Status codes and cookies

Every HTTP response starts with a three-digit status code. The first digit gives the family: 2xx it worked, 3xx look somewhere else, 4xx the request was wrong (the client's fault), 5xx the server failed (the server's fault).

The ones you'll meet most: 200 OK. 201 Created. 301 Moved Permanently and 302 Found, redirects to a new address given in the Location header. 304 Not Modified: "the copy you have is still fine". 400 Bad Request. 401 Unauthorized: you need to log in. 403 Forbidden: logged in or not, you're not allowed. 404 Not Found. 429 Too Many Requests: slow down. 500 Internal Server Error. 502 Bad Gateway and 503 Service Unavailable: a server in the middle couldn't reach the one behind it, or it's overloaded.

HTTP is stateless: each request stands on its own, and the server doesn't remember the last one. To keep you logged in, or remember what's in a basket, sites use cookies. The server sends a Set-Cookie header with a small piece of data, and the browser sends it back in a Cookie header with every later request to that site.

HTTP/1.1 200 OK
Set-Cookie: session=8f2c41; Secure; HttpOnly; SameSite=Lax

(next request)
GET /basket HTTP/1.1
Cookie: session=8f2c41

Cookie flags matter for safety. Secure sends it only over HTTPS. HttpOnly hides it from the page's scripts, so a malicious script can't read a login cookie. SameSite stops other sites' pages from sending it along with their requests. Websites also use local storage in the browser, which stays on your device and isn't sent with requests at all (that's how this site saves your progress).