The HTTP protocol, as its full name implies (Hypertext Transfer Protocol), has been designed for clients to access resources in web servers. However, over the years it has gained popularity also in other areas, such as service oriented architectures, remote procedure calls, and REST Application Programming Interfaces (APIs).

The HTTP does not natively support confidentiality and authentication, which are key in virtually all use cases of practical interest in any domain. However, these features can be enabled by intermediate layers such as the Secure Socket Layers (SSL, now obsolete) and Transport Layer Security (TLS), which we all use every day when accessing a website starting with “”https”” rather than the good old prefix “”http””. The HTTP is a layer 5 (a.k.a. session) protocol and it uses underneath TCP as a transport layer, e.g., for guaranteed delivery, flow control, and congestion avoidance.

The combined use of TCP and TLS makes the HTTP rather cumbersome on the uptake: before the first byte can be transferred from the client to the server, there are quite a few exchanges that must occur, each requiring a Round Trip Trip (RTT), which is the time it takes for a message to go from a client to the server and back to the client. When we are browsing the web, we usually do not notice such an additional delay, because it is much smaller than the time it takes to load the page, which possibly includes a lot of heavy images and videos.