Questions › Networking/Security

Anatomy of an HTTP request and response

HTTP BasicsEasyNetworking/Security

Describe the parts of an HTTP request and response. What lives in the start line, headers, and body?

What it tests

Understanding the concrete structure of an HTTP message — the thing every fetch, form post, and API call actually sends.

Approach & answer

An HTTP message has three parts: a START LINE, a block of HEADERS, and an optional BODY, separated by blank lines. A REQUEST's start line is method + path + version — 'GET /users/42 HTTP/1.1'. Then request headers: Host (which site — required in HTTP/1.1 so one IP can serve many domains), Accept (what content types the client wants back), Content-Type (the format of the body being sent, e.g. application/json), Content-Length, Authorization (credentials, e.g. a Bearer token), Cookie (stored cookies for this origin), User-Agent, and conditional headers like If-None-Match (with an ETag) for caching. The body carries the payload for methods that send data (POST/PUT/PATCH) — JSON, form-encoded fields, or a file; GET/HEAD requests normally have no body. A RESPONSE's start line is version + status code + reason phrase — 'HTTP/1.1 200 OK'. Then response headers: Content-Type (how to interpret the body), Content-Length, Cache-Control / ETag / Expires (caching directives), Set-Cookie (ask the browser to store a cookie), Location (redirect target or created-resource URL), and security headers like Content-Security-Policy, Strict-Transport-Security, and X-Frame-Options. The body is the returned representation — the HTML page, the JSON, the image bytes. Two things worth internalizing: headers are metadata ABOUT the message (who, what format, how to cache, auth, cookies), while the body is the actual content; and header NAMES are case-insensitive. Because headers drive so much behavior — caching, content negotiation, auth, security — reading them in DevTools' Network tab is the first move when debugging almost any request/response problem.

Use this technique when

Reading the Network tab; constructing a request by hand; understanding what a header does.

Code

REQUEST                          RESPONSE
-------------------------------  -------------------------------
GET /users/42 HTTP/1.1           HTTP/1.1 200 OK           <- start line
Host: api.example.com            Content-Type: application/json
Accept: application/json         Content-Length: 68
Authorization: Bearer eyJ...     Cache-Control: max-age=60
Cookie: sid=abc123               ETag: "9f2-a1"
If-None-Match: "9f2-a0"          Set-Cookie: sid=abc123; HttpOnly
                                 
(no body for GET)                {"id":42,"name":"Ada"}    <- body

Headers = metadata about the message; body = the content. Names are case-insensitive.

References