HTTP Header Parser

Yes. The parser auto-detects whether the input is an HTTP request or response based on the first line and parses accordingly. Request lines start with an HTTP method (GET, POST, etc.) while response lines start with HTTP/version.

Yes. Set-Cookie headers are parsed into individual cookies showing name, value, and all flags such as HttpOnly, Secure, SameSite, Path, Domain, and Max-Age.

Standard HTTP/1.1 and HTTP/2 header format with one header per line in the format "Name: Value". You can copy headers directly from browser developer tools.

Requests typically carry host, user-agent, accept, accept-encoding, and cookie; responses answer with content-type, content-length, cache-control, set-cookie, and date. API traffic adds authorization and content-type: application/json on the way in, and rate-limit headers on the way out. RFC 9110 (HTTP semantics, 2022) is the modern reference that defines them all.

Request headers (host, authorization, accept-*) describe what the client wants; response headers (location, set-cookie, retry-after) describe what came back. Some fields appear in both directions (cache-control, content-type), and a few govern the connection itself (connection: keep-alive) rather than the message content. This parser annotates which side each header belongs to.

Per RFC 9110, most repeated fields combine into one comma-separated list - two cache-control lines and one line reading no-cache, no-store are equivalent. Set-Cookie is the documented exception: it can never be comma-merged because Expires dates contain commas, so proxies must forward each Set-Cookie separately. That exception is a classic source of proxy bugs.

Field names became lowercase and travel as HPACK or QPACK-compressed binary frames; each request opens its own stream, and per-connection headers like Host were replaced by the :authority pseudo-header alongside :method, :scheme, and :path. Semantically the fields still follow RFC 9110 - the wire format changed, not the vocabulary.

Whitespace between the field name and the colon (Header : value) - HTTP/1.1 parsing and the HTTP/2 specification both reject it to prevent request smuggling. Also invalid: spaces or non-ASCII bytes inside the field name, control characters in values, and obs-fold (a header continued by an indented line), which RFC 9110 marks deprecated - replace it with a single line or a list value.