EXERCISE 2 — Inspecting an HTTPS request in browser DevTools
=============================================================

STEPS:
  1. Open DevTools (F12 or Ctrl+Shift+I) and select the Network tab.
  2. Load any HTTPS site (e.g. https://example.com). Refresh if empty.
  3. Click the first/main document request in the list.

(a) WHERE THE ENCRYPTION/SECURITY INFO LIVES:
  - In Chrome/Edge: there is a "Security" tab (or the "Connection"
    section in the request's Headers / the padlock in the address bar)
    showing:
       "Connection is secure"
       Protocol: TLS 1.3
       Cipher: e.g. AES_256_GCM
       Valid certificate issued to <domain> by <CA>
  - In Firefox: click the padlock > "Connection secure" > "More
    information" > View Certificate for the same details.
  - This confirms CONFIDENTIALITY (encrypted) + AUTHENTICATION (a valid
    certificate for the domain).

(b) THE REQUEST HEADERS:
  - In the "Headers" sub-tab you can read the full request: method, path,
    Host, User-Agent, Cookie, etc. — in plaintext.
  - IMPORTANT POINT OF THE EXERCISE: you can read these because DevTools
    sees the data INSIDE your own browser, BEFORE it is encrypted for
    sending (and after it is decrypted on receipt). On the network
    between you and the server, those exact bytes are unreadable.
    HTTPS protects data in transit, not from the endpoints themselves.

MAPPING TO THE THREE GUARANTEES:
  - Confidentiality -> the "TLS 1.3 / cipher" line: traffic is encrypted
    on the wire, so the Cookie header you can see here is not visible to
    the network.
  - Integrity -> implicit in TLS: the cipher (e.g. *_GCM) also
    authenticates each record, so any tampering in transit is detected
    (Chapter 2 covers how).
  - Authentication -> the certificate "issued to <domain> by <CA>":
    proof you are talking to the real owner of that domain, not an
    impostor.