> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/web-appsec/web-application-fundamentals/http-request-and-response.md).
# HTTP Request and Response
## **HTTP Request and Response Headers**
### **1. HTTP Request Headers**
HTTP request headers are sent by the client (typically a web browser or an application) to the server to provide **additional information** about the request. These headers help the server process the request appropriately.
#### **Commonly Used HTTP Request Headers:**
* **Host**: Specifies the hostname of the server the client wants to communicate with.
* **User-Agent**: Identifies the client application or browser making the request.
* **Accept**: Indicates the media types or content formats that the client can handle or prefers in the response.
* **Content-Type**: Specifies the media type of the content in the request body (if applicable).
* **Authorization**: Provides credentials or authentication tokens for accessing protected resources.
* **Cookie**: Contains previously stored cookies to help the server identify the user or maintain session state.
HTTP Request Headers
***
### **2. HTTP Response Headers**
HTTP response headers are sent by the server **back to the client** as part of the HTTP response. These headers provide **metadata about the response** and may include instructions for the client.
#### **Commonly Used HTTP Response Headers:**
* **Content-Type**: Specifies the media type or format of the response content.
* **Content-Length**: Indicates the size of the response body in bytes.
* **Cache-Control**: Provides caching instructions for the client or intermediary servers.
* **Set-Cookie**: Sends cookies to be stored by the client for future requests.
* **Location**: Redirects the client to a new URL if the response indicates a redirection.
* **Server**: Specifies the software or server name that generated the response.
HTTP Response Headers
***
## **HTTP Request and Response Body**
### **1. HTTP Request Body**
The **HTTP request body** contains **additional data** sent from the client to the server. It is primarily used with HTTP methods such as **POST, PUT, and PATCH** to submit data for processing or storage. The request body typically contains structured data in formats such as:
* **JSON (JavaScript Object Notation)**
* **XML (eXtensible Markup Language)**
* **Form Data (application/x-www-form-urlencoded or multipart/form-data for file uploads)**
***
### **2. HTTP Response Body**
The **HTTP response body** contains the **data or resource** sent by the server back to the client in response to an HTTP request. This body can include:
* **HTML content** (for rendering web pages)
* **JSON or XML data** (for APIs and web services)
* **Images, videos, or other media files**
***
## **HTTP Request Methods**
* **GET**: Retrieves data from the server without modification. Commonly used for fetching web pages, images, and documents.
* **POST**: Submits data to the server, often creating a new resource (e.g., form submissions, file uploads).
* **HEAD**: Similar to GET but returns only response headers, useful for checking resource metadata.
* **PUT**: Updates or creates a resource at a specific URI, replacing existing data. Idempotent.
* **DELETE**: Removes a specified resource from the server. Idempotent.
* **CONNECT**: Establishes a network connection, often for HTTPS tunneling.
* **OPTIONS**: Retrieves supported HTTP methods and server capabilities for a resource.
***
## **HTTP Status Codes**
HTTP status codes are **three-digit numbers** returned by a server in response to an HTTP request. These codes indicate the **status of the request** and the corresponding response. They are grouped into different categories based on their meaning:
### **1. Informational (100 - 199)**
These status codes indicate that the request has been received and the server is continuing the process.
* **100 Continue**: The server acknowledges the initial request and asks the client to continue sending the remaining data.
## **2. Success (200 - 299)**
Success status codes indicate that the request was successfully processed.
* **200 OK**: The request was successful, and the server returned the requested content.
* **201 Created**: A new resource has been successfully created as a result of the request.
* **204 No Content**: The request was successfully processed, but the server does not return any content.
## **3. Redirection (300 - 399)**
These status codes indicate that further action is required for the client to complete the request.
* **301 Moved Permanently**: The requested resource has been permanently moved to a new URL, and clients should update their references.
* **302 Found**: The resource has been temporarily moved to another location. Clients should continue using the original URL.
* **304 Not Modified**: The requested resource has not changed since the last request, allowing the client to use a cached version.
### **4. Client Errors (400 - 499)**
Client error status codes indicate that the request contains incorrect syntax or cannot be fulfilled by the server.
* **400 Bad Request**: The request cannot be processed due to invalid syntax, malformed data, or other client-side errors.
* **401 Unauthorized**: Authentication is required, and the client must provide valid credentials to access the resource.
* **404 Not Found**: The requested resource does not exist on the server.
### **5. Server Errors (500 - 599)**
Server error status codes indicate that the server encountered an issue while processing the request.
* **500 Internal Server Error**: A generic error indicating an unexpected condition encountered by the server.
* **503 Service Unavailable**: The server is temporarily unable to handle the request due to maintenance or overload, advising the client to retry later.