HTTP
HTTP Header Analyzer
Inspect field names case-insensitively, find malformed or duplicate lines, and export an analysis that redacts recognized authorization, cookie, API-key, and authentication-token headers.
How this tool works
HTTP field names are case-insensitive. Field combination rules are not universal, so duplicate lines need field-specific interpretation rather than blanket concatenation.
The analyzer parses Content-Type and charset, lists Cache-Control directives, identifies Content-Encoding and CORS fields, and checks the presence—not correctness—of several common security-related response headers.
Examples
- Inspect application/problem+json with UTF-8.
- Find duplicate Cache-Control fields.
- Confirm an Authorization value does not appear in exported output.
Common use cases
What to check first
- Confirm whether the block is a request or response.
- Check Content-Type before debugging body parsing.
- Review Cache-Control with validators such as ETag.
- Treat CORS fields as browser policy inputs, not authorization.
Limitations
Pasted headers lack connection, redirect, request mode, browser console, and body context. Structured fields and field-specific grammar are not fully validated. Use browser network tools or a captured trace for protocol-level evidence.
Failure case: HTTP Headers
Invalid/failure example
Confirm an Authorization value does not appear in exported output.
Expected: The analyzer parses Content-Type and charset, lists Cache-Control directives, identifies Content-Encoding and CORS fields, and checks the presence—not correctness—of several common security-related response headers.
Related guides
Official references
FAQ
Does this tool send the pasted data or execute an API request?
No. Analysis runs in this browser tab. The tool does not call pasted URLs, resolve remote references, or submit the input to a DevPouch processing endpoint.
Does a security header prove a site is secure?
No. Presence is only one observable configuration detail. Correct directives, delivery over the right connection, application behavior, and the full threat model still matter.
Which credential headers are redacted?
The analyzer redacts Authorization, Proxy-Authorization, Cookie, Set-Cookie, common API-key spellings, X-Auth-Token, and X-Access-Token case-insensitively. Uncommon proprietary names require manual review.