Is HTTPS Stateful or Stateless?

Question

I want a bit of clarity on whether HTTPS is stateful or stateless? This is with regards to a RESTful API I built. We were initially using HTTP. Since HTTP essentially works over TCP/IP which is stateless hence HTTP is stateless, but when I switched to HTTPS my API became stateful. I wanted to know whether my conclusion that HTTPS is stateful. is correct or not? I created my API using a middleware tool called webMethods. Thanks

Circumlunar

https is stateless just like http. – Archenteron

What do you mean "it became stateful?" You need to explain what that means to you. – Germinate

blog.wimtenbrink.nl/2017/12/29/how-ssl-is-failing – Raki

Answer 1

TLS/SSL is stateful. The web server and the client (browser) cache the session including the cryptographic keys to improve performance and do not perform key exchange for every request.

HTTP 1 is not stateful. HTTP/2 however defines many stateful components, but the "application layer" still remains stateless.

TL;DR: The transport pipe (TLS) is stateful, original HTTP is not.

Additional note: Cookies and other stateful mechanisms are later additions defined in separate RFC's. They are not part of the original HTTP/1.0 specification, although other stateful mechanisms like caching and HTTP auth are defined HTTP 1.1 RFC and RFC 2617. HTTP 1 is said to be stateless although in practice we use standardized stateful mechanisms. HTTP/2 defines stateful components in its standard and is therefore stateful. A particular HTTP/2 application can use a subset of HTTP/2 features to maintain statelessness.

Theory aside, in practice you use HTTP statefully in your everyday life.

Tim

Answer 2

The S in HTTPS is concerned with the transport, not the protocol. The semantics of the HTTP protocol remain the same for HTTPS. As the article about HTTPS on Wikipedia states,

Strictly speaking, HTTPS is not a separate protocol, but refers to use of ordinary HTTP over an encrypted SSL/TLS connection.

And the HTTP protocol is stateless by design, not because it is used most frequently over TCP/IP (nothing stops you to use HTTP over UDP for example).

Outface

Answer 3

HTTPS is HTTP over a secure connection.

HTTP is a higher level than a connection.

When connecting to a web server, your connection is (maybe always?) of type TCP/IP. So, in case you are visiting a website via HTTPS, your TCP/IP connection is encrypted.

The data the server and/or client send has not been encrypted by the server and/or client. It is just sent, as it is usually via HTTP, but this time using a connection via TCP/IP that is secured via encryption.

If data were vehicles, and the connexion the highway, then: - using HTTP would be like the vehicles going on the highway, and everyone can see them; - using HTTPS would be like the same, but the vehicles go through a tunnel or anything that prevents people not on the highway from seeing them. You can determine there is trafic, but you cannot identify the vehicles, except on both ends of the tunnel.

I believe this is an image close to what happens behind the scene. But I'm no expert. I just hope it helps.

Adulation

Answer 4

I believe HTTPS is a stateful protocol as it contains Session identifier field.This generated by server initially to identify a session with the chosen client.

Biped

Please provide links in your answer. Statefulness is a highly discussed topic, and links are aplenty. – Sheba

After reading the most upvoted answer, I still remain with doubt. Although I know I am wrong, in my mind it makes perfect sense that HTTPS is stateful, since client/server establish a connection, change keys and then initiate the data transfer... What am I missing? – Heresy

Answer 5

HTTP and HTTPS both are stateless protocols. The S in HTTPS stands for Secure and it refers to use of ordinary HTTP over an encrypted SSL/TLS connection.

Use of JWT tokens or the traditional way of establishing sessions using cookies help us to overcome the problem of HTTP being a stateless protocol, as it enables the server to authenticate the identity of the client, so that you don't need to login every time you click a link to navigate on the web-page.

So For example, when you log in to the website of your bank, it only asks you to enter your login details once. Once you are signed in, you don't need to re-enter them when you navigate to the account settings page, this is because the bank site is able to authenticate your identity using JWT tokens.

JWT tokens are only used on HTTPS and not in HTTP, because the connection is encrypted in HTTPS, so it cannot be intercepted by anyone.

Thus, HTTP and HTTPS both are stateless protocols, but JWT Tokens provides a workaround for it.

Stonemason