HTTP methods, headers, and representation semantics

Mechanism

HTTP carries requests, responses, representation metadata, and caching instructions. Method, authority, path, headers, and body can be interpreted by different layers. Content type controls parsing, while content encoding transforms representation bytes. Protocol-level behavior should be understood before treating an application response difference as a vulnerability.

Practical method

Capture the full request and response, including redirects. Vary method or content type independently. Inspect cache headers, cookies, and body framing. Compare raw bytes with the browser-rendered result and note proxies or gateways that may rewrite messages.

curl -i --max-redirs 0 https://lab.example/fixture
curl -I https://lab.example/fixture

Interpreting evidence

A HEAD response is not always identical to GET handling. Distinguish status, representation, and application state changes instead of using status codes as the sole success criterion.

Pitfalls and limits

Header names are case-insensitive but field syntax has rules. Automatic redirect following can hide intermediate behavior. JSON, form, and multipart parsers can reach different code paths for similar data.