In which layer is HTTP in the OSI model?

Question

Some said HTTP is in the session layer in the OSI model.

But in Tanenbaum's Computer Network, HTTP is said to be in the application layer in the OSI model.

Also some said that HTTP has no concept of session. Does it mean that HTTP can't be in the session layer?

So is HTTP in the session layer? Thanks.

Update: For HTTP/2 what is the layer in OSI model?

Answer 1

In which layer is HTTP in the OSI model?

It's in the application layer. See the following quotes from the RFC 7230, one of the documents that currently defines the HTTP/1.1 protocol:

The Hypertext Transfer Protocol (HTTP) is a stateless application-level request/response protocol that uses extensible semantics and self-descriptive message payloads for flexible interaction with network-based hypertext information systems.

HTTP is a stateless request/response protocol that operates by exchanging messages across a reliable transport- or session-layer "connection".

---

Also some said that HTTP has no concept of session. Does it mean that HTTP can't be in the session layer?

As previously mentioned in the quotes from the RFC 7230, the HTTP protocol is stateless, where each request from client to server (should) contain all of the information necessary to understand the request, without taking advantage of any stored context on the server.

The RFC 6265 defines some mechanisms for state management in HTTP, such as cookies, allowing session management on server side (but it doesn't make HTTP stateful in any ways).

The concept of session in HTTP is different from the concept of session in the OSI model. Anyways, HTTP is an application layer protocol.

The OSI model

The OSI (Open Systems Interconnection) model is a conceptual model created by the International Organization for Standardization which enables diverse communication systems to communicate using standard protocols.

It provides a standard for different computer systems to be able to communicate with each other and can be seen as a universal language for computer networking. It’s based on the concept of splitting up a communication system into seven abstract layers, each one stacked upon the last.

The following picture borrowed from Cloudflare illustrates pretty well what the OSI model is like:

The application layer is the only layer that directly interacts with data from the user. So software applications like web browsers and email clients rely on the application layer to initiate communications.

But it should be made clear that client software applications are not part of the application layer: rather the application layer is responsible for the protocols (such as HTTP and SMTP) and data manipulation that the software relies on to present meaningful data to the user.

The OSI model vs the TCP/IP model

While the OSI model is comprehensive reference framework for general networking systems, it's important to mention that the modern Internet doesn’t strictly follow the OSI model.

The modern Internet more closely follows the simpler Internet protocol suite, which is commonly known as TCP/IP because the foundational protocols in the suite are the TCP (Transmission Control Protocol) and the IP (Internet Protocol).

The following image illustrates how the OSI and TCP/IP models relate to each other:

---

^{Update: This section has been added to address the bounty started by noɥʇʎԀʎzɐɹƆ, who requested to update this answer with HTTP/2 details.}

Despite the quotes of the document that defines the HTTP/1.1 protocol, all of the above also applies to HTTP/2. Refer to the following quote from the RFC 7540, the document that defines the HTTP/2 protocol:

An HTTP/2 connection is an application-layer protocol running on top of a TCP connection. The client is the TCP connection initiator.