HTTP Working Group

https://httpwg.org/
Admin
The HTTP Working Group (HTTPbis) is an IETF working group that develops and maintains HTTP...
Tokens:553,528
Snippets:7,716
Trust Score:9.9
Update:1 month ago
Show doc for...
Tokens:
Raw
### Example HTTP/1.1 GET Request with Host Header

Source: https://httpwg.org/http-core/draft-ietf-httpbis-semantics-latest.html

Illustrates a basic HTTP/1.1 GET request, showing the placement of the Host header.

```http
GET /pub/WWW/ HTTP/1.1
Host: www.example.org


```

--------------------------------

### HTTP Client Request Example

Source: https://httpwg.org/http-core/draft-ietf-httpbis-semantics-latest.html

Illustrates a typical HTTP/1.1 GET request for a resource. Includes essential headers like User-Agent, Host, and Accept-Language.

```http
GET /hello.txt HTTP/1.1
User-Agent: curl/7.64.1
Host: www.example.com
Accept-Language: en, mi


```

--------------------------------

### Minimal response example

Source: https://httpwg.org/specs/rfc7240.html

Example of a minimal response following a return=minimal preference.

```HTTP
HTTP/1.1 201 Created
Location: http://example.org/collection/123

```

--------------------------------

### Example of a miscapitalized __SECURE- prefix

Source: https://httpwg.org/http-extensions/draft-ietf-httpbis-rfc6265bis.html

An example of a Set-Cookie header that might be incorrectly accepted by a case-sensitive user agent.

```http
Set-Cookie: __SECURE-SID=12345
```

--------------------------------

### Examples of accepted Set-Cookie header fields

Source: https://httpwg.org/http-extensions/draft-ietf-httpbis-rfc6265bis.html

A list of Set-Cookie headers that would be accepted if set from a secure origin.

```http
Set-Cookie: __Secure-SID=12345; Domain=site.example; Secure
Set-Cookie: __secure-SID=12345; Domain=site.example; Secure
Set-Cookie: __SECURE-SID=12345; Domain=site.example; Secure
Set-Cookie: __Host-SID=12345; Secure; Path=/
Set-Cookie: __host-SID=12345; Secure; Path=/
Set-Cookie: __HOST-SID=12345; Secure; Path=/
```

--------------------------------

### Example of a malicious miscapitalized cookie

Source: https://httpwg.org/http-extensions/draft-ietf-httpbis-rfc6265bis.html

An example of an attacker-supplied Set-Cookie header intended to impersonate a prefixed cookie.

```http
Set-Cookie: __SeCuRe-SID=evil
```

--------------------------------

### Rejected __Host-SID Cookie Examples

Source: https://httpwg.org/http-extensions/draft-ietf-httpbis-rfc6265bis.html

A list of Set-Cookie header fields that are always rejected because they fail to meet the __Host- prefix requirements.

```http
Set-Cookie: __Host-SID=12345
Set-Cookie: __Host-SID=12345; Secure
Set-Cookie: __Host-SID=12345; Domain=site.example
Set-Cookie: __Host-SID=12345; Domain=site.example; Path=/
Set-Cookie: __Host-SID=12345; Secure; Domain=site.example; Path=/
```

--------------------------------

### Ambiguous Set-Cookie header example

Source: https://httpwg.org/http-extensions/draft-ietf-httpbis-rfc6265bis.html

An example of a Set-Cookie header that is ambiguous because the comma character can be interpreted as a separator or part of a path value.

```http
Set-Cookie: a=b;path=/c,d=e
```

--------------------------------

### Example of multiple cookies sent to a server

Source: https://httpwg.org/http-extensions/draft-ietf-httpbis-rfc6265bis.html

The resulting Cookie header sent by a user agent when both a legitimate and a malicious cookie exist.

```http
Cookie: __Secure-SID=12345; __SeCuRe-SID=evil
```

--------------------------------

### Accepted __Host-SID Cookie Example

Source: https://httpwg.org/http-extensions/draft-ietf-httpbis-rfc6265bis.html

A Set-Cookie header field that is accepted if set from a secure origin, as it correctly includes the Secure attribute and Path=/ without a Domain attribute.

```http
Set-Cookie: __Host-SID=12345; Secure; Path=/
```

--------------------------------

### Accepted __Secure-SID Cookie Example

Source: https://httpwg.org/http-extensions/draft-ietf-httpbis-rfc6265bis.html

A Set-Cookie header field that is accepted if set from a secure origin because it includes the required Secure attribute.

```http
Set-Cookie: __Secure-SID=12345; Domain=site.example; Secure
```

--------------------------------

### Rejected __Secure-SID Cookie Example

Source: https://httpwg.org/http-extensions/draft-ietf-httpbis-rfc6265bis.html

A Set-Cookie header field that is rejected by a conformant user agent because it lacks the required Secure attribute.

```http
Set-Cookie: __Secure-SID=12345; Domain=site.example
```

