The real headers netcat proves your own browser sends

You assume your browser sends clean headers. You've never checked the raw bytes.

Intermediate to advancedRead 6 minDoing: about thirty minutes, a terminal and a browser open side by side7 steps

▶ Start

What you'll have at the end

A side-by-side of the raw request your own browser sent, captured live with netcat listening on a local port

Before you start

You need

A terminal on the same machine as your browser, comfortable running one command at a time, and your browser's own network inspector.

Not covered

Capturing a real https:// page's headers this way: a plain listener can't do the handshake a real site would demand, so this only works against a plain local address you type yourself.

Leans on

7 steps

Where to go next

Audit a login cookie for its missing security flags

once you know your inspector's request-header view can hide or reorder things, and you want the parallel check for its response-header view, on a Set-Cookie line instead of a request line.

Checked 18 Aug 2026

Part of the HTTP cookbook