HTTP reference for methods, status codes, redirects, headers, caching, CORS, security and TLS/web troubleshooting.
HTTP methods
- GET — Lire une ressourceShould ideally be safe/read-only from the client perspective.
- HEAD — Response headers without a response body. Useful for status, redirects and caching without body.
- POST — Submit or create a resource according to the API. Often non-idempotent; repeating may create multiple operations.
- PUT/PATCH/DELETE — Modification ou suppression APISemantics and authorization depend on the API.
2xx / 3xx status codes
- 200 — OKStandard successful response.
- 204 — No ContentSuccess with no response body.
- 301 — Moved PermanentlyCacheable permanent redirect.
- 302/307/308 — Redirections307/308 explicitly preserve method; inspect the actual chain.
4xx status codes
- 400 — Bad RequestMalformed or invalid request.
- 401 — UnauthorizedMissing/invalid authentication; often with WWW-Authenticate.
- 403 — ForbiddenServer understands but refuses access.
- 404/429 — Not Found / Too Many Requests429 may include Retry-After; 404 can sometimes hide forbidden resources.
5xx status codes
- 500 — Internal Server ErrorCheck application/runtime logs at the same timestamp.
- 502 — Bad GatewayGateway/proxy received an invalid upstream response.
- 503 — Service UnavailableMaintenance, overload or unavailable upstream.
- 504 — Gateway TimeoutUpstream exceeded proxy timeout.
Request/response headers
- Host — Requested hostname. Critical for virtual hosts and reverse proxies.
- Content-Type — Media type of the body. Wrong MIME type can break APIs, browsers or downloads.
- Authorization — Bearer / Basic / autreDo not log tokens/secrets in plain text.
- Set-Cookie — Cookie + attributsInspect Secure, HttpOnly, SameSite, Domain and Path.
Caching & compression
- Cache-Control — max-age, no-cache, no-store, private…no-cache allows storage with revalidation; no-store forbids storage.
- ETag — Representation validator. Can enable 304 Not Modified after revalidation.
- Last-Modified — Last modification timestamp. Used with If-Modified-Since.
- Content-Encoding — gzip / brCheck proxy/CDN if compression is missing or duplicated.
Security & CORS
- HSTS — Strict-Transport-SecurityUse includeSubDomains/preload only after validating all HTTPS subdomains.
- CSP — Content-Security-PolicyRoll out gradually; strict CSP can break scripts, fonts or embeds.
- nosniff — X-Content-Type-Options: nosniffReduces unwanted MIME sniffing.
- CORS — Access-Control-Allow-Origin and related headers. CORS is a browser policy, not server authentication.
Diagnostic commands
- curl headers — curl -I https://exemple.frShows status and headers.
- Redirect chain — curl -IL https://exemple.frFollows redirects to detect loops or unexpected targets.
- Verbose TLS/HTTP — curl -vI https://exemple.frShows DNS, connection, TLS and headers; output may contain sensitive data.
- PowerShell HEAD — Invoke-WebRequest https://exemple.fr -Method HeadNative Windows alternative for status and headers.
Key points
- Status code alone is not enough; keep URL, method, timestamp and relevant headers.
- Redirects may come from CDN, reverse proxy, web server or application.
- Do not use curl -k as proof of TLS security; it disables certificate validation.
- CSP, HSTS and CORS must be tested against the real application.