Developer Tool · HTTP · Security Analysis · 2026 · Solo build
HTTP Trace
A raw HTTP request inspector: paste any captured request, see every header with its RFC reference and category, body decoded, and a security scorecard flagging missing fields, risky methods, and credential leaks.
The problem
Developers debugging webhooks, CORS failures, or API integrations routinely need to inspect raw HTTP requests captured from curl -v, Burp Suite, or server logs — but most tools require uploading to a server or running a local proxy. HTTP Trace fills the gap: paste any raw HTTP/1.1 request text and get a structured anatomy with zero upload. Every header is categorized (routing, auth, content, caching, security, CORS, identity) and annotated with its RFC reference and description. The body is decoded — JSON is pretty-printed with structure, form-urlencoded params are parsed into key-value pairs. The security scorecard checks for risky methods (TRACE/CONNECT), missing Host header, credentials in URL query strings, and missing Content-Type on POST requests with a body, assigning an A–F grade with weighted severity deductions. Thirty TDD tests covering the parser, header semantics, security signal detection, body decoder, and scorer were written and verified RED before a single line of implementation existed.
Architecture
Key decisions
Command/Inspect surface over a dashboard
HTTP Trace is a single-artifact inspector: the user drills into one captured request to understand its structure. This maps precisely to the Command/Inspect surface — speed and focus over breadth. A Monitor or dashboard composition would add noise without value; the design stays tight to the request line, header list, decoded body, and security signals.
Pure TypeScript parser over a library
Parsing raw HTTP text is 50 lines of string splitting — not a job for a full HTTP parsing library that brings dependency weight and WASM constraints. The hand-rolled parser handles CRLF/LF normalization, validates the request line against known methods, and separates headers from body correctly. 12 unit tests prove correctness on all edge cases before any UI was built.
RFC reference per header over a generic tooltip
The value of HTTP Trace is RFC provenance. Saying 'Authorization: auth (RFC 9110 §11.6.2)' teaches the developer something permanent. A generic 'sends auth credentials' tooltip is forgettable. Every header in the catalog links back to its normative source, making the tool useful for learning as well as debugging.