# HTTP Headers Diff

Compare two sets of HTTP headers and see what changed: headers added, removed and changed, with case-insensitive names and noise-header ignore. Runs in your browser.

## Run it

- **CLI:** `gizza tool http-headers-diff "HTTP/1.1 200 OK
Content-Type: text/html
Server: nginx
Cache-Control: max-age=60
X-Frame-Options: DENY" 'right=HTTP/2 200
Content-Type: application/json
Server: nginx
Cache-Control: no-cache
Content-Security-Policy: default-src 'self''`
- **Web:** https://gizza.ai/tools/http-headers-diff/
- **Agents:** machine-readable descriptor (parameters JSON Schema) at https://gizza.ai/tools/http-headers-diff/tool.json

## Inputs

- `left` — First headers (left / old) _(field)_
- `right` — Second headers (right / new) _(field)_
- `ignore` — Ignore headers (comma / space separated) _(field)_
- `ignore_order` — Ignore token order in list headers (Vary, Cache-Control, …) _(field)_
- `output` — Output _(field)_

## Output

- Header diff (text)

## Query parameters

Open the tool pre-filled and auto-run via URL:

- `left` — First headers (left / old)
- `right` — Second headers (right / new)
- `ignore` — Ignore headers (comma / space separated)
- `ignore_order` — Ignore token order in list headers (Vary, Cache-Control, …)
- `output` — Output

Example: `https://gizza.ai/tools/http-headers-diff/?left=HTTP%2F1.1%20200%20OK%0AContent-Type%3A%20text%2Fhtml%0AServer%3A%20nginx%0ACache-Control%3A%20max-age%3D60%0AX-Frame-Options%3A%20DENY&right=HTTP%2F2%20200%0AContent-Type%3A%20application%2Fjson%0AServer%3A%20nginx%0ACache-Control%3A%20no-cache%0AContent-Security-Policy%3A%20default-src%20%27self%27&ignore=Date%2C%20Age%2C%20Report-To&ignore_order=true&output=report`

---

## About this tool

HTTP Headers Diff compares two pasted header blocks and reports what changed from the first set to the second: added headers, removed headers, changed values, and unchanged names. It is useful for release checks, CDN/proxy debugging, security-header reviews, cache-policy changes, and comparing request or response captures.

Header names are matched case-insensitively, repeated headers are combined according to HTTP header-list rules, and `Set-Cookie` is kept as separate lines instead of being comma-joined. Optional request/status lines such as `GET / HTTP/1.1` or `HTTP/1.1 200 OK` are skipped so you can paste raw captures.

## Worked example

First headers:

```text
Content-Type: text/html
Server: nginx
X-Frame-Options: DENY
```

Second headers:

```text
Content-Type: application/json
Server: nginx
Cache-Control: no-cache
```

Output:

```text
Header diff — 1 added, 1 removed, 1 changed, 1 unchanged

Added (1):
  + Cache-Control: no-cache

Removed (1):
  - X-Frame-Options: DENY

Changed (1):
  ~ Content-Type: text/html -> application/json

Unchanged (1):
  Server
```

Use **Ignore headers** for noisy values such as `Date`, `Age`, or request IDs. Turn on **Ignore token order** when comparing comma-list headers like `Cache-Control` or `Vary` where only the ordering changed.

## Limits & edge cases

- This is a paste-and-compare tool; it does not fetch live URLs or execute curl commands.
- The diff direction is first/left/old → second/right/new.
- Header names are case-insensitive, but values are compared exactly unless **Ignore token order** is enabled.
- Repeated headers are joined with `, ` except `Set-Cookie`, which stays newline-separated.
- Obsolete folded continuation lines are accepted and folded into the previous header value.
- The parser stops at the first blank line, treating anything after it as a message body and ignoring it.

## FAQ

<details>
<summary>Can I paste a full HTTP response?</summary>

Yes, if the first line is a status line such as `HTTP/1.1 200 OK`. The start line is skipped and only the following headers are compared. The parser stops at the first blank line, so a response body pasted after the headers is ignored.

</details>

<details>
<summary>Are header names case-sensitive?</summary>

No. HTTP header names are matched case-insensitively, so `content-type` and `Content-Type` are the same header. The report displays canonical title-case names for readability.

</details>

<details>
<summary>How are repeated headers handled?</summary>

Repeated headers are combined before comparison, which matches normal HTTP list-header behavior. `Set-Cookie` is the exception: each cookie stays on its own line because cookie values must not be comma-joined.

</details>

<details>
<summary>Why would I ignore token order?</summary>

Some headers are comma-separated lists. `Cache-Control: no-cache, no-store` and `Cache-Control: no-store, no-cache` usually mean the same thing. Enable **Ignore token order** to treat those reorder-only changes as unchanged.

</details>

## Related tools

- [Basic Auth Header Generator](https://gizza.ai/tools/basic-auth-header-generator/): Generate an HTTP Basic Authorization header from a username and password — base64(user:pass) per RFC 7617. Runs in your browser, nothing is sent, free.
- [Calendar Free/Busy Overlap](https://gizza.ai/tools/calendar-freebusy-overlap/): Paste two .ics calendars and list the time slots where both are free — working hours, minimum meeting length, timezones and DST handled. Free and in-browser.
- [CIDR Calculator](https://gizza.ai/tools/cidr-calculator/): CIDR calculator: get network address, broadcast, netmask, wildcard, usable host range and host count for any IPv4 or IPv6 prefix. Free, private, in-browser.
- [Extract Emails & Phone Numbers from Text](https://gizza.ai/tools/contact-info-extractor/): Extract emails and phone numbers from pasted text. Deduplicated, counted, sorted, and private in your browser with no upload.
- [cURL Command Parser](https://gizza.ai/tools/curl-command-parser/): Paste a curl command to see its method, URL, query params, headers, body, auth, cookies and flags — or rebuild clean curl. Browser-only.