Reading an HTTP exchange
Every HTTP request and response starts with a single line — a request line like GET /path HTTP/1.1, or a status line like HTTP/1.1 200 OK — followed by headers, one per line, each a name and a value separated by a colon.
Values may legitimately contain colons, which is why only the first one separates the name from the value. Content-Type: text/html; charset=utf-8 is one header whose value happens to contain both a colon-adjacent parameter and a semicolon.
The headers worth knowing
- Cache-Control — the single most consequential header for performance. Decides who may cache the response and for how long.
- Content-Type — how the browser interprets the body. A wrong value here makes a page render as plain text or download instead of displaying.
- ETag and Last-Modified — used to revalidate a cached copy without re-downloading it.
- Strict-Transport-Security, Content-Security-Policy and X-Content-Type-Options — the security headers worth auditing on any site you run.
- Vary — tells caches which request headers change the response. Getting it wrong causes the wrong cached variant to be served.
To pull apart the URL a request was made to, use the URL parser. To decode a bearer token from an Authorization header, use the JWT decoder.