Orlixio

8 min read

How to read HTTP headers

HTTP headers carry metadata that explains how an API response should be parsed, cached, authenticated, and traced.

Table of contents

  1. What headers are for
  2. Important headers to inspect
  3. Duplicates and casing
  4. Privacy while sharing headers

What headers are for

Headers are metadata attached to HTTP requests and responses. They can describe body format, accepted formats, caching, cookies, authentication, redirects, compression, CORS, tracing, and rate limits.

A response body may show the data, but headers often explain why the browser or API client behaved a certain way.

Important headers to inspect

Content-Type tells you whether the body is JSON, HTML, text, or another format. Authorization and WWW-Authenticate explain authentication. Cache-Control, ETag, and Last-Modified explain caching. Location appears with redirects. Retry-After and rate limit headers explain throttling.

Request IDs and trace headers are valuable when asking backend teams to find a specific request in logs.

Duplicates and casing

Header names are case-insensitive, so Content-Type and content-type refer to the same header. Some headers can appear more than once, and tooling should avoid silently dropping duplicates.

Parsing headers into structured JSON makes duplicates and values easier to inspect, especially after copying raw output from cURL or DevTools.

Privacy while sharing headers

Headers can expose tokens, cookies, user identifiers, internal infrastructure, and request tracing values. Redact sensitive values before sharing screenshots or logs in public places.

When reporting bugs, include safe metadata: status code, content type, cache behavior, request ID, and a redacted auth state description.

Related guides

URL encoding explained

URL encoding protects values inside URLs so reserved characters are interpreted as data instead of syntax.

SHA256 vs MD5

SHA-256 is a modern cryptographic hash. MD5 remains common in legacy checks but is broken for security uses.

HTTP status codes explained

HTTP status codes quickly tell you whether a request succeeded, redirected, failed client-side, or failed server-side.

FAQ

Are header names case-sensitive?

HTTP header names are case-insensitive.

Which headers are sensitive?

Authorization, Cookie, Set-Cookie, and some internal tracing headers can contain sensitive data.

What does Content-Type do?

It tells the client how to interpret the response body.

What does Cache-Control do?

It describes caching behavior for browsers, proxies, and CDNs.