CS I · Wed Nov 18 · 16.3 · We Do

Before the bell

You are responsible for all of this before the end of class.

The discussion form in the I Do deck. All three sections. If you are here, this should be done.
Your classwork. This form on the right. Section 1 before the exit ticket pops up; Section 2 past the floor.
Today's Bench Basics activity: Bring a Value Back. It opens later in class and lives on slide 4 of this deck.
The exit ticket. It opens 15 minutes before the bell and lives on the last slide of this deck.

Classwork

The classwork form is not linked yet. Use Station View and write your answers in your lab notebook with the item labels.

Bring a Value Back

This reading explains how a Java method sends a value back to the line that called it, and why Java will not compile a line placed after `return`.

Where a Returned Value Lands

A method whose header says `void` does its work and sends nothing back. A method whose header says `int` instead of `void` brings a whole number back with `return`. The value lands where the call was, as if the call were replaced by the value. The program below shows the same line numbers as the code panel on the bench.

1public class Main {
2    public static int addBonus(int score) {
3        int total = score + 5;
4        return total;
5    }
6
7    public static void main(String[] args) {
8        int points = addBonus(10);
9        System.out.println(points);
10        System.out.println(addBonus(points));
11    }
12}

15
20

The trace table follows the program one line at a time, in the order the lines run.

Line   score   total   points   Output
 8      10
 3      10      15
 4      10      15
 8                       15
 9                       15      15
10      15               15
 3      15      20       15
 4      15      20       15
10                       15      20

Line 8 calls `addBonus` with 10, so `score` holds 10. Line 3 stores 15 in `total`, and line 4 returns 15, which ends the method. The 15 lands on line 8 where the call was, so the line works as if it said `int points = 15;` and 15 is stored in `points`. Line 9 prints 15. Line 10 calls `addBonus` with 15, lines 3 and 4 run again, and the 20 that comes back lands inside the print, so line 10 prints 20. When line 8 or line 10 calls `addBonus`, the first row for that line shows the value passed in to `score`. On the other rows for `main`, the cells for `score` and `total` are blank, because those two belong to `addBonus`.

Code After Return

When `return` runs, the method is over, so a line after it could never run. Java refuses to compile a line that could never run. The program below adds `System.out.println("Done");` on the line right after `return total;`. Its first line is a comment, which counts as line 1, so every other line moves down by one.

1// This does not compile.
2public class Main {
3    public static int addBonus(int score) {
4        int total = score + 5;
5        return total;
6        System.out.println("Done");
7    }
8
9    public static void main(String[] args) {
10        int points = addBonus(10);
11        System.out.println(points);
12        System.out.println(addBonus(points));
13    }
14}

Main.java:6: error: unreachable statement
        System.out.println("Done");
        ^
1 error

The message names line 6, which is the line right after `return total;`. The fix is to move the print above the `return` or to delete it.

Two Mistakes the Bench Catches

The first mistake is expecting a method to print when it only returns. A call such as `addBonus(10);` on a line by itself prints nothing, because the 15 comes back and nothing stores it or prints it. Returning a value is not the same as printing it. To see a returned value, a program can store it and then print it, as lines 8 and 9 do, or put the call inside a print, as line 10 does. The second mistake is losing track of where the returned value lands. In `int points = addBonus(10);` the 15 goes into `points`, and not into `score` or `total`, which belong to the method.

Sources: Oracle, The Java Language Specification, Java SE 21 Edition, Chapter 14 (n.d.); CS I, Bench Basics B18 (2026); CS I, Java examples run with the course JDK (2026).

Links for today

HTTPS, Encryption and API Keys

This section explains how data is protected while it travels between a browser and a server, and why the key that pays for a service is never written in a web page.

What Encryption Does

On a shared network, such as public wifi, other people can capture data as it travels. Encryption is a way of scrambling data so that only the intended receiver can read it. First, the sender uses an encryption key, a set of values that both sides agree on, to change readable data into data that appears random. Next, the scrambled data travels across the network, and then the receiver, who has the right key, turns it back into readable data. For example, a sentence that anyone could read becomes a string of characters that means nothing without the key.

Encryption is often confused with compression, because both change a file before it is sent. A compressed file is smaller, but it is not hidden from anyone. All modern browsers support the same few compression methods, so any browser can open a compressed file. Compression is not encryption, because it makes data smaller without keeping anyone from reading it.

