HTTP reference for methods, status codes, redirects, headers, caching, CORS, security and TLS/web troubleshooting.
HTTP methods
Should ideally be safe/read-only from the client perspective.
Useful for status, redirects and caching without body.
Often non-idempotent; repeating may create multiple operations.
Semantics and authorization depend on the API.
2xx / 3xx status codes
Standard successful response.
Success with no response body.
Cacheable permanent redirect.
307/308 explicitly preserve method; inspect the actual chain.
4xx status codes
Malformed or invalid request.
Missing/invalid authentication; often with WWW-Authenticate.
Server understands but refuses access.
429 may include Retry-After; 404 can sometimes hide forbidden resources.
5xx status codes
Check application/runtime logs at the same timestamp.
Gateway/proxy received an invalid upstream response.
Maintenance, overload or unavailable upstream.
Upstream exceeded proxy timeout.
Request/response headers
Critical for virtual hosts and reverse proxies.
Wrong MIME type can break APIs, browsers or downloads.
Do not log tokens/secrets in plain text.
Inspect Secure, HttpOnly, SameSite, Domain and Path.
Caching & compression
no-cache allows storage with revalidation; no-store forbids storage.
Can enable 304 Not Modified after revalidation.
Used with If-Modified-Since.
Check proxy/CDN
Security & CORS
Use includeSubDomains/preload only after validating all HTTPS subdomains.
Roll out gradually; strict CSP can break scripts, fonts or embeds.
Reduces unwanted MIME sniffing.
CORS is a browser policy, not server authentication.
Diagnostic commands
curl -I https://exemple.frShows status and headers.
curl -IL https://exemple.frFollows redirects to detect loops or unexpected targets.
curl -vI https://exemple.frShows DNS, connection, TLS and headers; output may contain sensitive data.
Invoke-WebRequest https://exemple.fr -Method HeadNative Windows alternative for status and headers.
Key points
- Status code alone is not enough; keep URL, method, timestamp and relevant headers.
- Redirects may come from CDN, reverse proxy, web server or application.
- Do not use curl -k as proof of TLS security; it disables certificate validation.
- CSP, HSTS and CORS must be tested against the real application.