🔒
Pro Content
Subscribe to access all 69 OCR H446 A Level lessons.
£7.99/month
or £59/year
Subscribe now →
🔒 Pro · Component 1 · 1.3.5 TCP/IP Suite
1.3.5b Application Layer: HTTP, HTTPS, FTP, SMTP & IMAP
OCR H446 · A Level Computer Science · ~13 min read
Notes
Video
Slides
Worksheet
Quiz

HTTP and HTTPS

HTTP (Hypertext Transfer Protocol) is the foundation of data communication on the World Wide Web. It defines how clients (browsers) request resources and how servers respond.

  • Port 80 — unencrypted
  • Stateless protocol — each request is independent; no memory of previous requests
  • Request methods: GET (retrieve), POST (send data), PUT (update), DELETE (remove)
  • HTTP status codes: 200 OK, 404 Not Found, 301 Redirect, 500 Server Error

HTTPS (HTTP Secure) = HTTP + TLS (Transport Layer Security):

  • Port 443 — encrypted
  • Provides confidentiality (encryption), authentication (certificates) and integrity (MAC)
  • TLS handshake establishes a shared session key using asymmetric encryption; data then encrypted with symmetric key (AES)
  • All modern websites should use HTTPS — browsers display a padlock icon
HTTPHTTPS
Port80443
EncryptionNoneTLS (symmetric session key)
AuthenticationNoneDigital certificate (CA-signed)
Use caseStatic public content (deprecated)All modern web traffic

FTP — File Transfer Protocol

FTP is used to transfer files between a client and a server. It uses two separate connections:

  • Port 21 — control connection: commands (login credentials, LIST, RETR, STOR)
  • Port 20 — data connection: actual file transfer

FTP transmits data in plaintext — login credentials are visible. SFTP (SSH File Transfer Protocol, port 22) and FTPS (FTP over TLS) add encryption. For the exam, know that standard FTP is unencrypted.

Active vs Passive mode: In active mode, the server initiates the data connection back to the client — this is often blocked by firewalls. In passive mode, the client initiates both connections — friendlier for firewalls/NAT.

Email Protocols: SMTP, POP3, and IMAP

Three separate protocols handle email — one for sending and two for receiving:

ProtocolPortPurposeKey behaviour
SMTP25 (or 587 with auth)Sending email — from client to mail server, and between mail serversPush protocol — messages pushed from sender to server
POP3110Receiving email — downloads to local deviceDownloads and (by default) deletes from server. Email exists only on client. Simple but not multi-device friendly.
IMAP143Receiving email — synced with serverEmail stored on server; client shows a synced view. Supports multiple devices. Folder structure, read status all synced.

SMTP in more detail

SMTP (Simple Mail Transfer Protocol) is responsible for all outbound email delivery. When you send an email:

  1. Your email client sends the message via SMTP to your outgoing mail server (port 25 or 587).
  2. Your mail server uses DNS (MX records) to find the recipient's mail server.
  3. Your server connects via SMTP (port 25) to the recipient's mail server and delivers the message.
  4. The recipient's mail client retrieves the email using POP3 or IMAP.

POP3 vs IMAP

POP3IMAP
StorageDownloads to client, deletes from serverStored on server; client shows synchronised view
Multi-devicePoor — only available on one deviceExcellent — all devices see same emails
OfflineWorks offline (email downloaded)Requires connection to view (unless cached)
Server storageLow (deleted after download)Higher (all emails stored server-side)
Use caseSingle device, low server storageMulti-device (phone + laptop + webmail)

How HTTP Works: Request-Response Model

HTTP follows a simple request-response cycle:

  1. DNS lookup: browser resolves the domain to an IP address.
  2. TCP connection: TCP three-way handshake to the web server (port 80 or 443).
  3. HTTP GET request: browser sends GET /index.html HTTP/1.1 to the server.
  4. HTTP response: server sends status code (200 OK) + the HTML content.
  5. Render: browser parses HTML; further GET requests fetch CSS, JS, images.

HTTP/1.1 keeps the connection open (persistent) for multiple requests. HTTP/2 and HTTP/3 add multiplexing (many requests simultaneously on one connection).

