Reference
HTTP, CORS and API Reference
A lookup reference for HTTP message anatomy, status classes, CORS headers, Basic authentication and OpenAPI document structure.
HTTP messages share one shape: a start line, header fields and an optional body. The status class is the first digit of a response code. CORS is a set of response headers that lets a browser script read a cross-origin response. Basic authentication carries a base64-encoded user-pass. OpenAPI describes an API as a JSON or YAML document with an info block, paths and operations.
01Quick reference
- Start line: request line (method target version) or status line (version code reason).
- Field line: name, colon, optional whitespace, value; the name is a token and is case-insensitive.
- Status classes: 1xx informational, 2xx success, 3xx redirection, 4xx client error, 5xx server error.
- CORS: Access-Control-Allow-Origin must echo the origin when credentials are included; the wildcard is not allowed with credentials.
- Basic auth: Authorization: Basic base64(UTF-8(user:pass)); safe only over TLS.
- OpenAPI 3.x uses the openapi field; Swagger 2.0 uses swagger and definitions.
02Limitations
This reference summarises standards; it is not a substitute for the full RFC or OpenAPI texts, and it omits vendor-specific headers, HTTP/2 and HTTP/3 framing, and TLS handshake behavior.
Frequently asked questions
- What is the difference between 401 and 403?
- 401 means the request is unauthenticated; 403 means the client is authenticated but not permitted to access the resource.
- Is an OpenAPI document valid JSON Schema?
- OpenAPI 3.1 aligns its schema object with JSON Schema 2020-12, but an OpenAPI document also has API-specific fields beyond a plain schema.
Sources
- RFC 9110: HTTP Semantics — IETF (accessed 2026-10-05)
- RFC 7617: The Basic HTTP Authentication Scheme — IETF (accessed 2026-10-05)
- WHATWG Fetch Standard — WHATWG (accessed 2026-10-05)
- OpenAPI Specification 3.1.0 — OpenAPI Initiative (accessed 2026-10-05)