OAuth 2.0 Grant Types: Authorization Code, Client Credentials, JWT

Web communication follows a client-server model where browsers send requests to servers, which respond with content. HTTP responses include status codes: 200 (OK), 301 (Moved Permanently), 404 (Not Found), 401/403 (Unauthorized/Forbidden), 500 (Server Error). Responses include headers specifying content type (text/html, image/jpeg). When servers return 301 responses, they include Location headers specifying new URLs, and browsers automatically follow redirects. This is commonly used for redirecting from HTTP to HTTPS or from non-www to www versions.

HTTP defines the request-response cycle between client and server. Requests include method (GET, POST, PUT, PATCH, DELETE), URL, HTTP version, host, and authentication headers. Responses include HTTP version, status code (200 OK, 400 Bad Request, 401 Unauthorized, 404 Not Found, 500 Server Error), content type, and other headers. Status codes indicate success, client errors, or server errors.

HTTP (Hypertext Transfer Protocol) is a request-response cycle protocol enabling client-server communication. A protocol is a set of rules defining communication sequences. HTTP requests consist of three parts: Request Line (method and URL), Request Headers (metadata like Content-Type, Authorization, Accept), and Request Body (data for PUT, POST, DELETE methods). HTTP defines nine methods: GET (retrieve), PUT (modify), POST (create), DELETE (remove), and others like OPTIONS for browser capabilities. HTTP responses include Status Line (version and status code), Response Headers (Content-Type, Set-Cookie, Cache-Control), and Response Body (data or error details). Status codes are categorized: 2xx (Success - 200, 201, 204), 3xx (Redirection - 301), 4xx (Client Error - 400, 404), and 5xx (Server Error - 500, 503).

HTTP communication relies on standardized request and response messages. A request contains: HTTP version (indicating protocol capabilities), URL (absolute or partial with Host header), HTTP method (GET, POST, PUT, DELETE, HEAD, OPTIONS), request headers (browser info, accepted formats, authentication), and optional body (for POST/PUT). A response includes: status line (protocol version, 3-digit status code, human-readable text), response headers (content type, encoding, length), and optional body. Status codes categorize outcomes: 1xx informational, 2xx success, 3xx redirect, 4xx client error, 5xx server error.

HTTP communication follows a request-response cycle where clients send requests and servers respond. Requests include method, URL, headers, and body. Responses include status line, headers, and body. Status codes indicate results: 200 (success), 404 (not found), 500 (server error). Headers provide metadata like content type and length. This cycle enables all web interactions from loading pages to submitting forms.

RESTful APIs are web-based interfaces enabling communication between client applications and databases. The architecture consists of three components: client applications (built with frameworks like React, Angular), a RESTful server application acting as intermediary, and databases (MySQL, MongoDB, SQL Server). RESTful APIs use HTTP protocol and expose CRUD operations through standardized HTTP methods (POST, GET, PUT, DELETE). Postman enables API testing without complete client applications. An API (Application Programming Interface) provides abstraction layers for software interoperability, creating services across domains like entertainment, finance, e-commerce, and communication. APIs enable cross-platform communication between diverse clients while maintaining technology independence between clients and databases.

RESTful APIs are built on layered software architecture where the back-end handles data processing and business logic. The Service layer implements business rules, while the Repository layer abstracts database interactions. Controllers serve as intermediaries between external requests and internal services, using HTTP methods (GET, POST, PUT, DELETE) to represent operations. URL paths identify resources with query parameters for filtering. Controllers use annotations like @GetMapping to define endpoints. HTTP status codes indicate request outcomes, with 200 (OK) representing success. REST APIs typically return data in JSON format, a lightweight text-based format widely supported across programming languages. This architecture enables clean separation of concerns, making systems maintainable and testable.

REST APIs enable different applications (web, mobile, desktop) to communicate with a central server by defining specific routes. The client-server model forms the foundation: servers listen for requests and respond with data, while databases store persistent information. REST APIs use HTTP methods (GET for retrieving data, POST for creating, PUT for updating, DELETE for removing) combined with specific routes to perform CRUD operations. This architecture allows applications to share data seamlessly, enabling mobile apps to access the same data as web applications.

REST (Representational State Transfer) is a convention for building HTTP services using standard HTTP methods for CRUD operations. The client-server architecture separates front-end and back-end, communicating via HTTP. RESTful endpoints follow a predictable structure: [HTTP]://[domain]/[api]/[resource]. Standard HTTP methods map to operations: GET retrieves data, POST creates new resources, PUT updates existing ones, and DELETE removes them. Resources are accessed as collections (plural) or individual items (singular with ID in URL). This standardized approach enables predictable API design and interoperability between different systems.

REST (Representational State Transfer) is a specification defining rules for client-server communication. Resources are entities clients need from servers, identified by endpoints (URLs). HTTP methods (GET, POST, PUT, PATCH, DELETE) indicate actions: GET retrieves resources, POST creates new ones, PUT updates entire resources, PATCH updates specific parts, and DELETE removes resources. URI parameters identify specific resources in URL paths, while query parameters provide optional filtering and sorting. POST and PUT require request bodies (payloads) containing data, typically in JSON format. Headers carry metadata including authentication tokens and content types. HTTP status codes (100-599) indicate outcomes: 200s indicate success, 400s indicate client errors, 500s indicate server errors. Common codes include 200 OK, 201 Created, 400 Bad Request, 401 Unauthorized, 404 Not Found, and 500 Internal Server Error.

Cryptography is a security mechanism that uses mathematical algorithms to transform readable information (plaintext) into unreadable data (ciphertext) to ensure confidentiality, integrity, and authenticity of information, while digital signature is an electronic mark that authenticates user identity and guarantees document integrity and non-repudiation, typically stored on a secure token or smart card.

Digital signatures are mathematical techniques that provide authenticity, integrity, and non-repudiation for digital documents. They function similarly to handwritten signatures but offer greater security. Cryptography, derived from the Greek word for 'hidden,' is the practice of encrypting information to provide confidentiality, integrity, and accuracy. The fundamental processes include encryption (converting plain text to cipher text) and decryption (reversing this process). These concepts form the foundation for secure digital communication and are essential for understanding how digital signatures work in practice.

Digital signatures use asymmetric cryptography to provide message integrity, sender authentication, and non-repudiation by signing a hash of the message with the sender's private key, which can be verified using the corresponding public key; in web applications, this is implemented by having the client sign form data with their private key and the server verify the signature using the public key, with the signature format typically being PKCS7 containing both the signature and the public key.

Digital signatures are cryptographic values calculated from data and a secret key known only by the signer. Cryptography converts readable messages into unreadable forms, ensuring secure communication. In the physical world, handwritten signatures authenticate documents, but in the cyber world, digital signatures are required. They bind a person or entity to digital data, ensuring information remains secret against hackers. This binding can be independently verified by receivers and any third party who needs to access the data.

This section explains digital signatures and certificates for authentication. Digital signatures work by having the sender encrypt a document's hash with their private key; recipients decrypt with the sender's public key and compare hashes to verify authenticity and detect tampering. Digital certificates, issued by trusted Certificate Authorities like Let's Encrypt, enable browsers to verify server identities through trusted chains. When connecting to a website, the server presents its certificate, and the browser checks if the issuing CA is trusted. This establishes trust without pre-shared secrets, enabling secure web communications through standardized authentication mechanisms.