Unit 3: Headers · Lesson 1 of 5 · 16 min

Reading headers

Headers are name and value lines, and Linux tools slice them easily.

mission

You are
The analyst reviewing the shop.
Situation
Developers will ask you for exact header values, not screenshots.
Goal
Pull single headers out of responses with grep and cut.
Hand in
The Server, Content-Type and Cache-Control values of three pages.

A response as a labelled parcel

01

One header by name

Header names are not case sensitive, so always grep with -i.

learner@web-lab
curl -sI http://127.0.0.1:8000/ | grep -i '^server'
Server: shop/1.4

you should see Server: shop/1.4.

02

Just the value

learner@web-lab
curl -sI http://127.0.0.1:8000/api/products | grep -i '^content-type' | cut -d' ' -f2-
application/json

you should see application/json with no name in front.

03

Only the names

A list of names is handy for comparing two pages side by side.

learner@web-lab
curl -sI http://127.0.0.1:8000/shop | cut -d: -f1
HTTP/1.1 200 OK
Server
Date
Content-Type
Content-Length
X-Content-Type-Options
X-Frame-Options
Referrer-Policy
Content-Security-Policy

you should see The status line, then one header name per line.

04

Spot the difference between two pages

learner@web-lab
diff <(curl -sI http://127.0.0.1:8000/ | cut -d: -f1) <(curl -sI http://127.0.0.1:8000/shop | cut -d: -f1)
6a7,9
> X-Frame-Options
> Referrer-Policy
> Content-Security-Policy

you should see Three headers only /shop sends.

defender tip Frameworks set headers per route. Diffing the head of two pages is the quickest way to find routes that missed a setting.

What a defender takes away

  1. 1grep -i finds a header; cut trims it to the value.
  2. 2Header names are case insensitive, values usually are not.
  3. 3Diff the headers of two routes to find gaps.

Questions

0 of 3 solved

Answer each one from what you find on your lab machine.