--------------------------------

### Examples of rejected Set-Cookie header fields

Source: https://httpwg.org/http-extensions/draft-ietf-httpbis-rfc6265bis.html

A list of Set-Cookie headers that would be rejected by a conformant user agent due to prefix or attribute violations.

```http
Set-Cookie: __Secure-SID=12345; Domain=site.example
Set-Cookie: __secure-SID=12345; Domain=site.example
Set-Cookie: __SECURE-SID=12345; Domain=site.example
Set-Cookie: __Host-SID=12345
Set-Cookie: __host-SID=12345; Secure
Set-Cookie: __host-SID=12345; Domain=site.example
Set-Cookie: __HOST-SID=12345; Domain=site.example; Path=/
Set-Cookie: __Host-SID=12345; Secure; Domain=site.example; Path=/
Set-Cookie: __host-SID=12345; Secure; Domain=site.example; Path=/
Set-Cookie: __HOST-SID=12345; Secure; Domain=site.example; Path=/
```

--------------------------------

### Example Accept header values

Source: https://httpwg.org/specs/rfc9110.html

Examples demonstrating media type preferences and quality weighting.

```HTTP
Accept: audio/*; q=0.2, audio/basic
```

```HTTP
Accept: text/plain; q=0.5, text/html,
       text/x-dvi; q=0.8, text/x-c
```

```HTTP
Accept: text/*, text/plain, text/plain;format=flowed, */*
```

```HTTP
Accept: text/*;q=0.3, text/plain;q=0.7, text/plain;format=flowed,
       text/plain;format=fixed;q=0.4, */*;q=0.5
```

--------------------------------

### GET request to a stored resource

Source: https://httpwg.org/wg-materials/ietf122/ietf-httpbis-2025-03-query.xhtml

An example of a GET request to a resource identified by a Location header.

```http
GET /stored/42 HTTP/1.1
_...header fields ommitted..._
```

--------------------------------

### HTTP GET Request Example

Source: https://httpwg.org/specs/rfc7230.html

A standard GET request message targeting a text file on a host.

```http
GET /hello.txt HTTP/1.1
User-Agent: curl/7.16.3 libcurl/7.16.3 OpenSSL/0.9.7l zlib/1.2.3
Host: www.example.com
Accept-Language: en, mi


```

--------------------------------

### Example Accept-CH Header

Source: https://httpwg.org/specs/rfc8942.html

This example shows how to advertise server support for specific Client Hints using the Accept-CH response header. It should be added as early as possible in the response.

```http
Accept-CH: Sec-CH-Example, Sec-CH-Example-2

```

--------------------------------

### Equivalent Prefer Header Examples

Source: https://httpwg.org/specs/rfc7240.html

Demonstrates equivalent ways to specify a 'foo' preference with a 'bar' parameter, including cases with empty or no values.

```http
Prefer: foo; bar
```

```http
Prefer: foo; bar=""
```

```http
Prefer: foo=""; bar
```

--------------------------------

### Conditional GET Request with Accept-Encoding

Source: https://httpwg.org/specs/rfc7232.html

Example of a GET request that includes the Accept-Encoding header to demonstrate content negotiation.

```http
GET /index HTTP/1.1
Host: www.example.com
Accept-Encoding: gzip
```

--------------------------------

### Example From Header

Source: https://httpwg.org/specs/rfc7231.html

Shows a sample email address value for the From header.

```text
  From: webmaster@example.org
```

--------------------------------

### HTTP GET Request with Want-Repr-Digest

Source: https://httpwg.org/specs/rfc9530.html

Examples of clients requesting specific digest algorithms using the Want-Repr-Digest header.

```http
GET /items/123 HTTP/1.1
Host: foo.example
Want-Repr-Digest: sha-256=3, sha=10
```

```http
GET /items/123 HTTP/1.1
Host: foo.example
Want-Repr-Digest: sha=10
```

```http
GET /items/123 HTTP/1.1
Host: foo.example
Want-Repr-Digest: sha=10
```

--------------------------------

### Example OPTIONS Request

Source: https://httpwg.org/specs/rfc5789.html

An example of an OPTIONS request sent to a resource to discover supported methods.

```http
OPTIONS /example/buddies.xml HTTP/1.1
Host: www.example.com
```

--------------------------------

### Response without Content-Encoding

Source: https://httpwg.org/specs/rfc7232.html

Example HTTP response for a GET request that does not use content coding, including an ETag.

```http
HTTP/1.1 200 OK
Date: Fri, 26 Mar 2010 00:05:00 GMT
ETag: "123-a"
Content-Length: 70
Vary: Accept-Encoding
Content-Type: text/plain

Hello World!
Hello World!
Hello World!
Hello World!
Hello World!
```

--------------------------------

### Parameters Example

Source: https://httpwg.org/specs/rfc8941.html

Example demonstrating parameters associated with List members, including Items and Inner Lists with parameters.

```http-fields
Example-List: abc;a=1;b=2; cde_456, (ghi;jk=4 l);q="9";r=w
```

--------------------------------

### Response with Content-Encoding (gzip)

Source: https://httpwg.org/specs/rfc7232.html

Example HTTP response for a GET request that uses gzip content coding, including an ETag.

```http
HTTP/1.1 200 OK
Date: Fri, 26 Mar 2010 00:05:00 GMT
ETag: "123-b"
Content-Length: 43
Vary: Accept-Encoding
Content-Type: text/plain
Content-Encoding: gzip

_...binary data..._
```
Tokens:
Raw