What HTTPS Protects and What It Does Not

Browsers and websites send data using a set of rules called HTTP. HTTPS is the way a browser and a server send data to each other with encryption. In Chrome, the icon at the left of the address bar opens a panel, and on a site that uses HTTPS the panel says "Connection is secure." That message means the connection uses HTTPS. If someone on the same network captures the data, it appears as meaningless characters. HTTPS also confirms which server the browser is talking to, so the data goes to the site named in the address.

HTTPS protects data while it travels, but it does not make a site's information true. A site with a secure connection can still give wrong information, and its owners can still be dishonest. The team that builds Chrome reported that nearly all phishing sites, which are fake sites made to trick people, use HTTPS. Google's help page for Chrome advises people to be careful with personal information even on secure sites. For example, a page of homework answers can arrive over HTTPS and still be full of mistakes, because HTTPS protects the trip and does not check the content.

Why an API Key Stays on a Server

Many programs use services on another company's computers, such as a language model. An API is a set of rules that lets one program use another program or service. An API key is a secret string that identifies who is making requests to a service. The service uses the key to track each request and to bill the account it belongs to. Whoever has the key can use that account and spend its budget. An API key is not an encryption key, because it does not scramble anything. Mistral, the company whose model Code Coach uses, tells developers never to commit API keys to a repository.

Everything in a page is sent to the browser, including the HTML, the CSS and the JavaScript. Anyone who opens a page can read its JavaScript, so an API key is kept on a server and never written in the page. Google's guide to API keys gives the same rule for any code that runs in a browser. The page sends its request to a server, and the server adds the key before passing the request on.

Code Coach works this way, as Figure 1 shows. The bench page sends a student's question to the class endpoint, which is a server. The endpoint adds the key and passes the request on to the model. The key is stored on the endpoint as a secret setting, and it never appears in any file a browser receives. The excerpt below is copied from the code the B18 bench page loaded on October 19, 2026.

fetch("/api/class/ask",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({tool:c.trim(),system:"You are Code Coach.

The excerpt names the endpoint's address and contains no key. The class endpoint's address is in the page, and anyone can read it. The API key is a secret, and it is never in a file that a browser receives. The address does not reveal the key, and the endpoint accepts only requests that carry a valid course code, up to 12 Code Coach requests for each student in a class period.

Summary

Encryption scrambles data so that only the intended receiver can read it, and HTTPS uses encryption to protect data while it travels between a browser and a server. A secure connection does not show that a site's information is true or that the site is honest. An API key identifies an account and lets its holder spend the account's budget, so it is kept on a server such as the class endpoint and never written in a page, where anyone could read it.

Sources: Cloudflare, What is encryption? (n.d.); MDN, Compression in HTTP (2026); Cloudflare, What is HTTPS? (n.d.); Chromium, page_info_strings.grdp (n.d.); Chromium Blog, post of May 2 (2023); Google, Check if a site's connection is secure (n.d.); MDN, Glossary: API (2025); OWASP, Secrets Management Cheat Sheet (n.d.); Google Cloud, Manage API keys (n.d.); Mistral AI, Manage workspaces and API keys (n.d.); MDN, How the web works (2026); Google Cloud, Best practices for managing API keys (2026); CS I class endpoint code and saved B18 page excerpt (2026).

Classwork · Section 1 — Reading 2

The classwork form is not linked yet. Use Station View and write your answers in your lab notebook with the item labels.

MC 1. A student opens a site that uses HTTPS and types a question into a box on the page. What does HTTPS protect?

The question, while it travels between the browser and the server
The facts on the site, by checking that each one is correct
The student's Chromebook, by blocking viruses that come from the site
The site's code, by hiding it from the person who opens the page

MC 2. Chrome's panel says "Connection is secure" for a site. Which of these does that message not tell you?

That the connection to the site uses HTTPS
That data sent to the site is scrambled on the way
That the people who run the site are honest
That the browser is talking to the server named in the address

MC 3. Where is Code Coach's API key kept?

On the class endpoint, as a secret setting
In the bench page's own code, near the end where few people look
On each student's Chromebook, inside the browser
In the system prompt that the bench page sends with each question

MC 4. A programmer building a page that shows maps from a paid map service plans to type the service's API key into the page's code. What is the problem with that plan?

