An HTTP exchange is a request message from a client and a response message from a server. Both share the same shape: a start line, a block of header fields and an optional body. Knowing that shape makes every HTTP tool easier to reason about, because each tool reads or writes one part of it.
01The request line and the header block
The request line names the method and the target: GET /items/42 HTTP/1.1.
Each header field is a case-insensitive name, a colon and an opaque value; only the first colon separates them.
A field name may repeat, and the correct combination rule depends on the field, so duplicates must not be blindly joined.
The body follows a blank line and carries form data, JSON or uploaded bytes.
02Status, CORS and authentication
The status code tells the client what happened; its first digit is the class. CORS is the server opt-in that lets a browser script read a cross-origin response, and it is enforced by the browser rather than by the request. Basic authentication puts a base64-encoded user-pass into the Authorization header, which is only safe over TLS.
Frequently asked questions
Does a blocked CORS response mean the request was not received?
No. CORS is enforced by the browser after the response arrives, so the server may have processed the request even when the page cannot read the response.
Why do header names not need to match case?
HTTP field names are case-insensitive. Tools often lower-case them for grouping, while the value keeps its original bytes.
A practical guide to choosing random passwords and tokens, deriving and storing password hashes, signing tokens, encrypting with authenticated modes and measuring entropy.