Xerobit

HTTP Headers Checker: Inspect Raw Response Headers

Paste raw HTTP response headers into this http headers checker to see a structured table of every name and value. It flags duplicate entries, marks deprecated headers like X-XSS-Protection or P3P, and inspects Set-Cookie attributes for missing Secure, HttpOnly or SameSite flags. Everything runs locally in your browser without uploading any data.

Paste the full header block from a network inspector, curl -I or similar tool.

Result

3 header(s) parsed, 3 unique, 1 cookie(s)

Headers:
Content-Type: text/html; charset=utf-8
Set-Cookie: id=a3fWa; Expires=Thu, 21 Oct 2021 07:28:00 GMT; Secure; HttpOnly; SameSite=Strict
Cache-Control: no-cache

Cookie Analysis:
id=a3fWa -> All flags present
  • id=a3fWa
    All flags present
HeaderValueNotes
Content-Typetext/html; charset=utf-8
Set-Cookieid=a3fWa; Expires=Thu, 21 Oct 2021 07:28:00 GMT; Secure; HttpOnly; SameSite=Strict
Cache-Controlno-cache

3 header(s) parsed, 3 unique, 1 cookie(s)

How to use the http headers checker

  1. Copy the raw HTTP response headers from your browser's developer tools (Network tab), curl -I, or a proxy tool.
  2. Paste the headers into the text area above. The status line (e.g., HTTP/1.1 200 OK) is optional and will be ignored automatically.
  3. Review the parsed table to see each header name, its value, and any notes about duplicates or deprecated usage.
  4. Check the cookie analysis section to verify that every Set-Cookie header includes the Secure, HttpOnly and SameSite attributes.

How the http headers checker parses input

The tool splits the pasted text on newline characters (\r\n or \n). If the first line matches the HTTP status pattern (for example HTTP/1.1 200 OK), it is skipped. Each remaining line is split at the first colon to separate the header name from its value. Leading and trailing whitespace around both parts is trimmed, and a line that starts with a space or tab is joined to the header above it (obsolete line folding). The first blank line ends the header block, so a pasted body is ignored. Lines that are not a valid Name: Value pair are skipped and counted in the summary.

Header names are compared case-insensitively, as required by RFC 9110. This means content-type and Content-Type are treated as the same field when checking for duplicates. Values keep their commas and semicolons exactly as pasted.

Deprecated and obsolete headers

Several HTTP headers were once common but have been replaced by modern standards or removed from specifications. When this http headers checker finds one it adds a note: Deprecated for the headers below, and Superseded for X-Frame-Options, which still works but is replaced by CSP frame-ancestors.

HeaderWhy it is deprecated or superseded
X-Frame-OptionsSuperseded by the frame-ancestors directive in Content Security Policy. See the security headers checker for CSP evaluation.
X-XSS-ProtectionRemoved from modern browsers because the XSS auditor introduced vulnerabilities rather than preventing them.
P3PThe Platform for Privacy Preferences was never widely adopted and is ignored by all current browsers.
PragmaReplaced by Cache-Control in HTTP/1.1. Sending Pragma: no-cache is only useful for legacy HTTP/1.0 clients.
Public-Key-PinsHPKP was deprecated due to the risk of site breakage. Use HSTS and Certificate Transparency instead.

Handling duplicate headers

RFC 9110 allows multiple header fields with the same name if they can be combined into a single comma-separated list. However, some headers must not appear more than once. For instance, sending two Content-Length headers creates ambiguity that servers and proxies resolve inconsistently, which can lead to request smuggling.

This http headers checker highlights every header name that appears more than once. You should review duplicates carefully: Set-Cookie is expected to repeat (one header per cookie), while Content-Type or Content-Length appearing twice usually indicates a misconfiguration.

Common mistakes when inspecting headers

Developers often overlook subtle issues when reviewing HTTP responses manually. A few frequent problems include:

  • Case sensitivity confusion: Header names are case-insensitive, but some custom code treats them as case-sensitive, leading to missed lookups.
  • Whitespace in values: Extra spaces after the colon are legal and stripped by parsers, but embedded spaces within a token can break strict validators.
  • Mixing up request and response headers: Headers like Accept belong in requests, while Content-Type appears in both. Pasting request headers here will still work, but the context differs.
  • Ignoring continuation lines: Older HTTP versions allowed folding long headers across multiple lines starting with whitespace. HTTP/1.1 now forbids it, but this tool still joins the lines so old captures read correctly.

For generating authentication headers correctly, use the basic auth header generator.

Worked examples

ExampleInputResult
Secure cookie with modern headersRaw HTTP response headers: HTTP/1.1 200 OK / Content-Type: text/html; charset=utf-8 / Set-Cookie: session=abc123; Path=/; Secure; HttpOnly; SameSite=Lax / Cache-Control: no-storesession=abc123: All flags present
Insecure cookie and deprecated headerRaw HTTP response headers: HTTP/1.1 200 OK / X-XSS-Protection: 1; mode=block / Set-Cookie: user=bob / Server: Apache/2.4user=bob: Missing Secure, HttpOnly, SameSite
Duplicate headersRaw HTTP response headers: HTTP/1.1 200 OK / Cache-Control: max-age=3600 / Cache-Control: no-cache / Content-Type: application/json3 header(s) parsed, 2 unique / Headers: / Cache-Control: max-age=3600 [Duplicate] / Cache-Control: no-cache [Duplicate] / Content-Type: application/json

FAQ

What does this http headers checker do?

It takes raw HTTP response headers you paste in, splits them into individual fields, and presents them in a table. It also flags duplicate names, marks deprecated headers and checks Set-Cookie attributes for missing security flags.

Are my headers sent to a server?

No. The parsing logic runs entirely in your browser using JavaScript. Nothing you paste is uploaded anywhere.

Which Set-Cookie flags should I look for?

Every session or sensitive cookie should include Secure, HttpOnly and SameSite. The checker warns when any of the three is missing, when SameSite=None is used without Secure, and when a __Host- or __Secure- prefixed cookie breaks the prefix rules.

Why is X-Frame-Options marked as superseded?

Modern browsers prefer the frame-ancestors directive inside a Content-Security-Policy header. X-Frame-Options is still supported and still useful for older browsers, so the checker labels it Superseded rather than Deprecated.

Can I paste a full HTTP response including the body?

Yes, but only the header block is analysed. The first blank line ends the headers, and everything after it, including the body, is ignored.

Is it normal to see duplicate Set-Cookie headers?

Yes. Unlike most headers, Set-Cookie is designed to appear once per cookie being set. The checker notes duplicates for awareness but does not treat multiple Set-Cookie lines as an error.