Raw HTTP Header Parser & Cache/Security Inspector

791 bytes
Protocol / Status
HTTP/1.1 200 OK
Cache Directive
public, max-age=86400, s-maxage=604800, immutable
Security Posture
Grade A+ (Robust)
Cookies Present
2 tokens
Parsed Header Directives (17)
Header FieldNormalized ValueCategory
DateMon, 27 Jul 2026 12:28:53 GMTGeneral
ServercloudflareNetwork / Server
Content-Typeapplication/json; charset=utf-8Content
Content-Length1420Content
Connectionkeep-aliveNetwork / Server
Keep-Alivetimeout=5General
Cache-Controlpublic, max-age=86400, s-maxage=604800, immutableCaching
ETagW/"5f12a-abc123xyz"Caching
Strict-Transport-Securitymax-age=63072000; includeSubDomains; preloadSecurity
Content-Security-Policydefault-src 'self'; script-src 'self' 'nonce-rAnd0m'; object-src 'none'Security
X-Content-Type-OptionsnosniffSecurity
X-Frame-OptionsDENYSecurity
Referrer-Policystrict-origin-when-cross-originSecurity
Permissions-Policycamera=(), microphone=(), geolocation=()Security
Set-Cookiesession_id=s_98457abc; Path=/; Secure; HttpOnly; SameSite=Strict; Max-Age=86400Cookie / Auth
Set-Cookieuser_pref=dark_mode; Path=/; SameSite=Lax; Max-Age=2592000Cookie / Auth
VaryAccept-EncodingContent
17
Total Headers
6
Security Directives
2
Cookies / Auth Tokens
791 B
Header Length
Technical Reference & Architecture Guide

Raw HTTP Header Parser & Diagnostics Developer Guide — Reference Guide

Comprehensive reference for parsing raw HTTP request and response header wire blocks, diagnosing Cache-Control directives, security posture, and Set-Cookie tokens.

Key Parameters & Controls

rawHeadersstring

Unprocessed HTTP wire block including optional request line (GET / HTTP/1.1) or status line (HTTP/1.1 200 OK).

cacheAnalysisboolean

Evaluate caching behavior based on Cache-Control, ETag, Expires, and Last-Modified headers.

securityGradingboolean

Audit presence and configuration of HSTS, CSP, X-Frame-Options, and Permissions-Policy.

cookieExtractionboolean

Extract and decode Set-Cookie attributes (Secure, HttpOnly, SameSite, Max-Age).

Pro Tips & Best Practices

Always configure 'Cache-Control: public, max-age=31536000, immutable' for hashed static assets to maximize CDN efficiency.

Ensure 'Strict-Transport-Security: max-age=63072000; includeSubDomains; preload' is present to qualify for HSTS preload lists.

Set 'SameSite=Lax' or 'SameSite=Strict' on session cookies to mitigate Cross-Site Request Forgery (CSRF) vulnerabilities.

Common Gotchas & Troubleshooting

RFC 7230 deprecates line folding. Ensure each header field occupies a single line separated by CRLF.

Headers that appear multiple times are combined into list arrays per RFC 7230 section 3.2.2.

Frequently Asked Questions

Can this tool parse both request and response headers?▼

Yes. It automatically detects request lines (e.g., POST /api HTTP/1.1) or status lines (e.g., HTTP/2 200 OK).

Are cookie tokens or authorization headers sent to any server?▼

No. The parsing engine runs 100% locally in your browser memory.

Can I export the parsed headers as structured JSON?▼

Yes. One click copies the entire parsed key-value dictionary as formatted JSON.

How are header names normalized?▼

Header keys are canonicalized to standard Title-Case (e.g., 'content-type' -> 'Content-Type').

Related Tools & Utilities

All Tools →