HTTP cheat sheet

Methods

GET

Read. Safe, repeatable

POST

Create something or run an action

PUT

Replace a whole thing. Repeating it gives the same result

PATCH

Change part of a thing

DELETE

Remove. Repeating it gives the same result

OPTIONS

Ask what is allowed (used by CORS checks)

Status codes

200 OK / 201 Created / 204 No Content

It worked

301 Moved Permanently / 302 Found

Go to another address

304 Not Modified

Your cached copy is still good

400 Bad Request

The request is wrong

401 Unauthorized

Not signed in

403 Forbidden

Signed in but not allowed

404 Not Found

No such thing

409 Conflict

Clashes with the current state

429 Too Many Requests

Slow down (rate limit)

500 Internal Server Error

The server failed

502 / 503 / 504

Bad gateway / unavailable / gateway timeout

2xx worked, 3xx redirect, 4xx the client made a mistake, 5xx the server made a mistake.

Common headers

Content-Type: application/json

What the body is

Authorization: Bearer <token>

Who is asking

Cache-Control: max-age=3600

How long it may be reused

ETag / If-None-Match

Check if a cached copy is still current

Accept: application/json

What the client wants back

Location: /new-address

Where a redirect or a created item is

Cookies and CORS

Set-Cookie: id=1; HttpOnly; Secure; SameSite=Lax

A safe cookie: not readable by scripts, HTTPS only, limited cross-site sending

Access-Control-Allow-Origin: https://app.com

Allow that site to read the response in a browser

Access-Control-Allow-Methods / -Headers

Which methods and headers the other site may use

Try it with curl

curl -i https://example.com

Show headers and body

curl -X POST -H "Content-Type: application/json" -d '{"a":1}' URL

Send JSON

curl -H "Authorization: Bearer TOKEN" URL

Send a token