#340 · Developer Tool

HTTP Header Diff Checker

Compare two HTTP response-header blocks without losing repeated fields. The diff separates added, removed, and changed header names, normalizes name casing for comparison, and preserves the original values in a readable report. It is useful for checking CDN, reverse-proxy, framework, or deployment changes. Split the input with the supplied BEFORE and AFTER markers; request status lines and blank lines are safely ignored.

Developer Input

Two header blocks
Ad space

How to use this developer tool

  1. Paste the two header blocks or load the included sample.
  2. Adjust any tool-specific option shown below the input.
  3. Select Compare Headers or press Ctrl/Cmd + Enter.
  4. Review the summary and findings, then copy or download the output.

What this developer tool does

Builds a multimap for each block, compares normalized header names and ordered values, and classifies every difference as added, removed, or changed.

Builds a multimap for each block, compares normalized header names and ordered values, and classifies every difference as added, removed, or changed.

Order changes inside repeated headers are reported as changes because order can affect fields such as Set-Cookie and forwarding chains.

Example

Input

=== BEFORE ===
Cache-Control: no-cache
X-Frame-Options: SAMEORIGIN

=== AFTER ===
Cache-Control: public, max-age=3600
X-Frame-Options: DENY
X-Content-Type-Options: nosniff

Output

CHANGED Cache-Control
  before: no-cache
  after: public, max-age=3600
ADDED X-Content-Type-Options: nosniff

Use cases

  • Review a deployment before changing production response headers.
  • Compare application and reverse-proxy configuration.
  • Create a reproducible finding for a security review or pull request.
  • Teach the practical effect of HTTP Header Diff settings.

Tips for reliable output

  • Use the complete header value, including repeated fields.
  • Test the final response after CDN and proxy processing.
  • Keep a copy of the before and after output for review.
  • Do not treat a passing result as a penetration test.
  • Recheck after framework, server, or browser-policy updates.

Processing details

The divider syntax is === BEFORE === and === AFTER ===. Header names are case-insensitive; values remain case-sensitive and are not semantically parsed.

Equivalent directives written in a different order may appear changed. This is a textual structured diff, not a field-specific semantic comparison.

Frequently asked questions

How do I compare repeated Set-Cookie response headers?

The checker reports this directly from the supplied two header blocks and shows the relevant value in its output.

Are HTTP header names compared case-insensitively?

Use the result together with the browser and server behavior you support; the page does not make remote requests.

Why does directive reordering appear as a change?

Review the generated finding before deployment, especially when proxies or CDNs can alter headers.

Can I compare request headers with this checker?

The implemented rule follows current HTTP security-header practice and flags values it cannot recognize.

Does the diff ignore HTTP status lines and blank lines?

Retest with the exact production response because small header changes can affect the conclusion.

Checks and output

StageWhat is reported
ParseRecognized input fields and values
ValidateInvalid, missing, or conflicting settings
ExportText, CSV, and JSON when structured data is available

HTTP & Security Headers

Browse more tools for HTTP behavior, browser policies, cookies, CORS, CSP, and response-header security.

View HTTP & Security Headers