Computer ScienceFoundation18 min read

The Internet and the World Wide Web

Two different things, and what actually happens when you type an address

This topic appears in:

O Level Computer Science (2210) · ch.5A Level Computer Science (9618) · ch.2
01

The internet is not the web

The internet is the global network of interconnected networks — the physical and logical infrastructure that carries data between machines. The world wide web is a collection of pages and resources accessed over that infrastructure.

One is the roads; the other is one kind of traffic on them. Email, file transfer, video calls and online games all use the internet without being part of the web at all. Confusing the two is the single most commonly examined distinction in this topic.

TermMeaning
Internetthe global infrastructure of connected networks
World wide webpages and resources accessed over the internet
URLthe address of a resource: protocol, domain, path
HTTP / HTTPSthe protocol carrying web pages; HTTPS is encrypted
DNSthe system translating a domain name into an IP address
Browserthe software that requests, renders and displays pages
ISPthe company providing the connection to the internet
02

What a browser does

A browser does considerably more than display pages. It sends the request, receives the response, interprets the HTML into a structure, applies the CSS, runs the JavaScript, manages the history and bookmarks, and stores cookies.

It also renders the result. The same page can look slightly different in different browsers, because each interprets ambiguous cases in its own way — which is why web developers test in several.

Worked example

Describe what happens between typing a web address and the page appearing.

  1. The browser extracts the domain name from the URL and asks a DNS server for its IP address.The network routes by numeric address, not by name.
  2. The DNS server returns the IP address, or asks another DNS server if it does not know it.DNS is a hierarchy of servers, not a single lookup table.
  3. The browser sends an HTTP request to that IP address asking for the page.
  4. The web server responds with the HTML, and the browser then requests each stylesheet, image and script the page refers to.This is why a page with many images loads in stages.
  5. The browser parses the HTML into a structure, applies the CSS and runs the JavaScript, then renders the result.Only at this point does anything appear on screen.

DNS lookup, HTTP request, server response, further requests for resources, then parsing and rendering.

Why DNS exists

Machines are addressed by IP number, but numbers are impossible to remember and change when a site moves to a different server. DNS lets a memorable name point at whichever address is current, so a site can move servers without anyone needing to learn a new address. It is essentially the internet's phone book.

03

Cookies

A cookie is a small text file a website stores on the visitor's machine, sent back to that site on each subsequent visit. It is how a stateless protocol remembers anything at all.

Session cookies are held in memory and deleted when the browser closes — they keep you logged in as you move between pages of a site. Persistent cookies are stored on disk and survive until they expire, remembering preferences, a shopping basket, or that you have already seen a notice.

The concern is tracking. A cookie set by an advertiser appearing on many different sites can build a picture of the visitor's browsing across all of them, which is why browsers now restrict third-party cookies and why consent notices exist.

A cookie is data, not a program

It is a small text file. It cannot run, cannot access other files, and cannot carry a virus. The genuine concern is privacy — what can be inferred from the record of where you have been — rather than any direct harm to the machine. Answers claiming cookies infect computers are a standing error.

04

HTTP and HTTPS

HTTP carries requests and responses between browser and server as plain text, so anyone positioned between the two can read and alter it. HTTPS is the same protocol with the traffic encrypted, using a digital certificate issued to the site by a trusted authority.

The certificate does two jobs: it supplies the public key used to set up the encryption, and it vouches that the site is who it claims to be. The padlock a browser shows means the connection is encrypted and the certificate is valid — it does not mean the site is honest, only that it is genuinely the site whose name is on the certificate.

Before you leave this chapter

  1. The internet is the infrastructure; the web is one kind of content carried on it.
  2. DNS translates a domain name into an IP address, so sites can move without changing name.
  3. A browser requests, parses, applies CSS, runs JavaScript and renders.
  4. Cookies are text files, not programs — the concern is privacy, not infection.
  5. HTTPS encrypts using a certificate; the padlock proves identity and encryption, not honesty.
05

What the browser receives and what it does with it

The server sends back plain text — HTML, and separately the stylesheets and scripts the page refers to. Everything visible is constructed by the browser from that text, which is why the same page can look slightly different in different browsers.

The HTML is parsed into a tree of elements. The CSS is then applied to that tree, deciding how each part looks. Finally the JavaScript runs, able to change any part of the tree while the page is open. Three separate stages, in that order.

