Networks and Cyber Security · Semester 2

The Web and Client-Server Model

Analyzing how browsers interact with servers using HTTP/HTTPS and the role of DNS.

About This Topic

The Web and Client-Server Model details how browsers act as clients to request resources from servers using HTTP or HTTPS protocols, with DNS resolving domain names to IP addresses. Students trace the process: a user enters a URL, DNS queries propagate through root, TLD, and authoritative servers, the browser sends a request with headers, and the server responds with status codes, content, and possibly cookies. This reveals HTTP's stateless design, where servers forget prior requests unless state is managed explicitly.

In the MOE JC1 Networks and Cyber Security unit, the topic examines DNS decentralization for resilience, yet vulnerability to attacks like spoofing. Students compare stateless HTTP to stateful protocols, and study cookies for client-side persistence alongside server-side sessions for secure identity tracking. These elements link web functionality to cyber risks, preparing students for secure coding practices.

Active learning excels with this topic. Students inspecting live network traffic via browser tools or building basic servers experience protocol flows firsthand. Group simulations of DNS resolution and cookie exchanges clarify abstract concepts, while troubleshooting real requests builds debugging skills essential for computing.

Learning Objectives

• Analyze the steps involved in DNS resolution from a client's request to an authoritative server's response.
• Compare and contrast the characteristics of stateless and stateful network protocols in the context of web communication.
• Explain how cookies and server-side sessions are used to maintain user state across multiple HTTP requests.
• Evaluate the security implications of DNS decentralization, identifying potential vulnerabilities and resilience factors.
• Demonstrate the process of a web browser requesting and receiving a resource from a web server using HTTP/HTTPS.

Before You Start

Introduction to Networking Concepts

Why: Students need a foundational understanding of what a network is, including concepts like IP addresses and basic data transmission, before exploring web-specific protocols.

Basic Internet Structure

Why: Familiarity with the idea of servers, clients, and the general flow of information on the internet is necessary to understand the client-server model.

Key Vocabulary

DNS (Domain Name System)	A hierarchical and decentralized naming system for computers, services, or other resources connected to the Internet or a private network. It translates human-readable domain names into machine-readable IP addresses.
HTTP (Hypertext Transfer Protocol)	The foundational protocol of the World Wide Web, used for transmitting hypermedia documents such as HTML. It is a stateless protocol, meaning each request is independent.
HTTPS (Hypertext Transfer Protocol Secure)	An extension of HTTP that encrypts the communication between a client and a server, providing security and privacy for data transmission.
Stateless Protocol	A protocol that treats each request as an independent transaction, without retaining any memory of previous requests from the same client.
Stateful Protocol	A protocol that maintains information about previous interactions with a client, using this context to process subsequent requests.
Cookie	A small piece of data sent from a website and stored on the user's computer by the user's web browser while the user is browsing. It is used to remember stateful information for the user.

Active Learning Ideas

Demo: Network Tab Inspection

Instruct students to open browser developer tools, load a website, and switch to the Network tab. Have them filter for HTTP/HTTPS requests, examine headers, status codes, and response sizes. Groups discuss how DNS precedes the request by pinging the domain first.

⏱ 30 min·Small Groups

Generate mission

Build: Python HTTP Server

Provide code snippet for a simple Python HTTP server using http.server module. Students run it locally, access via browser, and modify responses to include custom headers or cookies. Compare logs on server and client sides to observe stateless behavior.

⏱ 45 min·Pairs

Generate mission

Timeline Challenge: DNS Resolution Trace

Students use command-line tools like nslookup or dig to query a domain's resolution path. Record each step from root servers to IP. Groups map the hierarchy on paper and discuss decentralization benefits and risks.

⏱ 25 min·Individual

Generate mission

Simulation Game: Cookie and Session Flow

Use physical cards for requests/responses; add 'cookies' as sticky notes. Simulate login: first request sets cookie, subsequent ones reference it. Groups role-play server forgetting state without cookies, then add sessions via a shared ledger.

⏱ 35 min·Small Groups

Generate mission

Real-World Connections

Web developers at companies like Google use their understanding of DNS and HTTP to design efficient and secure web applications, ensuring fast loading times and protecting user data.

Network administrators for large organizations, such as banks or universities, configure DNS servers and monitor network traffic to prevent cyberattacks like DNS spoofing and ensure reliable access to online services.

Cybersecurity analysts investigate network intrusions by examining HTTP request logs and analyzing the use of cookies and session data to identify malicious activity and unauthorized access.

Watch Out for These Misconceptions

Common Misconception

HTTP is stateful, remembering previous requests.

What to Teach Instead

HTTP treats each request independently as stateless. Browser dev tool inspections show servers respond without prior context unless cookies provide it. Hands-on request simulations help students observe and correct this by tracking multiple interactions collaboratively.

Common Misconception

DNS relies on a single central server for all lookups.

What to Teach Instead

DNS uses a decentralized hierarchy of servers for resilience. Tracing resolution paths with tools reveals distributed queries. Group mapping activities expose vulnerabilities like spoofing, reinforcing the balance of strengths and risks.

Common Misconception

HTTPS only hides data from eavesdroppers, ignoring identity.

What to Teach Instead

HTTPS uses certificates for server authentication via PKI. Packet captures in activities distinguish plain HTTP risks from HTTPS protections. Peer reviews of captured traffic clarify authentication's role in preventing man-in-the-middle attacks.

Assessment Ideas

Quick Check

Present students with a scenario: 'A user types www.example.com into their browser.' Ask them to list the first three distinct network requests that occur and identify the protocol used for each. This checks their understanding of the initial steps in web browsing.

Discussion Prompt

Pose the question: 'Imagine a website uses cookies to remember your login. If a hacker steals your cookie, what is the immediate security risk, and how does this relate to the stateless nature of HTTP?' Facilitate a discussion on session hijacking and state management.

Exit Ticket

Provide students with two terms: 'DNS' and 'HTTP'. Ask them to write one sentence explaining the primary function of each and one sentence describing how they work together to load a webpage. This assesses their grasp of core concepts and their interrelation.

Frequently Asked Questions

How does DNS contribute to web resilience and vulnerability?

DNS decentralization distributes authority across root, TLD, and authoritative servers, ensuring no single failure halts the web. This resilience supports global scale, but vulnerabilities like cache poisoning or DDoS arise from reliance on unverified responses. Students grasp this through tracing real queries, linking to cyber security defenses like DNSSEC.

What distinguishes stateful from stateless protocols in web communication?

Stateless protocols like HTTP process each request without context, requiring cookies or sessions for continuity. Stateful ones maintain connection data across requests. Classroom demos of repeated browser fetches without persistence highlight stateless efficiency for scalability, while sessions show state management for user experiences.

How do cookies and sessions handle user identity on the web?

Cookies store small data on clients for quick identity recall, like login tokens. Sessions use server-side storage keyed by cookies for sensitive data. Activities simulating flows demonstrate stateless HTTP's need for these, emphasizing security practices like HttpOnly flags to prevent XSS theft.

How can active learning help teach the client-server model?

Active approaches like live Wireshark captures or Python server builds let students witness request-response cycles in real time. Collaborative protocol dissections reveal headers and stateless quirks missed in lectures. Troubleshooting group simulations build resilience against errors, deepening grasp of DNS and security implications for JC1 cyber topics.