You type `https://google.com` and hit Enter. Less than a second later, a page appears. That feels like magic — but it's actually a precisely choreographed sequence of about a dozen distinct operations happening in your OS, your browser, across global infrastructure, and back. Let's pull it apart, layer by layer. ## Step 1 — URL Parsing Before anything hits the network, your browser reads what you typed and figures out what kind of request it is. It breaks the URL into parts: ``` https://www.google.com/search?q=hello#results │ │ │ │ │ scheme hostname path query fragment ``` - **Scheme** (`https`) — which protocol to use - **Hostname** (`www.google.com`) — who to talk to - **Path** (`/search`) — which resource to request - **Query** (`?q=hello`) — parameters passed to the server - **Fragment** (`#results`) — handled entirely in the browser, never sent to the server If you typed something without a scheme (like just `google.com`), the browser prepends `https://` automatically. If it looks like a search query instead of a URL, it routes it to your default search engine instead. ## Step 2 — HSTS Check Before making any network request, the browser checks its internal **HSTS (HTTP Strict Transport Security) preload list**. This is a hardcoded list of domains that must always be contacted over HTTPS — even if you typed `http://`. Major sites like Google, Facebook, and GitHub are on this list. If the domain is present, the browser upgrades the request to HTTPS before a single packet leaves your machine. This blocks a class of attack called SSL stripping, where a man-in-the-middle downgrades your connection to plain HTTP. ``` Browser checks: is "google.com" in the HSTS list? → Yes: force HTTPS, proceed → No: use whatever scheme was in the URL ``` ## Step 3 — DNS Resolution The browser knows the hostname (`www.google.com`) but the internet routes by IP address, not names. DNS (Domain Name System) is the phonebook th