HTTP Headers Reference

Credentials authenticating the user-agent with the server. Most common schemes: Bearer (OAuth/JWT), Basic (base64 user:pass), Digest, and API key conventions.

Authorization: Bearer eyJhbGciOiJIUzI1NiIs...

Developer note: Never log this header. Strip it from request dumps, error reports, and tracing spans.

Sent with a 401 Unauthorized response to indicate which authentication scheme(s) the resource accepts and where to fetch metadata.

WWW-Authenticate: Bearer realm="api", error="invalid_token"

Developer note: MCP and modern OAuth servers use the resource_metadata parameter here for discovery.

Credentials for authenticating with an intermediate proxy.

Proxy-Authorization: Basic dXNlcjpwYXNz

Directives for caching mechanisms in both requests and responses. Common values: no-store, no-cache, max-age=N, public, private, must-revalidate, immutable.

Cache-Control: public, max-age=31536000, immutable

Developer note: Use 'immutable' on fingerprinted asset URLs (e.g., main.a1b2c3.js). Browsers skip revalidation entirely.

Opaque identifier for a specific version of a resource. Lets the client revalidate via If-None-Match for conditional GETs.

ETag: "33a64df551425fcc55e4d42a148795d9f25f89d4"

Developer note: Strong ETags require byte-identical responses. Weak ETags (W/'...') allow semantic equivalence.

Timestamp of the last modification to the resource. Less precise than ETag but cheap to compute.

Last-Modified: Tue, 23 May 2026 18:21:00 GMT

Time in seconds since the response was generated by the origin server.

Age: 24

Specifies request headers that determine whether a cached response can be reused. Critical for CDNs and reverse-proxy caches.

Vary: Accept-Encoding, Origin

Developer note: Always include 'Origin' in Vary when you reflect Access-Control-Allow-Origin per request, otherwise the CDN may serve a cached response with the wrong origin.

HTTP/1.0 absolute date after which the response is considered stale. Superseded by Cache-Control: max-age; if both are present, Cache-Control wins.

Expires: Wed, 21 Oct 2026 07:28:00 GMT

Developer note: Only ship Expires for legacy HTTP/1.0 caches. For everything else, Cache-Control is the modern, richer directive.

HTTP/1.0 directive, effectively only `Pragma: no-cache` is still seen, equivalent to `Cache-Control: no-cache`. Modern clients should use Cache-Control instead.

Pragma: no-cache

Caching directive targeted specifically at CDNs, separate from the Cache-Control that downstream browsers see. Lets you keep an asset cached at the edge while marking it no-store for browsers.

CDN-Cache-Control: public, max-age=86400

Developer note: Cloudflare honors `CDN-Cache-Control`, Fastly honors `Surrogate-Control`, Vercel honors both. Check the platform docs before relying on either.

Pre-RFC 9213 vendor convention for telling CDNs/surrogate caches how to cache content separately from the browser-facing Cache-Control. Still used by Fastly and Akamai.

Surrogate-Control: max-age=3600

MIME type of the payload. Includes charset and boundary parameters where applicable.

Content-Type: application/json; charset=utf-8

Size of the payload in octets. Required for most non-streaming responses.

Content-Length: 1024

Compression applied to the payload. Common values: gzip, br (Brotli), zstd, deflate.

Content-Encoding: br

Developer note: Prefer Brotli (br) over gzip for text where supported, 10–20% smaller for HTML/JS/CSS at the same compression cost.

How the response should be presented, inline (display in browser) or attachment (force download). Can include a filename.

Content-Disposition: attachment; filename="report-2026-05.pdf"

Natural language(s) of the intended audience for the payload.

Content-Language: en, fr

URL of the specific representation returned (vs the request's target URL). Useful when a single resource has multiple representations (e.g., language-specific variants).

Content-Location: /docs/en/intro.html

Cryptographic digest of the resource representation. Successor to the deprecated Content-MD5 and Digest headers. Allows integrity verification independent of TLS.

Repr-Digest: sha-256=:X48E9qOokqqrvdts8nOJRJN3OWDUoyWxBf7kbu9DBPE=:

Cryptographic digest of the message body bytes (after Content-Encoding). Useful for end-to-end integrity through proxies that decode/recode.

Content-Digest: sha-256=:X48E9qOokqqrvdts8nOJRJN3OWDUoyWxBf7kbu9DBPE=:

Conditional GET, send the resource only if its ETag doesn't match. Returns 304 Not Modified if it does.

If-None-Match: "33a64df551425fcc55e4d42a148795d9f25f89d4"

Conditional GET, send the resource only if modified after the given date.

