HTTP Responses

HTTP - Responses

After receiving and interpreting a client’s request message, a server responds with an HTTP response message. The structure of a response message is similar to a request:

• A Status-Line
• Zero or more Header fields (General, Response, Representation headers) followed by CRLF
• An Empty line (CRLF) indicating the end of the header fields
• Optionally, a Message-body

The Status-Line has the following structure:

Status-Line = HTTP-Version SP Status-Code SP Reason-Phrase CRLF

HTTP Version

This indicates the version of HTTP the server is using for the response. For example:

HTTP-Version = HTTP/1.1

Servers supporting HTTP/2 or HTTP/3 will handle versioning differently at the framing layer but typically maintain HTTP/1.1 semantics for the status line concept.

Status Code

The Status-Code is a 3-digit integer that indicates the result of the client’s request. The first digit defines the class of response:

S.N.	Code Class	Description
1	1xx: Informational	The request was received and the process is continuing. (e.g., 100 Continue)
2	2xx: Success	The action was successfully received, understood, and accepted. (e.g., 200 OK, 201 Created)
3	3xx: Redirection	Further action must be taken by the client to complete the request. (e.g., 301 Moved Permanently, 302 Found)
4	4xx: Client Error	The request contains bad syntax or cannot be fulfilled by the server. (e.g., 400 Bad Request, 401 Unauthorized, 404 Not Found)
5	5xx: Server Error	The server failed to fulfill an apparently valid request. (e.g., 500 Internal Server Error, 503 Service Unavailable)

A comprehensive list of status codes is available in a dedicated chapter. HTTP applications are not required to understand all registered status codes but should handle the class of the response.

Reason-Phrase

The Reason-Phrase is a short, human-readable textual description of the Status-Code. It is intended for informational purposes only and does not affect the protocol’s interpretation of the response. Examples: OK, Not Found, Internal Server Error.

Clients should rely on the numerical Status-Code, not the Reason-Phrase, for determining the outcome.

Response Header Fields

Response header fields allow the server to pass additional information about the response that cannot be placed in the Status-Line. These headers provide details about the server, the resource, or how the client should handle the response.

Common response headers include:

• Date: The date and time at which the response was originated.
• Server: Information about the server software used.
• Content-Type: The media type of the response body.
• Content-Length: The length of the response body in bytes.
• Content-Encoding: Any encoding (e.g., compression) applied to the response body.
• Last-Modified / ETag: Validators for caching.
• Cache-Control / Expires: Caching directives.
• Set-Cookie: Instructs the client to store a cookie.
• Location: Used in redirection responses (3xx) to specify the new URL.
• Allow: Lists the HTTP methods supported by the resource (often with 405 Method Not Allowed).
• WWW-Authenticate: Sent with 401 Unauthorized responses to define the authentication challenge.
• Strict-Transport-Security: Instructs browsers to only use HTTPS for future requests to this domain.
• Content-Security-Policy: Helps prevent XSS attacks by specifying allowed content sources.

Developers can also include custom headers for application-specific purposes.

Examples of Response Messages

Example 1: Successful response with HTML content (200 OK)

HTTP/1.1 200 OK
Date: Mon, 21 Feb 2022 12:30:00 GMT
Server: MyWebServer/1.0
Last-Modified: Sun, 20 Feb 2022 10:00:00 GMT
ETag: "xyz123abc"
Content-Type: text/html; charset=utf-8
Content-Length: 150
Connection: keep-alive
Cache-Control: max-age=3600

<!DOCTYPE html>
<html>
<head><title>Success</title></head>
<body><h1>Hello, World!</h1><p>This is a sample page.</p></body>
</html>

Example 2: Resource not found (404 Not Found)

HTTP/1.1 404 Not Found
Date: Mon, 21 Feb 2022 12:35:00 GMT
Server: MyWebServer/1.0
Content-Type: application/json; charset=utf-8
Content-Length: 36
Connection: close

{
  "error": "Resource not found"
}

Example 3: Redirection (301 Moved Permanently)

HTTP/1.1 301 Moved Permanently
Date: Mon, 21 Feb 2022 12:40:00 GMT
Server: MyWebServer/1.0
Location: https://www.newexample.com/newpage.html
Content-Length: 0
Connection: keep-alive

(No message body for 301, or a short HTML note for older clients)