Interview Prep

Appearance

Web basics & HTTP/REST — cheat sheet ​

Mandatory. Source: roadmap.md sections "How does the web work?" and "HTTP/REST".

How the web works ​

  • Opening a website: browser resolves the domain to an IP via DNS, opens a TCP connection to that IP on the right port (443 for HTTPS), does a TLS handshake, sends an HTTP request, gets back HTML, then parses it and fires off more requests for CSS/JS/images, then renders the page.
  • Frontend vs backend: frontend runs in the browser (UI/UX, HTML/CSS/JS); backend runs on the server (business logic, data, auth) and talks to the frontend over HTTP.
  • HTML/CSS/JS: HTML = structure/content, CSS = styling/layout, JS = behavior/interactivity.
  • URL: address of a resource — scheme, host, port, path, query string, fragment.
  • IP address: numeric identifier for a device on a network.
  • localhost / 127.0.0.1: loopback address, always refers to your own machine.
  • Local (LAN) vs global (WAN) IP: LAN IP (e.g. 192.168.x.x) is only reachable inside your local network, assigned by your router; WAN/global IP is what the internet sees, assigned by your ISP.
  • IPv4 vs IPv6: IPv4 is 32-bit (~4.3B addresses, dotted decimal); IPv6 is 128-bit (a vastly bigger address space, hex/colon notation), created because IPv4 ran out.
  • Port: a number (0-65535) identifying a specific service on a device, so one IP can run many services (80 = HTTP, 443 = HTTPS, 5432 = Postgres, ...).
  • DNS: translates human-readable domain names into IP addresses.

HTTP/REST ​

  • Network protocol: an agreed-upon set of rules for how data is formatted and exchanged between systems.
  • HTTP: HyperText Transfer Protocol, the application-layer protocol the web is built on — request/response based, stateless.
  • Request/response structure: a request/status line, headers, and an (optional) body.
    • Verbs: GET (read), POST (create), PUT (replace/update), PATCH (partial update), DELETE (remove); also HEAD, OPTIONS.
    • Common headers: Content-Type, Authorization, Accept, Cache-Control, Cookie.
    • Body: the payload, usually JSON representing a resource (request) or the result (response). GET/DELETE typically have no body.
  • JSON: lightweight text-based data format.
    • Types: string, number, boolean, null, object, array.
    • Arrays use [ ], objects/dicts use { "key": value }.
    • Dates: no native date type, usually ISO 8601 strings ("2026-09-07T10:00:00Z").
    • Serialization = turning an object into JSON/text; deserialization = the reverse, turning JSON back into an object.
  • curl vs Postman: curl is a command-line HTTP client; Postman is a GUI app for building, testing, and organizing HTTP requests/collections. Same underlying job.
  • (REST) API: an interface a server exposes so other programs can interact with it, usually over HTTP with JSON.
    • REST: an architectural style — resources identified by URLs, standard HTTP verbs to act on them, stateless requests, representations (usually JSON) exchanged.
  • CORS: a browser-enforced security rule blocking a page from calling a different origin (scheme+host+port) than the one that served it, unless the target server opts in.
    • The server decides, via response headers (Access-Control-Allow-Origin, etc.).
    • CORS headers appear on both the (preflight) request and the response, but it's the response header that grants permission.
    • You find out it's enabled by checking those response headers / the browser console.
    • It does not apply to curl/Postman/server-to-server Java calls — CORS is enforced by browsers to protect end users, not a rule the HTTP protocol itself enforces.
    • Workaround for calling an API without CORS from your own frontend: proxy the request through your own backend (server-to-server has no CORS restriction).
  • SPA vs SSR:
    • SPA (Single Page Application): loads once, JS updates the DOM without full reloads. Pro: fast/app-like after initial load. Con: slower first load, harder SEO, needs JS.
    • SSR (Server-Side Rendering): server renders full HTML per request. Pro: fast first paint, SEO-friendly by default. Con: more server load, full/partial reloads.
    • Building an SPA is mostly frontend work (it still talks to a backend API).
    • Popular SPA frameworks: React, Vue, Angular — all JavaScript/TypeScript.
  • TLS/SSL: cryptographic protocols that encrypt traffic between client and server; HTTPS is HTTP running over TLS. Provides encryption, integrity, and server identity.