HTTP headers reference

Who may cache the response and for how long — the header that decides whether your deploy shows up.

A fingerprint of the response body, so the next request can ask “has it changed?” and get a tiny 304 instead of the whole thing.

When the resource last changed, for If-Modified-Since revalidation. The second-choice ETag.

The legacy freshness header. Cache-Control: max-age wins whenever both are present.

How many seconds a cached copy has been sitting in the CDN. The debugging header for “why am I seeing stale content”.

What the body IS. Wrong or missing, and browsers guess, APIs 415, and JSON arrives as text.

What the client wants back. Content negotiation's polite request — servers may ignore it.

The credential: Bearer tokens, Basic auth. The header that must never end up in logs or URLs.

Sent with a 401 to say which auth scheme is expected. What makes the browser's Basic-auth prompt appear.

Every cookie the browser holds for this origin, on every request. The reason cookie bloat slows sites.

Creates or updates a cookie. The attributes are the security model: HttpOnly, Secure, SameSite.

Where to go next: the target of every 3xx redirect, and where a 201 says the new thing lives.

Which site on this IP the request is for. Mandatory since HTTP/1.1; virtual hosting depends on it.

What the client claims to be. Useful for logs, unreliable for decisions — everything lies for compatibility.

The page the request came from — misspelled in the RFC forever. Controlled by Referrer-Policy.

How much of your URLs leak to other sites when users click away. strict-origin-when-cross-origin is the sane default.

Scheme + host + port of the requesting page. The input CORS decisions are made on.

The CORS verdict: which origin may read this response from JavaScript.

Which verbs the cross-origin caller may use, answered on the preflight OPTIONS.

Which request headers change the response — so caches keep separate copies per variant.

Which compressions the client understands: gzip, br, zstd.

How the body is compressed. Set it wrongly by hand and every client sees garbage bytes.

Body size in bytes. Lying about it hangs connections; chunked transfer omits it.

Display inline, or download with this filename — the header behind every “Save as” name.

HSTS: this site is HTTPS-only; browsers must not even try HTTP for max-age seconds.

The allowlist of what the page may load and run. The strongest XSS mitigation there is, and the easiest header to break your own site with.

May this page be put in an iframe? DENY stops clickjacking; superseded by CSP frame-ancestors but still widely sent.

nosniff: trust my Content-Type, never guess. One value, no downside, always send it.

When to come back, on a 429 or 503. Clients that honour it get unbanned faster than clients that hammer.

The client IPs a request passed through on its way in. Whatever the outermost client CLAIMS, plus each proxy's addition.

The standardised replacement for the X-Forwarded-* family, less widely deployed than any of them.

“Only send the body if the ETag changed.” The request half of 304 revalidation.

“Only apply this write if the ETag still matches” — optimistic locking over HTTP; 412 when it does not.

Ask for a byte slice of a file. Video seeking and resumable downloads are built on it.

chunked: the body streams in pieces of unknown total size. Mutually exclusive with Content-Length.

Machine-readable relations: pagination (rel=next), preload hints, canonical URLs.