HTTP Header Reference
v1.0.1Browse all HTTP request, response, security, CORS, and caching headers with usage guidance.
Reference for all standard HTTP request and response headers — lists header name, category (security, caching, content, auth), typical values, and examples, covering HTTP/1.1 and HTTP/2 specs.
How to use- →Search by header name (e.g. "Cache-Control", "Authorization", "Content-Security-Policy") to see its definition.
- →Filter by category (Security, Caching, CORS, Authentication) to browse related headers together.
- →Click any header to see its directive options with descriptions and copy-ready example values.
- →Use the "Strict-Transport-Security" and CSP sections for quick security header configuration.
47 headers found
AcceptContent types the client is willing to receive.
Accept: text/html, application/json, */*Accept-EncodingCompression algorithms the client supports.
Accept-Encoding: gzip, deflate, brAccept-LanguageNatural languages preferred by the client.
Accept-Language: en-US,en;q=0.9,de;q=0.7AuthorizationCredentials for authenticating the client with the server.
Authorization: Bearer eyJhbGci...Cache-ControlDirectives for caching mechanisms in both requests and responses.
Cache-Control: no-cacheContent-LengthSize of the request body in bytes.
Content-Length: 348Content-TypeMedia type and encoding of the request body.
Content-Type: application/json; charset=utf-8CookieHTTP cookies previously set by the server via Set-Cookie.
Cookie: session_id=abc123; theme=darkHostDomain name of the server (required in HTTP/1.1).
Host: api.example.comIf-Modified-SinceMakes the request conditional — server sends response only if modified after date.
If-Modified-Since: Sat, 29 Oct 2024 18:00:00 GMTIf-None-MatchMakes the request conditional based on ETag. Returns 304 if unchanged.
If-None-Match: "686897696a7c876b7e"OriginIndicates the origin of the request for CORS.
Origin: https://app.example.comRefererAddress of the page that linked to the requested resource.
Referer: https://example.com/pageUser-AgentIdentifies the client software making the request.
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)...X-Forwarded-ForOriginal client IP when request passes through proxies/load balancers.
X-Forwarded-For: 203.0.113.1, 70.41.3.18X-Requested-WithIdentifies Ajax requests. Set by jQuery and other frameworks.
X-Requested-With: XMLHttpRequestAllowHTTP methods supported by the resource.
Allow: GET, POST, HEADContent-EncodingCompression applied to the response body.
Content-Encoding: gzipContent-LanguageLanguage(s) of the response content.
Content-Language: en-USContent-TypeMedia type of the response body.
Content-Type: application/json; charset=utf-8ETagIdentifier for a specific version of a resource. Used for caching.
ETag: "33a64df551425fcc55e4d42a148795d9f25f89d4"Last-ModifiedDate and time the resource was last modified.
Last-Modified: Tue, 15 Oct 2024 12:00:00 GMTLocationURL to redirect the client to. Used with 3xx and 201 responses.
Location: https://example.com/new-pageRetry-AfterHow long to wait before making a new request after 429 or 503.
Retry-After: 120ServerInformation about the server software handling the request.
Server: nginx/1.24.0Set-CookieSends a cookie from server to client.
Set-Cookie: session=abc123; HttpOnly; Secure; SameSite=StrictTransfer-EncodingEncoding applied to transfer the payload body.
Transfer-Encoding: chunkedVaryTells caches which request headers affect the cached response.
Vary: Accept-Encoding, Accept-LanguageContent-Security-PolicyControls which resources the browser can load. Prevents XSS attacks.
Content-Security-Policy: default-src 'self'; script-src 'self' cdn.example.comPermissions-PolicyControls which browser features the page can use.
Permissions-Policy: camera=(), microphone=(), geolocation=(self)Referrer-PolicyControls how much referrer information is sent.
Referrer-Policy: strict-origin-when-cross-originStrict-Transport-SecurityForces HTTPS connections. Prevents downgrade attacks (HSTS).
Strict-Transport-Security: max-age=31536000; includeSubDomains; preloadX-Content-Type-OptionsPrevents MIME type sniffing. Set to 'nosniff'.
X-Content-Type-Options: nosniffX-Frame-OptionsControls if the page can be embedded in iframes. Prevents clickjacking.
X-Frame-Options: DENYX-XSS-ProtectiondeprecatedDeprecated. Browser XSS filter — superseded by CSP.
X-XSS-Protection: 0Access-Control-Allow-OriginSpecifies which origins can access the resource.
Access-Control-Allow-Origin: https://app.example.comAccess-Control-Allow-MethodsSpecifies allowed HTTP methods for CORS.
Access-Control-Allow-Methods: GET, POST, PUT, DELETEAccess-Control-Allow-HeadersSpecifies allowed request headers for CORS.
Access-Control-Allow-Headers: Authorization, Content-TypeAccess-Control-Allow-CredentialsIndicates if credentials can be included in CORS requests.
Access-Control-Allow-Credentials: trueAccess-Control-Expose-HeadersLists response headers that can be exposed to the browser.
Access-Control-Expose-Headers: X-Rate-Limit, X-Request-IdAccess-Control-Max-AgeHow long the preflight response can be cached (seconds).
Access-Control-Max-Age: 86400Access-Control-Request-HeadersUsed in preflight requests to indicate which headers will be sent.
Access-Control-Request-Headers: Authorization, Content-TypeAccess-Control-Request-MethodUsed in preflight requests to indicate which method will be used.
Access-Control-Request-Method: PUTAgeTime in seconds the object has been in the proxy cache.
Age: 3600Cache-ControlDirectives for caching: max-age, no-cache, no-store, public, private, immutable.
Cache-Control: public, max-age=86400, immutableExpiresDate/time after which the response is considered stale. Superseded by Cache-Control.
Expires: Tue, 15 Oct 2025 12:00:00 GMTPragmadeprecatedLegacy HTTP/1.0 caching directive. Use Cache-Control instead.
Pragma: no-cache