🌐 HTTP & Web

← Back to Cheatsheets

A quick-reference for HTTP — the protocol behind every web request. Covers methods, status codes, common headers, and URL structure. Understanding these is useful whether you're building APIs, debugging network issues, or reading server logs.

Protocol versions: HTTP/1.1 · HTTP/2 · HTTP/3 Transport: TCP (HTTP/1.1 & HTTP/2) · QUIC/UDP (HTTP/3) Default ports: 80 (HTTP) · 443 (HTTPS)

Resources: MDN — HTTP docs httpstatuses.io MDN — Headers reference http.cat — visual status codes

URL & Request Structure

▼

Every URL maps to a specific resource. The path and query string are sent to the server; the fragment (#) is browser-only and never sent.

URL Anatomy

scheme://host:port/path?query=value&key=val#fragment

https://api.example.com:443/users/42?expand=profile#bio
│       │               │   │        │                └─ fragment (client-only)
│       │               │   │        └─ query string
│       │               │   └─ path
│       │               └─ port (443 = https default, 80 = http default)
│       └─ host
└─ scheme

URL Encoding

Special characters in query values must be percent-encoded. Spaces become %20 or +, & becomes %26, = becomes %3D.

HTTP Methods

▼

Methods describe the intended action. Safe methods don't modify state. Idempotent methods produce the same result no matter how many times they're called.

GET — retrieve a resource Safe · Idempotent · No request body · Response is cacheable

POST — submit data, create a resource Not safe · Not idempotent · Has request body · Responses usually not cached

PUT — replace a resource entirely Not safe · Idempotent · Has request body · Calling twice is the same as calling once

PATCH — partially update a resource Not safe · Not necessarily idempotent · Has request body

DELETE — remove a resource Not safe · Idempotent · No request body

HEAD — same as GET, headers only Safe · Idempotent · No response body · Used to check if a resource exists or get its metadata

OPTIONS — describe communication options Used by browsers for CORS preflight requests to determine which methods and headers are allowed for a resource

Status Codes

▼

Status codes indicate the result of an HTTP request. The first digit defines the class: 1xx informational, 2xx success, 3xx redirection, 4xx client error, 5xx server error.

1xx — Informational

Provisional responses. The request was received; processing continues.

Code	Name	Description
100	Continue	Server received the request headers; client should proceed to send the body.
101	Switching Protocols	Server is switching to the protocol requested (e.g. upgrading HTTP → WebSocket).

2xx — Success

The request was received, understood, and accepted.

Code	Name	Description
200	OK	Standard success. Response body contains the requested data.
201	Created	Resource was created. A `Location` header should point to the new resource.
202	Accepted	Request accepted for processing, but processing is not complete (async operations).
204	No Content	Success, but no body to return. Common for DELETE and PUT.
206	Partial Content	Response is a partial result due to a `Range` request (used for resumable downloads, video streaming).

3xx — Redirection

The client must take further action to complete the request. The target URL is given in the Location header.

Code	Name	Description
301	Moved Permanently	Resource has a new permanent URL. Browsers and search engines update their records. Method may change to GET.
302	Found	Temporary redirect. Browsers follow it, but keep the original URL. Method may change to GET.
303	See Other	Redirect to a different resource using GET. Common after a POST to prevent form resubmission (Post/Redirect/Get pattern).
304	Not Modified	Cached version is still valid; no body returned. Sent in response to conditional requests (`If-None-Match`, `If-Modified-Since`).
307	Temporary Redirect	Like 302, but the original HTTP method is preserved (a POST stays a POST).
308	Permanent Redirect	Like 301, but the original method is preserved. Preferred over 301 for API redirects.

4xx — Client Errors

The request contains bad syntax or cannot be fulfilled. The problem is on the client side.

Code	Name	Description
400	Bad Request	Malformed request syntax, invalid parameters, or failed validation.
401	Unauthorized	Authentication required or failed. Despite the name, it means unauthenticated — credentials are missing or wrong.
403	Forbidden	Authenticated but not permitted. The server understood the request but refuses to authorize it.
404	Not Found	Resource doesn't exist at this URL. Also used intentionally to hide the existence of a resource (instead of 403).
405	Method Not Allowed	The HTTP method is not supported for this endpoint. Response includes an `Allow` header listing valid methods.
408	Request Timeout	Client took too long to send the request.
409	Conflict	Request conflicts with the current state of the resource (e.g. duplicate entry, version mismatch).
410	Gone	Resource existed but has been permanently removed (unlike 404, which is ambiguous).
413	Content Too Large	Request body exceeds the server's size limit (e.g. file upload too big).
415	Unsupported Media Type	The `Content-Type` of the request body is not supported. Usually means sending XML to a JSON-only endpoint.
422	Unprocessable Content	Request is well-formed but semantically invalid (e.g. JSON parses but fails business logic validation). Common in REST APIs.
429	Too Many Requests	Rate limit exceeded. Response often includes `Retry-After` header indicating when to try again.

5xx — Server Errors

The server failed to fulfil a valid request. The problem is on the server side.

Code	Name	Description
500	Internal Server Error	Generic catch-all for unhandled server errors. Check server logs.
501	Not Implemented	The server doesn't support the functionality required to fulfil the request (e.g. an unrecognised method).
502	Bad Gateway	Server acting as a proxy received an invalid response from an upstream server.
503	Service Unavailable	Server is temporarily unable to handle requests — overloaded or down for maintenance. Often includes a `Retry-After` header.
504	Gateway Timeout	Proxy/gateway did not receive a timely response from an upstream server.
507	Insufficient Storage	Server cannot store the representation needed to complete the request (WebDAV, but also used in storage APIs).

Headers

▼

Headers pass metadata alongside a request or response. Request headers describe the client; response headers describe the server's reply and how to handle it.

Request Headers

Content-Type: application/json
Accept: application/json
Authorization: Bearer <token>
Cookie: session=abc123
User-Agent: Mozilla/5.0 ...
Origin: https://example.com

Response Headers

Content-Type: application/json; charset=utf-8
Content-Length: 348
Cache-Control: max-age=3600, public
Set-Cookie: session=abc; HttpOnly; Secure; SameSite=Lax
Location: /users/42
ETag: "abc123"

CORS Headers

Access-Control-Allow-Origin: https://app.example.com
Access-Control-Allow-Methods: GET, POST, PUT, DELETE
Access-Control-Allow-Headers: Content-Type, Authorization
Access-Control-Max-Age: 86400

Set by the server to permit cross-origin browser requests.

Common Content-Type Values

application/json
application/x-www-form-urlencoded   # HTML form default
multipart/form-data                 # file uploads
text/html; charset=utf-8
text/plain
application/octet-stream            # arbitrary binary

Full Request / Response Example (JSON API)

POST /users HTTP/1.1
Host: api.example.com
Content-Type: application/json
Authorization: Bearer eyJhbGci...

{
    "name": "Alice",
    "email": "alice@example.com"
}

HTTP/1.1 201 Created
Content-Type: application/json
Location: /users/42

{
    "id": 42,
    "name": "Alice",
    "email": "alice@example.com",
    "createdAt": "2024-01-15T10:30:00Z"
}