The Anatomy of an HTTP Request
Every interaction your browser has with a web server — loading a page, submitting a form, calling an API — is expressed as an HTTP request. Understanding what these requests contain, why each field exists, and how attackers manipulate specific fields is one of the most foundational skills in web security.
The Request Line
Every HTTP request opens with a single line called the request line. It contains three space-separated components:
POST /api/v1/orders HTTP/1.1- Method (
POST): describes the intended action. The most common methods are GET (retrieve data), POST (submit data to create or process), PUT (replace a resource), PATCH (partially update a resource), and DELETE (remove a resource). The server is expected to interpret each method differently — a GET request should never modify server state, and a DELETE request should remove a resource. - Path (
/api/v1/orders): the URL path identifies which resource the request targets. Paths often embed identifiers (such as/api/v1/orders/42) that the server uses to look up a specific record. - Protocol version (
HTTP/1.1): declares which version of HTTP the client speaks. HTTP/1.1 is still dominant for request-level understanding, though HTTP/2 and HTTP/3 use binary framing at the transport layer.
Headers
Below the request line comes a set of headers — key-value pairs separated by a colon. Headers carry metadata about the request: who is making it, what format the body is in, what cookies the client holds, and much more.
Common Headers and Their Security Relevance
| Header | Purpose | Security implication |
|---|---|---|
Host | Declares the target virtual host | Must be validated server-side; forging it can bypass host-based routing controls or enable web cache poisoning |
Authorization | Carries credentials or tokens (e.g., Bearer <JWT>) | The primary identity proof for API calls; must be validated cryptographically |
Cookie | Sends session tokens to the server | Session fixation, cookie theft via XSS, and missing HttpOnly/Secure flags are common attack surfaces |
Content-Type | Declares the body format (e.g., application/json) | Servers that ignore this header and parse body in the wrong format can be confused; some CSRF bypasses rely on Content-Type mismatches |
X-Forwarded-For | Added by proxies to pass the original client IP | Fully attacker-controlled; never trust it for security decisions without additional validation |
Referer | The page the request originated from | Useful for CSRF token validation patterns; can leak sensitive URL parameters |
User-Agent | Identifies the client software | Easily forged; useful for fingerprinting but not for security enforcement |
The Blank Line and Body
After the headers, a single blank line separates them from the optional request body. GET and DELETE requests typically have no body. POST, PUT, and PATCH requests carry data in the body — a JSON object, a form-encoded string, multipart file data, or raw bytes, depending on the Content-Type header.
HTTP Methods and Security
Method semantics matter for security in two important ways.
Access control by method. A server that properly checks authorization for GET /api/v1/orders may forget to add the same check for DELETE /api/v1/orders/42. Testing all methods on every endpoint is a standard part of API penetration testing.
CSRF sensitivity by method. Cross-Site Request Forgery (CSRF) exploits the fact that browsers attach cookies automatically to same-origin requests triggered by third-party pages. Simple requests — GET, and POST with form-encoded or plain-text bodies — can be triggered cross-site without a preflight check. Non-simple methods (PUT, PATCH, DELETE) trigger a CORS preflight that the browser will not skip, providing a degree of protection — but only if the server correctly enforces CORS policy.
What You Will Explore
In the interactive panel, you will click on five individual segments of a real HTTP request to read detailed annotations. Pay special attention to which segments are attacker-controlled and which the server trusts without verification.