CS103 · The Web: HTTP, Networks & Browsers
Learning materials — twelve chapters, each with a cited reading, a worked example and a 20-mark problem set. Examination paper — 2 h 30 · 100 marks · grade descriptors · every question mapped to a chapter.
Credits 4 · Hours 40 · Prereqs CS101 · Semester 1
Source course
Section titled “Source course”Stanford CS142 — Web Applications (Mendel Rosenblum). Lectures: https://web.stanford.edu/class/cs142/lectures.html Info: https://web.stanford.edu/class/cs142/info.html
CS142 assigns no textbook: “course content is defined by lectures”, with MDN as the recommended reference. Its lecture list (verbatim order): Intro, HTML, CSS, URLs, JavaScript Basics, JavaScript Programming/New Features, FrontEnd, ReactJS, RWD, WebApps, HTTP, WebServers, WebAppSecurity, NetworkAttacks/SessionAttacks, Code Injection/Phishing/DOS, LargeScaleWebApps, Datacenters, FutureWebAppTech.
Gap, stated plainly: DNS and TLS are not standalone lectures — DNS appears
inside “URLs”, TLS inside “WebAppSecurity”. Caching is inside the HTTP deck
(https://web.stanford.edu/class/cs142/lectures/HTTP.pdf), which does cover
Cache-Control: max-age, status codes and keep-alive. The gap is filled from
High Performance Browser Networking (below), which is free and has the DNS and
TLS chapters this course omits.
Objectives
Section titled “Objectives”- Trace a request end to end and name the log line proving each hop.
- Use
curlas the primary instrument, cookies and CSRF included. - Tell 401/403/404/422 apart in a system with three auth mechanisms.
- Know what a CDN may and may not cache.
Weekly map
Section titled “Weekly map”| Wk | CS142 lecture | Topic |
|---|---|---|
| 1 | URLs | scheme, host, path, query; URL resolution; where DNS enters |
| 2 | HTML, CSS | document structure, the cascade, box model |
| 3 | JavaScript Basics / New Features | scope, closures, this, modules, async/await |
| 4 | FrontEnd | DOM, events, fetch |
| 5 | HTTP (deck) | methods, headers, cookies, status semantics |
| 6 | HTTP (deck) + HPBN ch. 11–13 | Cache-Control, Vary, s-maxage, HTTP/2, CDN behaviour |
| 7 | HPBN ch. 2, 4 | DNS resolution, TLS handshake — the CS142 gap |
| 8 | — | sessions, CSRF, same-origin, CORS |
| 9 | WebServers | nginx as reverse proxy; FTM’s routing |
| 10 | WebAppSecurity, SessionAttacks | auth boundaries, injection, phishing, XSS |
| 11 | LargeScaleWebApps, Datacenters | caching tiers, ISR, purge |
| 12 | — | Reading week |
FTM labs
Section titled “FTM labs”- L1
curla staging endpoint four ways — anonymous, session cookie, hashed token, wrong scope — and explain each status code. - L2 capture one dashboard Unpoly interaction in DevTools; write the full request/response chain including the Unpoly header.
- L3 trace a
staging.fixthemusic.comrequest across nginx → Next.js → Django, naming the proof at each hop.
Project
Section titled “Project”One-page static client for a read-only FTM API endpoint. Correct caching headers, error states, no framework.
Reading list
Section titled “Reading list”| Book | Author, year | Use | Free |
|---|---|---|---|
| High Performance Browser Networking | Ilya Grigorik, 2013 | The DNS/TLS/caching depth CS142 leaves open — ch. 2, 4, 11–13; hpbn.co | Yes |
| Eloquent JavaScript, 3rd ed. | Marijn Haverbeke, 2018 | Modern JS with in-browser exercises; the one JS book CS142 marks free | Yes |
| Web Browser Engineering | Panchekha & Harrelson, 2024 | Builds a browser in ~2k lines of Python: URLs/HTTP, DOM, cookies, CSRF; browser.engineering | Yes |
| HTTP: The Definitive Guide | Gourley & Totty, 2002 | Desk reference for headers, caching, proxies. Dated on HTTP/2 | No |
| JavaScript: The Definitive Guide, 7th ed. | David Flanagan, 2020 | Lookup, not reading | No |
Assessment
Section titled “Assessment”Coursework 45% (L1–L3) · Project 35% · Check-off viva 10% · Exam 10%.