted envelope before it's sent.

HTTPS (Hypertext Transfer Protocol Secure) is simply HTTP layered on top of TLS. The "S" in HTTPS signifies that the connection is secured by TLS. When you visit an HTTPS website, a "handshake" process occurs behind the scenes. During this handshake, TLS performs two critical functions. First, it encrypts the data, scrambling it so that only the intended recipient with the correct decryption key can read it. This prevents eavesdropping. Second, it authenticates the server's identity using digital certificates. This ensures you are indeed connecting to the legitimate server (e.g., kunalganglani.com) and not a malicious imposter trying to trick you.

For you as a backend developer, understanding HTTPS is crucial. All modern web applications, especially those handling any form of user data, must serve content and API endpoints over HTTPS. You'll be responsible for configuring your server environment (like Nginx, Apache, or directly in your application code) to use valid TLS/SSL certificates, which are obtained from Certificate Authorities (e.g., Let's Encrypt). Implementing HTTPS is not just about security; it also builds user trust and is a ranking factor for search engines. Always assume any data leaving or entering your backend should be secured in transit.

Key Takeaways

  • HTTPS is HTTP secured by TLS (Transport Layer Security).
  • TLS encrypts data to prevent unauthorized reading (eavesdropping).
  • TLS authenticates the server's identity using digital certificates, preventing imposters.
  • All sensitive data and modern web traffic should use HTTPS for security and trust.
  • As a backend developer, you'll configure servers with TLS/SSL certificates to enable HTTPS.

Code Example

python
import requests

# Making a simple GET request to an HTTPS endpoint
# As a backend developer, you'll often interact with other APIs over HTTPS.

try:
    response = requests.get("https://api.github.com/users/octocat")
    response.raise_for_status() # Raise an exception for HTTP errors (4xx or 5xx)
    print(f"Status Code: {response.status_code}")
    print(f"Content Type: {response.headers['Content-Type']}")
    print("Response JSON (first 100 chars):", str(response.json())[:100], "...")
except requests.exceptions.RequestException as e:
    print(f"An error occurred: {e}")

How this code works

This Python code demonstrates how a backend application securely retrieves data from an external API using HTTPS, a common task for integrating services. It begins by importing the requests library, a powerful tool for making HTTP requests. The core action is requests.get("https://api.github.com/users/octocat"), which sends a GET request to a specific GitHub API endpoint. The inclusion of "https://" in the URL is critical, signifying that the data transmission is encrypted using TLS, ensuring privacy and integrity in transit.

After making the request, response.raise_for_status() is called. This is a crucial step: it automatically checks the HTTP status code and will raise an error if the request was not successful (e.g., a 4xx client error or 5xx server error). This elegantly prevents proceeding with invalid responses. If successful, the code proceeds to print details like the response.status_code, the Content-Type header, and the first 100 characters of the response.json() payload. The entire process is wrapped in a try...except requests.exceptions.RequestException as e: block, which ensures that any issues during the request or response handling, such as network problems or DNS lookup failures, are caught and reported gracefully without crashing the program.

Resources

Related Articles

Hand-picked reads to go deeper on http & networking basics.

Back to Backend Developer Roadmap