#065 · API Developer Tool

HTTP Header Viewer

Paste raw HTTP headers to inspect request or response metadata, duplicate fields, cache rules, CORS settings, and missing security headers.

Developer Input

Raw HTTP message

Parsed Header Table

Structured view
HeaderValue

How to use this developer tool

  1. Copy request or response headers from a network inspector.
  2. Paste the complete block, including the start line when available.
  3. Run the parser and review structured output.
  4. Check invalid, duplicate, cache, CORS, and security findings.

What this developer tool does

Splits raw HTTP messages into a start line and case-insensitive header collection while preserving duplicate values.

Normalize line endings → detect request/status line → split at first colon → preserve duplicates → analyze security/cache/CORS fields.

Sensitive Authorization and Cookie values should be removed before sharing output.

Example

HTTP/1.1 200 OK
Content-Type: application/json
Cache-Control: no-cache

Tips for better output

  • Use the Network tab to copy real headers.
  • Keep duplicate Set-Cookie fields separate.
  • Missing security headers are recommendations, not proof of a vulnerability.

FAQ

How do I parse raw HTTP response headers into JSON?

Paste the header block and run the parser; the JSON output preserves header names and values.

Which HTTP security headers are missing from this response?

Enable security analysis to list recommended headers that were not present.

How do I check Cache-Control and CORS headers?

The analysis section extracts Cache-Control and Access-Control-Allow-Origin values.

Why does an HTTP response contain duplicate headers?

Headers such as Set-Cookie can appear multiple times and should be preserved.

How do I analyze a raw HTTP request header block?

Paste the request line and headers; the first line is detected separately from field lines.

Supported formats and output

Raw request headers, response headers, and header-only blocks. Output is JSON plus a table.