Header Diff: complete usage guide
Compare two HTTP header sets to quickly identify changed security directives, caching rules, and proxy metadata across environments.
What this tool does
It parses `Header-Name: value` lines into comparable key-value entries.
It matches header names case-insensitively and highlights value differences.
It marks added, removed, modified, and unchanged headers with clear status labels.
It helps troubleshoot deployment drift between local, staging, and production responses.
Typical use cases
- Compare response headers before and after CDN or proxy changes.
- Audit security header rollouts such as CSP and HSTS updates.
- Validate cache-control policy differences between environments.
- Inspect API gateway behavior after middleware refactors.
- Create evidence snapshots for incident postmortems.
Input examples
Left headers
Content-Type: application/json
Cache-Control: no-cache
Right headers
Content-Type: text/html
Cache-Control: max-age=3600
Security sample
Content-Security-Policy: default-src 'self'
Output examples
Modified header
Content-Type changed from application/json to text/html
Added header
X-Forwarded-For added on right side
Diff summary
Removed 1, modified 2, added 1, unchanged 3
Common errors and fixes
Missing colon separator in input line
Use `Header-Name: value` format for each row.
Duplicate header names collapse unexpectedly
Merge duplicate values explicitly before comparison if needed.
Whitespace around values causes false diffs
Trim and normalize header lines before pasting.
Multi-line folded headers parsed incorrectly
Flatten folded headers into a single normalized line first.
Comparing request and response headers together
Compare matching header contexts only.
Security and privacy notes
For the shared privacy terminology, local processing model, external-request labels, and DevTools verification workflow, see the Trust Center.
- Header comparison is local and does not transmit pasted values.
- Remove auth tokens and cookies from shared examples.
- Do not expose internal infrastructure header names publicly.
Step-by-step workflow
- Feed Header Diff the smallest reproducible sample you can collect from the real issue.
- Review the first findings and separate confirmed signals from assumptions or environment-specific noise.
- Compare a clean baseline sample against the problematic input when you need to isolate regressions.
- Keep one redacted output snapshot with the key findings for tickets, runbooks, or incident handoff.
Quality checklist before sharing output
- Confirm Header Diff findings still reproduce with the same input and assumptions.
- Check that the sample includes enough surrounding context to support the conclusion you are drawing.
- Translate notable findings into concrete next checks, ownership, or remediation notes.
- Redact private hosts, tokens, certificates, or customer identifiers before sharing analysis output.
Operational notes
Header Diff is most effective when it produces a focused, reproducible evidence bundle that can be handed to the next engineer without extra cleanup.
Frequently asked questions
Are header names case-sensitive in this diff?
No, names are compared case-insensitively.
Can I compare security header changes?
Yes, this is useful for CSP, HSTS, and related checks.
Why is one header marked removed?
It exists on one side only and is absent on the other.
Should I include cookies in shared diffs?
Avoid sharing real cookie values; redact sensitive data first.
Can this validate header correctness?
It highlights differences; compliance validation still needs policy checks.
