Week 9: HTTP Internals (Days 61–67)

Phase: 3 — L7 Networking + WAF + API Security Goal: Move from raw TCP to the application layer. Build an HTTP/1.1 parser from scratch, understand why HTTP request smuggling works, configure a hardened reverse proxy, and implement WebSocket from the wire up.

Background in this wiki: TCP/IP guide Ch 28 (rawhttp), Ch 39 (HTTP framing), Ch 43 (WebSockets and SSE); HTTPS guide Ch 19 (production server and Slowloris), Ch 20 (reverse proxy, X-Forwarded-For, smuggling), Ch 24 (streaming).