HTTP requests and responses explained: methods, headers and bodies

Every page load is a conversation of HTTP requests and responses between a browser and a web server. Knowing what is inside those messages makes it much easier to understand redirects, caching, CORS errors, uploads and almost every web server setting. This guide takes one request apart line by line.

Before you start

• A terminal with curl, or a browser with DevTools (F12 → Network).
• For how the server side processes a request, see what is a web server.

Anatomy of an HTTP request

GET /blog/?page=2 HTTP/1.1
Host: example.com
User-Agent: Mozilla/5.0
Accept: text/html
Accept-Encoding: gzip, br
Cookie: session=abc123

• Request line: method (GET), target (/blog/?page=2), protocol version.
• Headers: one Name: value per line, describing the client and what it wants.
• Blank line, then an optional body (form data, JSON, file uploads).

In HTTP/2 and HTTP/3 the same information is sent as compressed binary frames, but the meaning is identical, so web server configs and logs treat them the same way.

HTTP methods

Caches and CDNs only store GET and HEAD responses. Forms that change data must use POST so a reload or crawler does not repeat the action.

Request headers web servers rely on

• Host: which site is wanted. Virtual hosts and server blocks are chosen by this header (and by SNI for HTTPS).
• Accept-Encoding: which compression the client supports.
• Cookie: session and login state; also decides whether a page cache is bypassed.
• Authorization: credentials for HTTP auth or API tokens.
• If-None-Match / If-Modified-Since: conditional requests that let the server answer 304 Not Modified with no body.
• Content-Type / Content-Length: describe the request body; upload limits like client_max_body_size check its size.
• X-Forwarded-For / X-Forwarded-Proto: added by proxies to pass the real client IP and scheme.

Anatomy of an HTTP response

HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Content-Encoding: br
Cache-Control: max-age=600
Set-Cookie: session=abc123; Secure; HttpOnly; SameSite=Lax
Strict-Transport-Security: max-age=31536000

<!doctype html>...

• Status line: version, code and reason. 2xx success, 3xx redirect, 4xx client error, 5xx server error.
• Headers: type, encoding, caching rules, cookies and security policies.
• Body: the HTML, image, JSON or file.

Response headers worth knowing

• Location: target of a 301/302 redirect.
• Cache-Control, ETag, Last-Modified: how long browsers and CDNs may reuse the response (Cache-Control guide).
• Set-Cookie: stores a cookie; flags Secure, HttpOnly and SameSite protect it.
• Vary: tells caches which request headers change the response.
• Server: often reveals the software; many admins shorten it.

Inspect requests yourself

1. Show only response headers:
   Copy

   curl -sI https://example.com/

2. Show the full exchange, including the TLS handshake and request headers:
   Copy

   curl -sv https://example.com/ -o /dev/null

3. Send a POST with JSON:
   Copy

   curl -s -X POST -H 'Content-Type: application/json' -d '{"name":"test"}' https://example.com/api

4. In the browser, open DevTools → Network, click a request and read the Headers tab.

More examples: debug HTTP with curl.

FAQ: HTTP requests and responses

What is the difference between HTTP and HTTPS?

The messages are the same; HTTPS wraps them in TLS so they are encrypted and the server is authenticated.

Why does the server ignore my PUT or DELETE?

Some servers, WAF rules or apps allow only GET and POST. Check for 405 Method Not Allowed and the allowed methods list.

Are headers case-sensitive?

Header names are not. HTTP/2 and HTTP/3 send them in lowercase.

Next steps

• Web server ports explained
• Security headers in Nginx and Apache
• Fix CORS errors