HTTP HeadersExplained

58 of 58 rows

Header↕	Purpose↕	Example↕
Request
⤢Host	Names the server and port the request targets.	developer.mozilla.org
⤢User-Agent	Identifies the client software making the request.	Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)
⤢Accept	Declares the media types the client can process.	text/html,application/xhtml+xml,application/json
⤢Authorization	Carries credentials that authenticate the client.	Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9
⤢Cookie	Sends stored cookies back to the origin server.	sessionid=38afes7a8; theme=dark
⤢Referer	Gives the URL of the page that linked here.	https://example.com/docs/index.html
⤢Accept-Encoding	Lists the compression encodings the client accepts.	gzip, deflate, br
⤢Accept-Language	Ranks the natural languages the client prefers.	en-US,en;q=0.9
⤢Origin	Names the origin that started the request.	https://example.com
⤢Range	Asks for only part of the body, given as a byte range.	bytes=0-1023
⤢X-Forwarded-For	Lists the client and proxy IPs along the request path.	203.0.113.45, 70.41.3.18
⤢X-Forwarded-Proto	Tells the origin which protocol the client used.	https
⤢Forwarded	Carries the proxy path in one standard field.	for=203.0.113.45;proto=https
⤢Connection	Controls whether the connection stays open after this exchange.	keep-alive
⤢Expect	States what the server must confirm before the client sends the body.	100-continue
⤢Max-Forwards	Limits how many proxies may forward a TRACE request.	3
Response
⤢Content-Type	Declares the media type of the body on requests and responses.	text/html; charset=utf-8
⤢Content-Length	Gives the size of the body in bytes.	3489
⤢Cache-Control	Directs how caches store the request or response.	no-cache
⤢Set-Cookie	Tells the browser to store a cookie.	id=a3fWa; Expires=Wed, 21 Oct 2026 07:28:00 GMT; HttpOnly
⤢Location	Names the URL for a redirect target.	https://example.com/new-location
⤢ETag	Gives a version tag for the body, used by conditional requests.	"33a64df551425fcc55e4d42da148ef95"
⤢Last-Modified	Gives the date and time the body last changed.	Wed, 21 Oct 2025 07:28:00 GMT
⤢Vary	Lists the request headers a cached response depends on.	Accept-Encoding
⤢Content-Encoding	Names the compression applied to the body.	gzip
⤢Transfer-Encoding	Names the wire format used to move the body.	chunked
⤢Retry-After	Tells the client how long to wait before the next request.	120
⤢Allow	Lists the methods the resource supports.	GET, POST, HEAD
⤢Age	Reports how long the response has spent in a cache.	2463
⤢Server	Names the server software behind the response.	cloudflare
⤢Date	Gives the time the response was produced.	Wed, 21 Oct 2025 07:28:00 GMT
Conditional
⤢If-None-Match	Asks for a fresh body only if the ETag changed.	"33a64df551425fcc55e4d42da148ef95"
⤢If-Modified-Since	Requests the body only if it changed since the date.	Wed, 21 Oct 2025 07:28:00 GMT
⤢If-Match	Makes the request succeed only when the ETag matches.	"33a64df551425fcc55e4d42da148ef95"
⤢If-Unmodified-Since	Makes the request succeed only when the body is unchanged since the date.	Wed, 21 Oct 2025 07:28:00 GMT
⤢If-Range	Applies the Range only when the ETag or date still matches.	"33a64df551425fcc55e4d42da148ef95"
Security
⤢Strict-Transport-Security	Forces HTTPS for future requests to this host.	max-age=31536000; includeSubDomains
⤢Content-Security-Policy	Whitelists the sources the browser may load.	default-src 'self'; script-src 'self'
⤢X-Frame-Options	Stops other sites from framing this page; superseded by the CSP frame-ancestors directive, which browsers honor instead when both are set.	DENY
⤢X-Content-Type-Options	Stops the browser from guessing a different content type.	nosniff
⤢Referrer-Policy	Limits the referrer data sent with outgoing requests.	strict-origin-when-cross-origin
⤢Permissions-Policy	Grants or blocks browser features, such as camera or geolocation.	camera=(), geolocation=(self)
⤢Cross-Origin-Opener-Policy	Isolates the page from cross-origin browser windows.	same-origin
CORS
⤢Access-Control-Allow-Origin	Names which origin may read the response.	https://example.com
⤢Access-Control-Allow-Methods	Lists the HTTP methods permitted in CORS.	GET, POST, OPTIONS
⤢Access-Control-Allow-Headers	Lists request headers allowed in CORS.	Content-Type, Authorization
⤢Access-Control-Allow-Credentials	Lets credentialed requests read the response.	true
⤢Access-Control-Expose-Headers	Lists response headers the page may read from script.	X-Request-Id, Content-Length
⤢Access-Control-Max-Age	Sets how long the browser caches the preflight result.	600
⤢Access-Control-Request-Method	Tells the server which method the real request will use.	DELETE
⤢Access-Control-Request-Headers	Tells the server which headers the real request will send.	Content-Type, Authorization
⤢Timing-Allow-Origin	Lets the named origin read detailed resource timing data.	https://example.com
Content
⤢Content-Disposition	Tells the browser to show the body or save it as a file.	attachment; filename="report.pdf"
⤢Content-Range	Reports which byte range a partial body covers.	bytes 0-1023/146515
⤢Accept-Ranges	Tells the client the server accepts byte range requests.	bytes
⤢Link	Points to related resources, such as the next page.	</page/2>; rel="next"
⤢Alt-Svc	Points to another service endpoint, such as HTTP/3.	h3=":443"; ma=86400
⤢WWW-Authenticate	Names the auth scheme the server requires after a 401.	Bearer realm="api"