Free tool · runs in your browser
HTTP Security Inspector
Powered by Fetch Headers (WHATWG), HTTP Semantics (IETF)
Raw HTTP message
HTTP/1 request or response copied from Burp, a proxy or a terminal. Limit: 1 MiB. Nothing is sent or replayed.
Summary
Security review
Headers preserved in order
| # | Name | Value |
|---|
Response cookies
| Cookie | Secure | HttpOnly | SameSite | Security review |
|---|
Sanitised export
Sanitised curl command
What is an HTTP message?
An HTTP message combines a request or status line, header fields and an optional body. In HTTP/1, intermediaries must agree exactly on the message boundaries. Differences around Content-Length, Transfer-Encoding or separators can desynchronise a proxy and server.
HTTP/1 message boundaries
The empty line separates headers from the body. Content-Length announces a byte length; Transfer-Encoding: chunked frames the body in chunks. A message carrying both, different lengths or lines tolerated by only some components should be rejected before reaching another parser.
Headers, cookies and CORS
Security headers are contextual. A JSON API does not need the same controls as an HTML page, and a JavaScript-readable cookie may be intentional. The tool therefore produces review points, not a compliance certificate.
?Frequently asked questions
Does the tool send the request?
No. It contains no network client. It only splits the pasted text and uses the browser Headers API to check each name and value.
Can the tool prove request smuggling?
No. It flags ambiguous forms such as CL.TE, conflicting lengths or bare LF. A vulnerability depends on the exact front-end and back-end parsers and must be validated in an authorised environment.
What does the sanitised export hide?
Authorization, Proxy-Authorization, Cookie, Set-Cookie, headers that look like secrets and sensitive URL parameters. Named secrets in JSON and form bodies are replaced; other bodies are omitted. Always review the export before sharing.
+More tools
- *-srcCSP Evaluator
Find the bypasses in a Content Security Policy.
- ://URL Inspector
Break down and normalise a URL with the browser’s actual parser.
- APIOpenAPI Auditor
Inventory routes, authentication schemes and weaknesses in an API contract.
Technical assessment
Request an application or infrastructure assessment
For an assessment by our team, specify the systems involved, available access and requested tests in your enquiry.