Switch from HTML to CSS to JavaScript. The structure is built first, styled second, and only JavaScript can change anything after the page has loaded.

Why pages load in stages

Each image, stylesheet and script is a separate request to the server. A page with forty images makes forty-one requests in total, and the visible content appears as each response arrives. That is why a page can show its text before its pictures, and why reducing the number of separate files is one of the main ways of making a site load faster.

Practice questions

6 questions · 20 marks · full working on every one

Try each one on paper first, then open the working. The marks are shown where they are actually awarded, because that is where they are actually lost.

Short questions

3 · 6 marks

Two marks each, in the style of the short-question section of the paper. Answer in two or three lines.

SQ1[2 marks]
Explain the difference between the internet and the world wide web.
Model answer

The internet is the global infrastructure of interconnected networks that carries data. The world wide web is a collection of pages and resources accessed over that infrastructure — one of several services using it, alongside email and file transfer.

Examiner tip. Naming another service that uses the internet but is not the web — email is easiest — proves the distinction rather than just asserting it.

SQ2[2 marks]
What is the purpose of DNS?
Model answer

It translates a domain name that people can remember into the IP address the network needs to route data. This also allows a site to move to a different server without its address changing for visitors.

Examiner tip. The second sentence is often the second mark. DNS is not just convenience — it decouples the name from the machine.

SQ3[2 marks]
State two uses of cookies.
Model answer

Keeping a user logged in as they move between pages of a site, and remembering preferences such as language, currency or the contents of a shopping basket.

Examiner tip. Two distinct uses. "Storing information" is too vague to earn either mark.

Solved numericals

2 · 8 marks

Full working, one step per line, with the marks shown where they are awarded.

N1[4 marks]
Describe the sequence of events from entering a URL to a web page being displayed.
Full working
  1. The browser extracts the domain name and requests its IP address from a DNS server[1]
  2. The DNS server returns the IP address, querying other DNS servers if necessary[1]
  3. The browser sends an HTTP request to that address and the server responds with the HTML[1]
  4. The browser requests the further resources the page references, then parses the HTML, applies the CSS and renders the page[1]

DNS lookup → HTTP request → server response → further resource requests → parse and render.

Examiner tip. Four stages, four marks. Naming DNS and HTTP explicitly is what distinguishes this from a vague description of "the computer gets the page".

N2[4 marks]
Explain how HTTPS protects a user entering payment details, and state one thing the padlock does not guarantee.
Full working
  1. The data is encrypted in the browser before it is transmitted[1]
  2. so anyone intercepting it on the network sees only ciphertext and cannot read the card details[1]
  3. A digital certificate issued by a trusted authority supplies the public key and confirms the site's identity[1]
  4. The padlock does not guarantee the site is honest — only that the connection is encrypted and the site is genuinely the one named on the certificatea fraudulent site can hold a valid certificate[1]

Encryption in transit plus a certificate proving identity; the padlock says nothing about the site's honesty.

Examiner tip. The final point matters practically: a phishing site can obtain a valid certificate, so the padlock is not a substitute for checking the address.

Long questions

1 · 6 marks

Theory and numerical together, as they appear in the long-question section.

LQ1[6 marks]
An online shop uses cookies and HTTPS.
  1. Explain the difference between a session cookie and a persistent cookie, with a use for each.
  2. Explain why cookies raise privacy concerns.
  3. Explain why a cookie cannot infect the visitor's computer.
Mark scheme
  1. A session cookie is held in memory and deleted when the browser closes — used to keep the customer logged in while moving between pages[1]
  2. A persistent cookie is stored on disk and survives until it expires — used to remember preferences or a basket between visits[1]
  3. A cookie set by an advertiser present on many different sites can be read on each of them[1]
  4. so a record of the user's browsing can be assembled across sites without their being aware of itthe cross-site point is the concern[1]
  5. A cookie is a small text file, not a program, so it cannot be executed[1]
  6. It can only be read by the site that set it, and cannot access other files on the machine — the genuine risk is to privacy, not to the computer[1]

(a) session in memory until the browser closes; persistent on disk until expiry (b) cross-site tracking builds a browsing profile (c) it is data, not a program

Examiner tip. Part (c) is a standing exam question because the misconception is so widespread. A cookie cannot run, so it cannot be a virus.