🌍 HTTP & Web

← Back to Cheatsheets

A quick-reference for HTTP — the protocol behind every web request. Covers methods, status codes, common headers, and URL structure. Understanding these is useful whether you're building APIs, debugging network issues, or reading server logs.

Resources

URL Anatomy

Every URL maps to a specific resource. The path and query string are sent to the server; the fragment (#) is browser-only and never sent.

• Structure:

  scheme://host:port/path?query=value&key=val#fragment
  
  https://api.example.com:443/users/42?expand=profile#bio
  │       │               │   │        │                └─ fragment (client-only)
  │       │               │   │        └─ query string
  │       │               │   └─ path
  │       │               └─ port (443 = https default, 80 = http default)
  │       └─ host
  └─ scheme

• URL encoding:
  Special characters in query values must be percent-encoded. Spaces become %20 or +, & becomes %26, = becomes %3D.

Methods

Methods describe the intended action. Safe methods don't modify state. Idempotent methods produce the same result no matter how many times they're called.

• GET — retrieve a resource
  Safe · Idempotent · No request body · Response is cacheable

• POST — submit data, create a resource
  Not safe · Not idempotent · Has request body · Responses usually not cached

• PUT — replace a resource entirely
  Not safe · Idempotent · Has request body · Calling twice is the same as calling once

• PATCH — partially update a resource
  Not safe · Not necessarily idempotent · Has request body

• DELETE — remove a resource
  Not safe · Idempotent · No request body

• HEAD — same as GET but returns only headers, no body
  Safe · Idempotent · Used to check if a resource exists or get its metadata

• OPTIONS — describe communication options for a resource
  Used by browsers for CORS preflight requests

Common Headers

Headers pass metadata alongside a request or response. Request headers describe the client; response headers describe the server's reply and how to handle it.

• Request headers:

  Content-Type: application/json       # body format being sent
  Accept: application/json             # formats the client will accept
  Authorization: Bearer <token>       # credentials
  Cookie: session=abc123
  User-Agent: Mozilla/5.0 ...
  Origin: https://example.com          # sent on cross-origin requests

• Response headers:

  Content-Type: application/json; charset=utf-8
  Content-Length: 348
  Cache-Control: max-age=3600, public  # how long to cache
  Set-Cookie: session=abc; HttpOnly; Secure; SameSite=Lax
  Location: /users/42                  # used with 3xx redirects and 201 Created
  ETag: "abc123"                       # resource version fingerprint

• CORS headers:

  Access-Control-Allow-Origin: https://app.example.com
  Access-Control-Allow-Methods: GET, POST, PUT, DELETE
  Access-Control-Allow-Headers: Content-Type, Authorization
  Access-Control-Max-Age: 86400        # preflight cache duration (seconds)

  (set by the server to permit cross-origin browser requests)
• Common Content-Type values:

  application/json
  application/x-www-form-urlencoded   # HTML form default
  multipart/form-data                 # file uploads
  text/html; charset=utf-8
  text/plain
  application/octet-stream            # arbitrary binary

1xx — Informational

Provisional responses. The request was received; processing continues.

• 100 Continue
  Server received the request headers; client should proceed to send the body.

• 101 Switching Protocols
  Server is switching to the protocol requested (e.g. upgrading HTTP → WebSocket).

2xx — Success

The request was received, understood, and accepted.

• 200 OK
  Standard success. Response body contains the requested data.

• 201 Created
  Resource was created. A Location header should point to the new resource.

• 202 Accepted
  Request accepted for processing, but processing is not complete (async operations).

• 204 No Content
  Success, but no body to return. Common for DELETE and PUT.

• 206 Partial Content
  Response is a partial result due to a Range request (used for resumable downloads, video streaming).

3xx — Redirection

The client must take further action to complete the request. The target URL is given in the Location header.

• 301 Moved Permanently
  Resource has a new permanent URL. Browsers and search engines update their records. Method may change to GET.

• 302 Found
  Temporary redirect. Browsers follow it, but keep the original URL. Method may change to GET.

• 303 See Other
  Redirect to a different resource using GET. Common after a POST to prevent form resubmission (Post/Redirect/Get pattern).

• 304 Not Modified
  Cached version is still valid; no body returned. Sent in response to conditional requests (If-None-Match, If-Modified-Since).

• 307 Temporary Redirect
  Like 302, but the original HTTP method is preserved (a POST stays a POST).

• 308 Permanent Redirect
  Like 301, but the original method is preserved. Preferred over 301 for API redirects.

4xx — Client Errors

The request contains bad syntax or cannot be fulfilled. The problem is on the client side.

• 400 Bad Request
  Malformed request syntax, invalid parameters, or failed validation.

• 401 Unauthorized
  Authentication required or failed. Despite the name, it means unauthenticated — credentials are missing or wrong.

• 403 Forbidden
  Authenticated but not permitted. The server understood the request but refuses to authorize it.

• 404 Not Found
  Resource doesn't exist at this URL. Also used intentionally to hide the existence of a resource (instead of 403).

• 405 Method Not Allowed
  The HTTP method is not supported for this endpoint. Response includes an Allow header listing valid methods.

• 408 Request Timeout
  Client took too long to send the request.

• 409 Conflict
  Request conflicts with the current state of the resource (e.g. duplicate entry, version mismatch).

• 410 Gone
  Resource existed but has been permanently removed (unlike 404, which is ambiguous).

• 413 Content Too Large
  Request body exceeds the server's size limit (e.g. file upload too big).

• 415 Unsupported Media Type
  The Content-Type of the request body is not supported. Usually means sending XML to a JSON-only endpoint.

• 422 Unprocessable Content
  Request is well-formed but semantically invalid (e.g. JSON parses but fails business logic validation). Common in REST APIs.

• 429 Too Many Requests
  Rate limit exceeded. Response often includes Retry-After header indicating when to try again.

5xx — Server Errors

The server failed to fulfil a valid request. The problem is on the server side.

• 500 Internal Server Error
  Generic catch-all for unhandled server errors. Check server logs.

• 501 Not Implemented
  The server doesn't support the functionality required to fulfil the request (e.g. an unrecognised method).

• 502 Bad Gateway
  Server acting as a proxy received an invalid response from an upstream server.

• 503 Service Unavailable
  Server is temporarily unable to handle requests — overloaded or down for maintenance. Often includes a Retry-After header.

• 504 Gateway Timeout
  Proxy/gateway did not receive a timely response from an upstream server.

• 507 Insufficient Storage
  Server cannot store the representation needed to complete the request (WebDAV, but also used in storage APIs).