HTTP Headers Reference
Searchable reference of all HTTP request and response headers with descriptions and examples.
Searchable reference of all HTTP request and response headers with descriptions and examples.
51 headers
Media types the client can process.
Accept: text/html, application/jsonCompression algorithms the client supports.
Accept-Encoding: gzip, deflate, brPreferred human language for the response.
Accept-Language: en-US, en;q=0.9Credentials for authenticating the client.
Authorization: Bearer eyJhbGciOi...Directives for caching in requests and responses.
Cache-Control: no-cache, max-age=3600Control options for the current connection.
Connection: keep-aliveWhether content is displayed inline or downloaded.
Content-Disposition: attachment; filename="file.pdf"Encoding applied to the response body.
Content-Encoding: gzipSize of the request or response body in bytes.
Content-Length: 1024Controls resources the browser is allowed to load.
Content-Security-Policy: default-src 'self'Media type of the resource.
Content-Type: application/json; charset=utf-8Stored HTTP cookies sent by the client.
Cookie: session=abc123; theme=darkControls sharing of browsing context with cross-origin documents.
Cross-Origin-Opener-Policy: same-originControls which origins can read the response.
Cross-Origin-Resource-Policy: same-siteDate and time the message was sent.
Date: Wed, 21 Oct 2024 07:28:00 GMTIdentifier for a specific version of a resource.
ETag: "33a64df551425fcc55e4d42a148795d9f25f89d4"Indicates expectations the server must meet.
Expect: 100-continueDate after which the response is stale.
Expires: Thu, 01 Dec 2024 16:00:00 GMTProxy-added info about the client connection.
Forwarded: for=192.0.2.60; proto=http; by=203.0.113.43Domain name of the server (required in HTTP/1.1).
Host: www.example.comReturns 304 if resource unchanged since given date.
If-Modified-Since: Wed, 21 Oct 2024 07:28:00 GMTReturns 304 if ETag unchanged.
If-None-Match: "33a64df5"Parameters for persistent connections.
Keep-Alive: timeout=5, max=1000Date the resource was last modified.
Last-Modified: Mon, 14 Oct 2024 00:00:00 GMTTyped relationships between a resource and other URIs.
Link: <https://example.com>; rel="canonical"URL to redirect the client to (3xx responses).
Location: https://www.example.com/new-pageIndicates where a fetch originates from.
Origin: https://www.example.comControls browser features and APIs.
Permissions-Policy: geolocation=(), microphone=()HTTP/1.0 cache control (deprecated in favour of Cache-Control).
Pragma: no-cacheCredentials for proxy authentication.
Proxy-Authorization: Basic YWxhZGRpbjpvcGVuc2VzYW1lPartial resource request (byte ranges).
Range: bytes=200-1000Address of the previous page linking to the request.
Referer: https://www.example.com/pageControls how much referrer info is included with requests.
Referrer-Policy: strict-origin-when-cross-originHow long to wait before retrying (429/503 responses).
Retry-After: 120Software used by the origin server.
Server: nginx/1.25.0Sends a cookie from server to client.
Set-Cookie: sessionId=abc123; Secure; HttpOnly; SameSite=StrictForces HTTPS connections (HSTS).
Strict-Transport-Security: max-age=31536000; includeSubDomainsTransfer encodings the client is willing to accept.
TE: trailers, deflateFields present in the trailer of a chunked message.
Trailer: ExpiresEncoding used to transfer the payload body.
Transfer-Encoding: chunkedRequest to switch to a different protocol.
Upgrade: websocketBrowser/client software string.
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)...Which request headers affect the cached response.
Vary: Accept-Encoding, Accept-LanguageProxies through which the request/response passed.
Via: 1.1 proxy.example.comAuthentication method the server expects.
WWW-Authenticate: Bearer realm="api"Prevents MIME-type sniffing.
X-Content-Type-Options: nosniffClient IP address when request passes through proxies.
X-Forwarded-For: 203.0.113.195, 70.41.3.18Original host requested by the client.
X-Forwarded-Host: en.wikipedia.orgControls embedding in iframes (use CSP frame-ancestors instead).
X-Frame-Options: DENYUnique identifier for a request for tracing.
X-Request-ID: f058ebd6-02f7-4d3f-942e-904344e8cde5Legacy XSS filter (deprecated — use CSP instead).
X-XSS-Protection: 1; mode=block