Every file of the page is sent to each visitor's browser, so any visitor can read the key and use the account.
There is no problem, because HTTPS scrambles the code so that a visitor's browser cannot show the key.
Only a few visitors with special software could find the key, so the risk to the account is small.
The map service charges more for each request when the key is in the page instead of on a server.

MC 5. Which method header says that the method brings back a whole number?

public static void showTotal(int n)
public static int getTotal(int n)
public static void main(String[] args)
public static void returnTotal(int n)

MC 6. What value does minusThree(11) return?

1public class Main {
2    public static int minusThree(int n) {
3        return n - 3;
4    }
5
6    public static void main(String[] args) {
7        System.out.println(minusThree(11));
8    }
9}

8
11
14
Nothing, because minusThree has no print in it

MC 7. Line 7 is int y = f(3); and f returns 9. Where does the 9 land?

1public class Main {
2    public static int f(int x) {
3        return x * x;
4    }
5
6    public static void main(String[] args) {
7        int y = f(3);
8        System.out.println(y);
9    }
10}

It takes the place of f(3) on line 7, so 9 is stored in y.
It is stored in x on line 2, because x is the method's box.
It is printed on line 3, because that line has the return.
It is lost on line 4, because the method ends there.

MC 8. What does this program print?

1public class Main {
2    public static int plusOne(int n) {
3        return n + 1;
4    }
5
6    public static void main(String[] args) {
7        int a = 5;
8        plusOne(a);
9        System.out.println(a);
10        a = plusOne(a);
11        System.out.println(a);
12    }
13}

5 on the first line, then 6 on the second
6 on the first line, then 7 on the second
5 on the first line, then 5 on the second
Nothing, because plusOne has no print in it

MC 9. Inside a method, a programmer writes System.out.println("Hi"); on the line right after return n; and then compiles the program. What happens?

Java does not compile the program, because that line could never run.
The program compiles, and Hi is printed after the method returns.
The program compiles, and Java moves the print above the return.
The program compiles, and Java skips the line with no message.

MC 10. A student traced this program one row at a time. Which row of the student's trace table is wrong?

1public class Main {
2    public static int addExtra(int laps) {
3        int extra = laps / 4;
4        return laps + extra;
5    }
6
7    public static void main(String[] args) {
8        int total = addExtra(20);
9        System.out.println(total);
10    }
11}

Line 3: extra is 5
Line 4: the method returns 25
Line 8: total is 20
Line 9: the output is 25

CR 1. Fill a trace table for this program with the columns Line, side, n, result, area and Output, one row for each line that runs. Then write the output.

1public class Main {
2    public static int square(int n) {
3        int result = n * n;
4        return result;
5    }
6
7    public static void main(String[] args) {
8        int side = 4;
9        int area = square(side);
10        System.out.println(area);
11        System.out.println(area + 1);
12    }
13}

Write your answer in your lab notebook, labeled CR 1.

CR 2. Explain in two sentences why the class endpoint's address can be in the bench page but the API key cannot.

Write your answer in your lab notebook, labeled CR 2.

Figure 1. Code Coach's request travels encrypted from the bench page to the class endpoint, which adds the API key and passes it on to the model's server, and the bench page's own code shows the endpoint's address and no key.

Classwork · Section 2 — Past the floor

The classwork form is not linked yet. Use Station View and write your answers in your lab notebook with the item labels.

CR 3. Line 7 uses a returned value inside a second call. Give the value each call to addThree returns, in the order the calls happen, and write the output.

1public class Main {
2    public static int addThree(int n) {
3        return n + 3;
4    }
5
6    public static void main(String[] args) {
7        int x = addThree(addThree(2));
8        System.out.println(x);
9        System.out.println(addThree(x) * 2);
10    }
11}

Write your answer in your lab notebook, labeled CR 3.

CR 4. Name one kind of information a person should not type into any tool, and explain why HTTPS alone does not make it safe to type.

Write your answer in your lab notebook, labeled CR 4.

Bench Basics

Bring a Value Back

Open the bench, do its six jobs, then paste your credit code into the credit-code form. You can turn in up to three codes per bench; your best score is your grade.

Bench Basics opens during your class period.

Classwork

The classwork form is not linked yet. Use Station View and write your answers in your lab notebook with the item labels.

Exit Ticket

This opens during your class period.