Paste a response head and this page reads it back line by line, saying
what will actually happen. HTTP headers raise no error when you get them
wrong. A cookie with SameSite=None and no Secure is dropped
by the browser without a word. This page names those places.
Set-Cookie, an Authorization
header — is sent anywhere. URLs in the headers are never fetched either.
| header | value | notes |
|---|
Nothing to flag right now.
Headers object; it is written here.
It follows RFC 9110 and 9112: which characters a name may contain, how whitespace around a
value is dropped, how repeats of one name are joined, and folding with leading whitespace.s-maxage, then max-age, then
Expires − Date, and if none of those are there it falls back to a
guess from Last-Modified (10% of the elapsed time).
Age comes from Age plus the time since Date.Headers object every time the page loads, and the result is printed in the
self-check panel: name normalisation, whitespace around values, how repeats join, and which
characters are refused.Content-Security-Policy is only listed directive by directive; this page does
not decide whether a given URL would pass the policy.
Structured fields (RFC 8941) are read only as far as their dictionary and list shapes.