Unit 1: Requests and responses · Lesson 3 of 5 · 15 min
The same traffic in the browser
Developer tools show every request a page makes, with the same headers curl shows.
mission
- You are
- The analyst preparing the shop review.
- Situation
- Developers on the shop team work in the browser, not the terminal. Your notes have to point at what they can see in their own tools.
- Goal
- Find the same status codes and headers in the browser's network panel.
- Hand in
- Two headers from the stylesheet and the status of /admin, read from devtools.
Finding a request in devtools
- F12open developer tools
- Networkone row per request
- Reloadrecord the page
- Click a rowheaders, response, timing
Open the home page
The lab browser on the right is already on the shop. Its Network panel shows the status, request headers and response headers for the page you are on.
you should see Status 200 and the same Server header curl showed.
Follow the stylesheet
A page is rarely one request. The home page pulls in /static/site.css. Pick it from the Pages list.
you should see A Content-Type and a Cache-Control header the HTML page does not have.
defender tip In a real browser, right-click any row and choose Copy as cURL. You can then replay it in a terminal and change one header at a time.
Compare a refused page
Open /admin and compare its response headers with the home page.
you should see Status 403 and fewer headers. Error pages often skip the security headers set on normal pages.
What a defender takes away
- 1The browser and curl see the same HTTP; devtools just draw it.
- 2Every stylesheet, script and image is its own request with its own headers.
- 3Error pages need the same security headers as normal ones.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.