Overview
For every request, the server sends back an HTTP response. Its structure mirrors the request and carries the status, metadata, and the actual content (a page, an image, JSON). This lesson explains what an HTTP response contains and how to read it.
Learning objectives
- Describe the structure of an HTTP response.
- Identify the status line, headers, and body.
- Interpret what a response tells you about the result.
Core concept
An HTTP response has three parts, paralleling the request:
- Status line — the HTTP version, a numeric status code, and a reason phrase, e.g.
HTTP/1.1 200 OK. - Headers — metadata about the response (content type, length, caching directives, cookies to set, security headers, etc.).
- Body — the actual content being returned (HTML, an image, JSON data), when applicable.
The status code (covered in detail in a later lesson) is the quick summary of what happened.
How it works
After receiving a request, the server processes it and sends back the status line first, then headers, a blank line, then the body. Key headers shape how the client handles the content: Content-Type tells the browser how to interpret the body (e.g. text/html), Content-Length gives its size, Set-Cookie stores state on the client, and various security headers instruct the browser on safe handling. The client reads the status and headers, then renders or processes the body accordingly.
Practical example
A successful page load returns:
HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Content-Length: 1256
Set-Cookie: session=abc123; HttpOnly
<!DOCTYPE html> ... (the page HTML) ...
The 200 OK status says the request succeeded, Content-Type tells the browser to render HTML, and Set-Cookie stores a session cookie (with HttpOnly, which keeps scripts from reading it).
Cybersecurity relevance
Responses are full of security-relevant signals. Security headers (e.g. Content-Security-Policy, Strict-Transport-Security) instruct the browser to reduce risk; their presence or absence is a common assessment finding. Set-Cookie attributes (HttpOnly, Secure, SameSite) determine how well session cookies resist theft. Error responses can leak information (stack traces, versions). Reading responses carefully is central to web security analysis.
Common mistakes
- Ignoring the status code — it is the first thing that tells you the outcome.
- Overlooking security-relevant headers (CSP, HSTS, cookie flags).
- Assuming every response has a body — some (e.g. certain redirects or
204 No Content) do not.
Key takeaways
- An HTTP response has a status line (version, status code, reason), headers (metadata), and an optional body (the content).
- Headers like Content-Type, Set-Cookie, and security headers govern how the client handles the response.
- Responses carry key security signals — security headers, cookie flags, and potential information leakage in errors.
Check your understanding
- What are the three parts of an HTTP response, and what does the status line summarize?
- Name two response headers that carry security implications and what each controls.