CodeParkThe browser finds the server's IP address, opens a secure connection, sends a GET request, and then renders the response. Here are the steps in order.
1. Check the URL. The browser parses the URL. It checks if it already has a cached response. It also checks for an HSTS rule. HSTS (HTTP Strict Transport Security) is a rule that tells the browser to always use HTTPS for this site.
2. DNS lookup. DNS turns the name example.com into an IP address. The browser looks in these places, in order:
- the browser cache
- the operating system (OS) cache
- a recursive resolver, which asks the root servers, then the TLD servers (for
.com), then the site's authoritative servers
3. Open a connection. The browser opens a TCP connection to port 443 with the three-way handshake. With HTTP/3, it uses QUIC over UDP instead of TCP.
4. TLS handshake. This step makes the connection secure:
- The server presents its certificate.
- The browser checks that the certificate is valid.
- Both sides create shared session keys for encryption.
- ALPN (Application-Layer Protocol Negotiation) picks HTTP/2 or HTTP/1.1.
5. Send the request. The browser sends GET /products with headers such as Host, Accept and cookies. The request may pass through a CDN, a load balancer or a reverse proxy before it reaches the app.
6. Get the response. The app returns a status, headers and a body.
7. Render. The browser parses the HTML. It fetches the CSS, JS and images. Then it renders the page.
- DNS resolution turns the hostname into an IP address, and there are caches at several levels.
- The browser opens a TCP connection to port 443 with a handshake, or uses QUIC for HTTP/3.
- The TLS handshake validates the certificate, exchanges keys, and uses ALPN to choose the protocol.
- The HTTP request and response may pass through a CDN or proxies.
- The browser parses the HTML and fetches subresources before it renders the page.