HTTP Header Diff Checker
Compare HTTP header sets while preserving case-insensitive names, repeated fields, malformed lines, and redaction needs.
Added, removed, changed and unchanged HTTP fields will appear here with repeated-value and malformed-line details.
HTTP Field Names Ignore Case; Your Diff Tool Should Too
RFC 9110 defines HTTP field names as case-insensitive. content-type, Content-Type and CONTENT-TYPE therefore identify the same field name in HTTP semantics. Treating capitalization alone as a deployment change produces noisy diffs.
Yoryantra normalizes the comparison key to lowercase while keeping a readable display name. HTTP/2 and HTTP/3 pseudo-fields such as :status are handled separately because their syntax is not an ordinary HTTP field line.
Repeated Field Lines Are Data, Not Formatting Noise
HTTP permits many fields to be repeated, and RFC 9110 generally defines combination by preserving the order of field-line values. A diff that converts every field into one dictionary string before comparison can lose that evidence.
Every parsed field line stays in source order. If the before response contains two Warning lines and the after response reverses or changes them, that remains visible instead of being flattened away.
Set-Cookie Is the Classic Reason “Just Join Duplicates With a Comma” Is Dangerous
Set-Cookie commonly appears once per cookie and its syntax includes commas in places where generic list combination is unsafe. HTTP specifications call out Set-Cookie as a field that does not follow the ordinary combination model.
The checker therefore preserves each Set-Cookie line independently. Sensitive redaction is on by default so session identifiers do not leak into screenshots or copied comparison reports.
Whitespace Around a Field Value Is Different From Whitespace Inside the Value
HTTP syntax permits optional whitespace around field values in serialized messages. A proxy might emit Cache-Control: no-cache while another emits spacing around the same value. That surrounding whitespace is removed by the parser before comparison.
Internal characters are preserved. The comparison does not reorder CSP directives, split Cache-Control tokens, normalize media types, sort Vary values, or reinterpret each registered field's grammar. Those transformations could incorrectly turn a real semantic change into “same.”
obs-fold Is Historical Input You May Still Encounter, Not Something New Servers Should Emit
Older HTTP syntax allowed continuation lines beginning with space or tab. Modern HTTP treats that obsolete folding syntax as something recipients must handle cautiously rather than something senders should produce.
When the pasted capture contains an indented continuation, this checker unfolds it into the preceding value and reports that it did so. That preserves useful debugging evidence without recommending obs-fold as valid modern output.
A Changed Header Is an Observation; the Cause May Live in a Different Layer
If Server changes from Nginx to Cloudflare, your origin software may not have changed at all—the edge may be replacing the field. A new Age header can indicate cache reuse. A changed Content-Length may be compression, templating, minification or a genuinely different payload.
Header diffs are strongest when paired with the deployment event: CDN rule, reverse-proxy change, framework release, cache-policy update, security-header rollout, API version or origin migration.
Cache-Control Changes Need the Whole Cache Story
Moving from no-cache to public, max-age=3600 is obviously important, but the effective cache behavior can also depend on shared-cache directives, Vary, validators, Age, CDN configuration, authenticated responses, request headers and application-specific surrogate controls.
Use the diff to find the change. Then test representative requests through the actual browser/CDN/origin path before deciding the cache behavior is correct.
Security-Header Diffs Need Behavior Testing, Not “More Headers = Better”
Adding CSP, HSTS or Permissions-Policy can be a security improvement; a misconfigured value can also block scripts, embeds, authentication popups, API connections or whole subdomains. Removing X-Frame-Options might be acceptable when a stronger equivalent frame-ancestors policy is enforced.
The checker flags policy changes so they get deliberate review. It does not assign security meaning simply from added/removed counts.
Volatile Fields Are Optional Noise Suppression, Not “Unimportant Headers”
Date, Age, request IDs and tracing fields often differ on every request. Hiding them can make a before/after deployment diff easier to read. But those fields can be exactly what you need when diagnosing cache residency, request routing or distributed tracing.
The ignore option is therefore explicit and off by default. When enabled, the report lists which present fields were intentionally omitted.