Web & Dev
HTTP Headers Reference
Searchable reference of common HTTP request and response headers with examples.
42 results
Accept Request
Media types the client can understand.
Accept: text/html, application/json
Accept-Encoding Request
Content encodings (compression) the client accepts.
Accept-Encoding: gzip, deflate, br
Accept-Language Request
Preferred natural languages for the response.
Accept-Language: en-US,en;q=0.9
Authorization Request
Credentials to authenticate the user agent with the server.
Authorization: Bearer eyJhbGciOi...
Cache-Control Both
Directives for caching mechanisms in requests and responses.
Cache-Control: no-cache, max-age=3600
Connection Both
Controls whether the network connection stays open after the transaction.
Connection: keep-alive
Content-Disposition Response
Indicates if content is displayed inline or treated as a download.
Content-Disposition: attachment; filename="file.pdf"
Content-Encoding Both
The compression applied to the message body.
Content-Encoding: gzip
Content-Length Both
The size of the message body, in bytes.
Content-Length: 3495
Content-Security-Policy Response
Controls resources the user agent is allowed to load.
Content-Security-Policy: default-src 'self'
Content-Type Both
The media type of the resource or request body.
Content-Type: application/json; charset=utf-8
Cookie Request
Stored HTTP cookies previously sent by the server.
Cookie: session_id=abc123; theme=dark
Date Both
The date and time at which the message was originated.
Date: Tue, 15 Nov 2024 08:12:31 GMT
ETag Response
An identifier for a specific version of a resource, used for caching.
ETag: "33a64df5"
Expires Response
The date/time after which the response is considered stale.
Expires: Wed, 21 Oct 2025 07:28:00 GMT
Host Request
The domain name and optional port of the target server.
Host: example.com
If-Modified-Since Request
Makes the request conditional on the resource being modified since a date.
If-Modified-Since: Sat, 29 Oct 2024 19:43:31 GMT
If-None-Match Request
Makes the request conditional on the ETag not matching.
If-None-Match: "33a64df5"
Last-Modified Response
The date and time the resource was last modified.
Last-Modified: Tue, 15 Nov 2024 12:45:26 GMT
Location Response
The URL to redirect to, or the URL of a newly created resource.
Location: https://example.com/new-page
Origin Request
The origin (scheme, host, port) that caused the request.
Origin: https://example.com
Referer Request
The address of the page that linked to the requested resource.
Referer: https://example.com/page
Retry-After Response
How long to wait before making a follow-up request.
Retry-After: 120
Server Response
Information about the software handling the request.
Server: nginx/1.25.3
Set-Cookie Response
Sends a cookie from the server to the user agent.
Set-Cookie: session_id=abc123; HttpOnly; Secure
Strict-Transport-Security Response
Forces communication over HTTPS for a period of time.
Strict-Transport-Security: max-age=63072000
Transfer-Encoding Response
The form of encoding used to safely transfer the body.
Transfer-Encoding: chunked
User-Agent Request
A string identifying the client software making the request.
User-Agent: Mozilla/5.0 (Windows NT 10.0)
Vary Response
Lists request headers that affect how the response is cached.
Vary: Accept-Encoding, User-Agent
WWW-Authenticate Response
Defines the authentication method to access a resource.
WWW-Authenticate: Basic realm="Access"
X-Forwarded-For Request
Identifies the originating IP address through a proxy.
X-Forwarded-For: 203.0.113.195, 70.41.3.18
X-Frame-Options Response
Controls whether a page can be rendered in a frame (clickjacking protection).
X-Frame-Options: DENY
X-Content-Type-Options Response
Prevents MIME-type sniffing of the response.
X-Content-Type-Options: nosniff
Access-Control-Allow-Origin Response
Specifies which origins may access the resource (CORS).
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods Response
Lists the methods allowed when accessing the resource (CORS).
Access-Control-Allow-Methods: GET, POST, PUT
Access-Control-Allow-Headers Response
Lists which headers can be used during the actual request (CORS).
Access-Control-Allow-Headers: Content-Type, Authorization
Access-Control-Request-Method Request
Used in a preflight request to state which method will be used.
Access-Control-Request-Method: POST
Range Request
Requests only part of a resource (byte ranges).
Range: bytes=0-1023
Content-Range Response
Indicates where a partial body belongs in the full resource.
Content-Range: bytes 0-1023/146515
Accept-Ranges Response
Indicates the server supports range requests.
Accept-Ranges: bytes
Allow Response
Lists the HTTP methods supported by the resource.
Allow: GET, POST, HEAD
Age Response
The time in seconds the object has been in a proxy cache.
Age: 24