Final HTTP inspection

You have the pieces. Now read one real page the way a debugger would.

Open the Network panel on a site you use daily. Reload with DevTools open. Select the main document request (type Doc or the first HTML row). Work through this list:

1. URL, method, and protocol version. Is it GET? h2 or h3?
2. Status code and redirect chain. Did you get 200 directly or follow a 301/302 first?
3. Request and response content types. Does Content-Type match what you see in the Preview tab?
4. Cache freshness and validators. Read Cache-Control, ETag, and whether the second reload shows (disk cache).
5. Cookies sent or set. Any Cookie on the request? Any Set-Cookie on the response?
6. CORS and security headers. Look for access-control-*, content-security-policy, strict-transport-security.
7. Transferred size and timing. How long did DNS, TLS, waiting (TTFB), and download take?

Write your answers in a note. One paragraph per item is enough. If you cannot explain a header, look it up or revisit the lesson that covered it.

Next, pick one stylesheet or image the document triggered. Click that row and repeat the inspection. Static assets usually carry longer max-age values and different Content-Type than HTML. Explain why the caching policy differs. HTML changes when you publish. A hashed CSS file at /app.a1b2.css can sit in cache for a year because the URL changes when the content changes.

Finally, reproduce a safe public request in the terminal:

curl -I https://flaviocopes.com/

Compare the headers with what the browser showed. Differences are normal. The browser may send cookies, different Accept and Accept-Encoding values, and hit a different cache layer. curl shows what a plain client gets without a session.

You now have the vocabulary to explain an HTTP exchange instead of treating the Network panel as a wall of data. Status line, headers, body, cache, cookies, CORS, TLS, and protocol version all tell part of the same story.

Try this capstone on your own project: load the homepage, inspect the document request, then inspect one API call or asset it pulls in. Explain both out loud to someone (or to yourself). If you stumble, that is the lesson to revisit.

Quick check

Start quiz

Result

You got of right.

Try again

Quick check

Start quiz

Result

You got of right.

Try again