TRACE

HTTP basics

Use these notes to understand web traffic from a local app or an explicitly authorized lab. Examples use localhost only.

All traces

Request and response

Part	Purpose
Method	The requested operation, such as GET or POST.
Path	The resource path on the selected host.
Headers	Metadata about the request or response.
Status	A three-digit result code returned by the server.
Body	Optional content sent by the client or server.

curl -I http://127.0.0.1:3000curl -sS -D headers.txt -o body.txt http://127.0.0.1:3000

Security headers

Header	Purpose
Content-Security-Policy	Restricts the sources and capabilities a page may use.
Strict-Transport-Security	Asks browsers to use HTTPS for a host after a secure connection.
X-Content-Type-Options	Helps prevent browsers from interpreting a response as a different media type.
Referrer-Policy	Controls how much referrer information is sent with requests.
Permissions-Policy	Controls access to selected browser features.

Choose policies for the application’s actual needs and test for compatibility. A header’s presence alone does not prove an application is secure.

Cookies and sessions

Attribute	Why it matters
Secure	Restricts a cookie to secure transport.
HttpOnly	Prevents ordinary client-side scripts from reading the cookie.
SameSite	Limits when a browser attaches a cookie to cross-site requests.
Path / Domain	Limits the hosts and URL paths for which a cookie is sent.

More traces

Security foundations
Core principles for safer systems and everyday security decisions.
Security research commands
Searchable notes for local web checks, safe file inspection and reproducible research.
Web security
Core concepts, safe practice and defensive checks for web applications.

Questions

What does an HTTP status code tell me?

It gives a broad result category for a request, such as success, redirection, client error or server error. The response body and application behavior provide additional context.

Why use localhost in the examples?

The examples are intentionally limited to a local service so they can be practised without sending test traffic to someone else’s system.