Exam tip: Know which protocol does what. SMTP = sending email. IMAP/POP3 = receiving email. IMAP is better for multiple devices (server-based). POP3 downloads to one device. FTP transfers files (ports 20/21). HTTP/HTTPS loads web pages (ports 80/443).
Exam tip: A common exam question is: "A student uses webmail on their phone and laptop. Explain why IMAP is more suitable than POP3." Answer: IMAP stores emails on the server and synchronises all devices — emails read on the phone are also marked read on the laptop. POP3 downloads emails to one device and deletes from server, so they wouldn't appear on the other device.
⚠ Common Mistakes
  • Saying SMTP is used to receive email — SMTP is only for sending. Receiving uses POP3 or IMAP.
  • Confusing FTP ports — port 21 = control channel (commands), port 20 = data channel (file transfer). Both are needed for active FTP.
  • Saying HTTP and HTTPS are completely different protocols — HTTPS = HTTP + TLS. The application layer protocol is the same; TLS wraps it with encryption.
✓ Notes completed!
▶
Video coming soon
Click to advance · Arrow keys also work
Click slide or press arrow keys to navigate
✍

Worksheet — 1.3.5b Application Layer Protocols

8 questions · 20 marks · instantly marked

Q1Explain the difference between HTTP and HTTPS. Why is HTTPS preferred for modern websites?[4 marks]
✓ Mark scheme
HTTP (port 80) transmits data in plaintext — no encryption [1]; HTTPS (port 443) = HTTP + TLS encryption [1]. HTTPS provides: confidentiality (data encrypted — cannot be read by eavesdroppers) [1]; authentication (digital certificates verify the server's identity); integrity (MAC detects tampering). Preferred because without it, login credentials, credit card details and personal data are transmitted in plaintext and can be intercepted [1].
Q2A student accesses their email on both a smartphone and a laptop. Explain why IMAP is more suitable than POP3 in this scenario.[4 marks]
✓ Mark scheme
IMAP stores emails on the mail server and provides a synchronised view to all client devices [1]; emails read on the smartphone will also appear as read on the laptop (and vice versa) [1]; any sent, deleted or moved emails are reflected on all devices [1]. POP3 would download emails to one device and (by default) delete from the server — the email would not appear on the second device; it is not multi-device friendly [1].
Q3What is the role of SMTP? Outline the steps involved in sending an email from one domain to another (e.g. from alice@gmail.com to bob@yahoo.com).[4 marks]
✓ Mark scheme
SMTP (Simple Mail Transfer Protocol) is used to send/transfer email — it is a push protocol [1]. Steps: Alice's email client sends the email via SMTP to Google's outgoing mail server [1]; Google's server performs a DNS lookup for Yahoo's MX record to find Yahoo's incoming mail server address [1]; Google's server connects via SMTP to Yahoo's mail server (port 25) and delivers the email; Bob retrieves the email using POP3 or IMAP [1].
Q4Describe how FTP transfers files. Why is standard FTP considered insecure?[3 marks]
✓ Mark scheme
FTP uses two connections: a control channel on port 21 for commands (login, list files, request transfer) and a data channel on port 20 for actual file transfer [1]. It transmits data including login credentials in plaintext — an attacker performing packet sniffing could read the username and password [1]. Secure alternatives include SFTP (SSH File Transfer Protocol using port 22) or FTPS (FTP over TLS/SSL) which encrypt the connection [1].
Q5Describe the request-response cycle of HTTP when a user loads a webpage.[3 marks]
✓ Mark scheme
Browser performs a DNS lookup to get the server's IP address; establishes a TCP connection (three-way handshake) [1]; browser sends an HTTP GET request for the resource (e.g. GET /index.html HTTP/1.1 with host header) [1]; server responds with a status code (200 OK) and the requested HTML content; browser parses the HTML and makes further HTTP requests for linked CSS, JavaScript and image files [1].
Q6State the port numbers associated with: (a) FTP control, (b) FTP data, (c) SMTP, (d) IMAP, (e) POP3.[3 marks]
✓ Mark scheme
FTP control = port 21 [1]; FTP data = port 20 [0.5]; SMTP = port 25 [0.5]; IMAP = port 143 [0.5]; POP3 = port 110 [0.5]. (Award 1 mark for each correct pair up to 3 marks.)
Q7What is a stateless protocol? Give an example and explain one consequence of HTTP being stateless.[3 marks]
✓ Mark scheme
A stateless protocol treats each request independently — the server retains no memory of previous requests from the same client [1]. HTTP is stateless [1]. Consequence: HTTP cannot inherently maintain session state — websites must use additional mechanisms such as cookies, session tokens, or server-side sessions to track logged-in users or shopping basket contents [1].
Q8Suggest why POP3 might still be appropriate for a user who wants to access email without a constant internet connection.[2 marks]
✓ Mark scheme
POP3 downloads all emails to the local device and (by default) deletes them from the server [1]; the user can then read, reply and manage emails offline without needing an internet connection. The downloaded emails are permanently stored locally, so no internet access is required after download [1].
Topic Quiz
1 of 15
You scored
out of 15
🎯

Mini Test — 1.3.5b Application Protocols

  • 10 questions · 10 marks · 10 minutes
  • 5 MCQ + 5 short answer
Card 1 of 15
Click to reveal
🎉
Complete!
TermDefinition
← 1.3.5a TCP/IP Suite 1.3.5 TCP/IP Suite Next: 1.3.5c Transport, Network & Link Layers →