If-Modified-Since: Tue, 23 May 2026 18:21:00 GMT

Conditional update, proceed only if the resource's ETag matches. Used to prevent the lost-update problem on PUT/PATCH/DELETE.

If-Match: "33a64df551425fcc55e4d42a148795d9f25f89d4"

Developer note: Use this to implement optimistic concurrency. A 412 Precondition Failed response tells the client to refetch and retry.

Sends the request only if the resource has not been modified since the given date. Mainly used with PUT/PATCH/DELETE for optimistic concurrency.

If-Unmodified-Since: Wed, 21 Oct 2026 07:28:00 GMT

Range request that asks the server to return the requested bytes only if the resource has not changed; otherwise return the entire resource. Used by resumable downloads.

If-Range: "33a64df551..."

Request a specific byte range of the resource. Used for resumable downloads and video seek.

Range: bytes=1024-2047

Whether the server accepts range requests, and in what unit.

Accept-Ranges: bytes

The byte range returned by a 206 Partial Content response.

Content-Range: bytes 1024-2047/4096

Media types the client prefers in the response, with optional quality factors (q=0–1).

Accept: application/json, text/plain;q=0.9, */*;q=0.5

Compression algorithms the client supports.

Accept-Encoding: gzip, deflate, br, zstd

Natural languages the client prefers, with quality factors.

Accept-Language: en-US,en;q=0.9,fr;q=0.6

Historical header for indicating preferred response character sets. Deprecated, modern clients accept UTF-8 universally, and servers should always respond in UTF-8.

Accept-Charset: utf-8

Developer note: Do not send. Browsers stopped emitting this circa 2016 because it leaks fingerprinting bits.

Lists the patch document formats the resource accepts. Sent on OPTIONS or 415 responses to advertise PATCH support.

Accept-Patch: application/json-patch+json

Cookies stored by the client for the request's origin.

Cookie: session=abc123; theme=dark

Asks the client to store a cookie. Attributes include Domain, Path, Expires, Max-Age, Secure, HttpOnly, SameSite, Partitioned.

Set-Cookie: session=abc123; Path=/; Secure; HttpOnly; SameSite=Lax; Max-Age=3600

Developer note: For session cookies: always use Secure + HttpOnly + SameSite=Lax at minimum. Add Partitioned for third-party contexts under CHIPS.

Origin (scheme + host + port) that initiated a cross-origin request. Sent automatically by browsers.

Origin: https://app.example.com

Origin(s) allowed to access the resource. A single concrete origin, '*', or 'null'.

Access-Control-Allow-Origin: https://app.example.com

Developer note: Wildcard '*' is incompatible with Access-Control-Allow-Credentials: true. Always echo a concrete origin for credentialed requests.

HTTP methods allowed in cross-origin requests. Sent in preflight responses.

Access-Control-Allow-Methods: GET, POST, PATCH, DELETE

Request headers permitted on cross-origin requests. Sent in preflight responses.

Access-Control-Allow-Headers: Content-Type, Authorization, X-Requested-With

Whether the browser should expose the response to JavaScript when credentials are included (cookies, Authorization, client certificates).

Access-Control-Allow-Credentials: true

How long (seconds) the preflight response can be cached.

Access-Control-Max-Age: 86400

Developer note: Without this header, every non-simple cross-origin request is preceded by a fresh OPTIONS preflight. Set to 86400 (24h) to halve real-user latency.

Method the actual request will use. Sent by the browser during preflight.

Access-Control-Request-Method: PATCH

Headers the actual request will include. Sent by the browser during preflight.

Access-Control-Request-Headers: content-type, authorization

Lists response headers that browser-side JavaScript is allowed to read on a CORS response. By default scripts only see a safe subset (Content-Type, Cache-Control, etc.).

Access-Control-Expose-Headers: X-Request-ID, X-RateLimit-Remaining

Developer note: If your API returns custom headers and the frontend can't read them, this is what's missing. Common gotcha with X-Total-Count for paginated APIs.

Allows cross-origin scripts to access detailed Resource Timing data (DNS, TCP, TLS, TTFB) via the Performance API. Without it, cross-origin timings are zeroed.

Timing-Allow-Origin: https://app.example.com

Declares which sources can be loaded for various resource types. The strongest defense against XSS.

Content-Security-Policy: default-src 'self'; script-src 'self' 'nonce-abc123'; style-src 'self' 'unsafe-inline'

Developer note: Use nonces or hashes, avoid 'unsafe-inline' on script-src. Start with a Report-Only policy in production to learn before enforcing.

Tells the browser to use HTTPS only for the given duration. Once received, the browser will refuse plaintext for that host.

