Layer 7, up close
Layer 7 is where programs actually say things to each other: “give me this page”, “create this invoice”, “here is an email”. Everything below it exists to carry those messages. Tap a layer to see how it fits, then explore the top one.
Anatomy of an HTTP exchange
HTTP is the most common Layer 7 protocol. Every exchange is a request and a response, each made of a start line, headers and an optional body. Tap any line to see what it does.
Methods: what the client wants
| Method | Used for | Safe | Idempotent |
|---|---|---|---|
| GET | Read a resource | yes | yes |
| HEAD | Headers only, no body | yes | yes |
| POST | Create, or run an action | no | no |
| PUT | Replace a resource | no | yes |
| PATCH | Change part of a resource | no | no |
| DELETE | Remove a resource | no | yes |
| OPTIONS | Ask what is allowed (CORS) | yes | yes |
Safe means it should not change anything. Idempotent means repeating it has the same effect as doing it once, which is what makes automatic retries safe.
Status codes: how it went
Devices that work at Layer 7
Some network boxes only look at addresses and ports. Others read the HTTP itself and make decisions on it. Switch between the two kinds of load balancer and send a few requests.
Reverse proxy
Sits in front of servers, ends TLS, and forwards requests. Adds headers, compresses, buffers slow clients.
L7 load balancer
Routes by hostname, path or header, checks server health, retries failed requests, and pins sessions with cookies.
API gateway
Front door for APIs: checks tokens, enforces rate limits and quotas, versions and reshapes requests.
Web application firewall
Inspects requests for attack patterns such as SQL injection or known exploits, and blocks or challenges them.
CDN edge
Caches responses close to users and absorbs traffic floods before they reach the origin. Usually combines all of the above.
Service mesh proxy
A small proxy next to each service that adds mTLS, retries, timeouts and tracing to service-to-service calls.
Other Layer 7 protocols
HTTP is not alone at the top. Each of these solves a different conversation pattern. Pick one to see a real exchange.
Attacks at Layer 7, and how they are stopped
Layer 7 attacks look like normal requests, which is what makes them hard to stop. The first line of defense is often a rate limiter. Push the request rate up and watch it react.
20 tokens, refills 10 per second, each request spends one. Short bursts pass; a sustained rate above 10/s gets 429 Too Many Requests.OWASP Top 10:2025, the most common web application risks
- Broken Access Control
- Security Misconfiguration
- Software Supply Chain Failures
- Cryptographic Failures
- Injection
- Insecure Design
- Authentication Failures
- Software or Data Integrity Failures
- Security Logging and Alerting Failures
- Mishandling of Exceptional Conditions
Most of these live in application code, not in the network. A WAF can catch some patterns, but it cannot know that invoice 124 belongs to someone else.