HTTP Cheatsheet

What is HTTP?

HTTP (HyperText Transfer Protocol) is the protocol used by web browsers and servers to communicate. It defines how requests are sent, how responses look, and the rules for resources on the web.

Think of HTTP as a language both browser and server speak: browser asks (requests), server answers (responses).

HTTP Request Structure

A request contains a method, URL (path), HTTP version, headers, and an optional body.

GET /path/resource?id=10 HTTP/1.1
Host: example.com
User-Agent: Mozilla/5.0
Accept: application/json
Accept-Language: en-US

<optional body for POST/PUT>

• Method: what you want to do (GET, POST, etc.).
• URL / Path: resource you want from the server.
• Headers: metadata (content type, auth tokens, caching hints).
• Body: data sent with some methods (POST, PUT, PATCH).

HTTP Response Structure

A response has a status line (status code + reason), headers, and a body (often HTML, JSON, images, etc.).

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 45
Cache-Control: max-age=3600

{ "id": 10, "name": "Alice", "active": true }

The status code helps the client know what happened (success, redirect, client error, server error).

HTTP Methods (Verbs)

Methods indicate the desired action. Here are the most common ones and how to think about them.

GET /posts/1

POST /posts
Content-Type: application/json

{ "title": "New Post", "body": "Hello" }

PUT /posts/1
Content-Type: application/json

{ "title": "Updated", "body": "New body" }

PATCH /posts/1
Content-Type: application/json

{ "title": "Small edit" }

DELETE /posts/1

Common HTTP Headers

Headers transmit metadata. There are request headers, response headers, and entity headers.

POST /api/items HTTP/1.1
Host: example.com
Content-Type: application/json
Authorization: Bearer abc123

{ "name": "Widget", "qty": 10 }

Cookies & Sessions

Cookies are small pieces of data set by servers in the browser. They are used to keep session state (e.g. logged-in user). They are sent automatically on subsequent requests to the same domain.

Set-Cookie: sessionId=abc123; Path=/; HttpOnly; Secure; SameSite=Lax

Caching

Caching improves performance by storing copies of resources. HTTP provides directives to control caching behavior for browsers and proxies.

Cache-Control: max-age=3600, public
Cache-Control: no-cache
Cache-Control: no-store

ETag: "abc123"
If-None-Match: "abc123"
--> 304 Not Modified

Security Headers

Use these headers to harden your web app against common attacks.

Content-Security-Policy: default-src 'self'; img-src 'self' https://images.example.com;

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

X-Content-Type-Options: nosniff

Referrer-Policy: no-referrer-when-downgrade

X-Frame-Options: DENY

HTTP Versions (1.1, 2, 3)

HTTP evolved to improve speed and reliability:

• HTTP/1.1 — persistent connections (keep-alive), chunked responses, widely supported.
• HTTP/2 — multiplexing (multiple requests/responses on single connection), header compression, server push. Improves latency.
• HTTP/3 — runs over QUIC (UDP-based), reduces connection/setup latency and improves reliability on lossy networks.

HTTP Status Codes (Grouped)

Status codes are grouped by class. Each code tells the client what happened.

Practical Examples & Tips

fetch('/api/items', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ name: 'Widget' })
})
  .then(r => {
    if (!r.ok) throw new Error('Request failed: ' + r.status);
    return r.json();
  })
  .then(data => console.log(data));

# GET
curl -i https://api.example.com/posts/1

# POST JSON
curl -i -X POST https://api.example.com/posts \
  -H "Content-Type: application/json" \
  -d '{"title":"Hi","body":"Hello"}'

How to use this page

1. Read the request/response structure to understand the pieces of HTTP messages.
2. Practice common methods (GET/POST/PUT/PATCH/DELETE) with cURL or fetch.
3. Learn essential headers (Content-Type, Authorization, Cache-Control, ETag).
4. Use the status codes list to understand server responses and design API behavior.