HTTP Headers Reference

Every common HTTP header explained, grouped by purpose. Searchable by name or keyword. Includes examples and RFC 9110 references.

Runs 100% in your browser — nothing is uploaded.

Auth

AuthorizationRequest
Credentials for authenticating the request.
Bearer eyJhbGci...
WWW-AuthenticateResponse
Indicates the authentication scheme(s) applicable to access the target.
Bearer realm="api"
Proxy-AuthorizationRequest
Credentials for authenticating with a proxy.

Caching

Cache-ControlBoth
Directives for caching mechanisms in both requests and responses.
public, max-age=31536000, immutable
ETagResponse
Version identifier for a specific resource version.
W/"abc123"
If-None-MatchRequest
Ask server for the resource only if the ETag has changed.
If-Modified-SinceRequest
Request the resource only if it was modified after the given date.
Last-ModifiedResponse
Date the resource was last modified.
AgeResponse
Seconds the object has been in a proxy cache.
ExpiresResponse
Date after which the response is considered stale. Superseded by Cache-Control max-age.
VaryResponse
Which request headers cause a different cached response.
Accept-Encoding, User-Agent

Entity

Content-TypeBoth
Media type of the resource.
application/json; charset=utf-8
Content-LengthBoth
Size in bytes of the body.
Content-EncodingResponse
Compression applied to the body (gzip, br, deflate).
Content-LanguageResponse
Language(s) of the resource.
Content-DispositionResponse
How the response should be handled (inline / attachment) and filename.
attachment; filename="report.pdf"
Content-RangeResponse
Byte range and total length for partial content responses.
RangeRequest
Byte range client wants.
bytes=0-1023

Request

AcceptRequest
Media types the client can process.
application/json
Accept-EncodingRequest
Compression algorithms the client accepts.
gzip, deflate, br
Accept-LanguageRequest
Preferred languages.
en-US, en;q=0.9
HostRequest
Domain name of the server (required in HTTP/1.1).
User-AgentRequest
Client software identification.
RefererRequest
URL of the page that linked to this one. Yes, the header is misspelled — a 1995 typo that stuck.
OriginRequest
Origin (scheme + host + port) of the requesting page, used by CORS.
CookieRequest
Stored HTTP cookies sent to the server.

Response

Set-CookieResponse
Send a cookie from server to client.
session=abc; HttpOnly; Secure; SameSite=Lax
LocationResponse
URL to redirect to (used with 3xx redirects, 201 Created).
ServerResponse
Information about the origin server software.
AllowResponse
HTTP methods valid for the resource. Sent with 405 responses.
Retry-AfterResponse
How long to wait before retrying. Used with 429 and 503.

CORS

Access-Control-Allow-OriginResponse
Which origins are allowed. Can be * or a specific origin.
https://example.com
Access-Control-Allow-MethodsResponse
Allowed methods for preflight requests.
GET, POST, DELETE
Access-Control-Allow-HeadersResponse
Which headers can be included in the request.
Access-Control-Allow-CredentialsResponse
Whether credentials (cookies, auth) are allowed with CORS.
true
Access-Control-Max-AgeResponse
Seconds the preflight can be cached.
Access-Control-Request-MethodRequest
Sent by browsers during preflight to indicate the actual method.

Security

Strict-Transport-SecurityResponse
Force HTTPS for future requests to this host.
max-age=63072000; includeSubDomains; preload
Content-Security-PolicyResponse
Whitelist of allowed content sources — the single most important security header.
default-src 'self'; script-src 'self' 'nonce-abc'
X-Content-Type-OptionsResponse
Disable MIME sniffing. Always set to nosniff.
nosniff
X-Frame-OptionsResponse
Prevent framing (clickjacking). Superseded by CSP frame-ancestors but still respected.
DENY
Referrer-PolicyResponse
How much of the Referer to include on outbound requests.
strict-origin-when-cross-origin
Permissions-PolicyResponse
Which browser features are allowed on this page (camera, mic, geolocation, etc.).
X-XSS-ProtectionResponse
Legacy XSS filter toggle. Deprecated — use CSP instead.

Frequently asked

Which spec?

RFC 9110 (2022 HTTP semantics) plus CORS spec, plus common security headers (CSP, HSTS, etc.).

Where is X-Forwarded-For?

Non-standard headers (X-Forwarded-*, X-Real-IP) are widely used but not in the RFC. They're on the roadmap for a "common non-standard headers" section.