Strict-Transport-Security: max-age=63072000; includeSubDomains; preload

Setting 'nosniff' disables browser MIME-type sniffing, prevents browsers from interpreting a text file as JavaScript.

X-Content-Type-Options: nosniff

Controls whether the page can be embedded in a frame. Values: DENY, SAMEORIGIN. Largely superseded by CSP frame-ancestors.

X-Frame-Options: SAMEORIGIN

Controls how much of the Referer header is sent with outbound requests.

Referrer-Policy: strict-origin-when-cross-origin

Controls which browser features (camera, geolocation, fullscreen, payment) the document and its embedded contexts can use.

Permissions-Policy: camera=(), geolocation=(self), payment=()

Isolates the browsing context from cross-origin documents. Required for SharedArrayBuffer + cross-origin isolation.

Cross-Origin-Opener-Policy: same-origin

Prevents other origins from loading the resource. Defense against Spectre-style cross-origin leaks.

Cross-Origin-Resource-Policy: same-origin

Controls whether the document can load cross-origin resources that don't grant permission. Required (with COOP) to enable cross-origin isolation and use SharedArrayBuffer / high-resolution timers.

Cross-Origin-Embedder-Policy: require-corp

Developer note: Enabling COEP without auditing third-party scripts breaks ads, analytics, and embeds. Roll out with report-only mode first via Cross-Origin-Embedder-Policy-Report-Only.

Instructs the browser to clear cookies, storage, cache, or executionContexts associated with the response's origin. Use on logout endpoints.

Clear-Site-Data: "cache", "cookies", "storage"

Requests that the browser isolate the document in an origin-keyed agent cluster (separate process), preventing cross-origin DOM access even between same-site subdomains.

Origin-Agent-Cluster: ?1

Historical header for opting into Certificate Transparency enforcement. Deprecated as of 2023, Chrome enforces CT by default for publicly trusted certificates issued after 2018.

Expect-CT: enforce, max-age=86400, report-uri="https://example.com/ct-report"

Developer note: Do not add to new sites. Remove from existing config, the header is a no-op in modern Chrome.

The request's destination: 'document', 'image', 'script', 'style', 'font', 'iframe', 'empty' (fetch/XHR), etc. Browser-set, not client-controllable.

Sec-Fetch-Dest: document

Developer note: Use server-side as a CSRF defense: reject state-changing requests where Sec-Fetch-Dest is not 'empty' or 'document'.

How the request was initiated: 'navigate', 'cors', 'no-cors', 'same-origin', 'websocket'. Browser-set.

Sec-Fetch-Mode: cors

Relationship between the initiator's origin and the target's origin: 'same-origin', 'same-site', 'cross-site', 'none' (top-level nav from address bar).

Sec-Fetch-Site: same-origin

Developer note: A 'none' value plus a POST is suspicious, top-level navigations should be GET. Useful CSRF heuristic.

Set to '?1' when the navigation was triggered by user activation (click, key press). Absent otherwise. Lets servers tell user-initiated nav from script-initiated nav.

Sec-Fetch-User: ?1

Low-entropy User-Agent client hint listing the browser brand(s) and major version. Sent by default on Chromium-based browsers; replaces fingerprintable bits of User-Agent.

Sec-CH-UA: "Chromium";v="120", "Not(A:Brand";v="24", "Google Chrome";v="120"

Low-entropy hint: '?0' for desktop, '?1' for mobile form factor. Always sent on Chromium.

Sec-CH-UA-Mobile: ?0

Operating system family: 'Windows', 'macOS', 'Linux', 'Android', 'iOS', 'Chrome OS'. Low-entropy, always sent.

Sec-CH-UA-Platform: "macOS"

Server's request for additional high-entropy client hints on subsequent requests. The browser may comply on next navigation.

Accept-CH: Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, DPR, Viewport-Width

Device pixel ratio. Lets servers send appropriately-resolution images without DOM-side <picture> logic. Requires Accept-CH opt-in.

DPR: 2

User has opted into a 'data saver' mode at the OS or browser level. Server should consider sending lighter assets, lower-resolution images, or fewer prefetches.

Save-Data: on

Named endpoints to which the browser will POST violation reports (CSP, COEP, Deprecation, Intervention). Successor to the older Report-To header.

Reporting-Endpoints: csp-endpoint="https://example.com/csp", default="https://example.com/reports"

Developer note: Reference endpoints by name from CSP's report-to directive: `Content-Security-Policy: ...; report-to csp-endpoint`.

JSON-formatted older form of the Reporting API endpoint declaration. Still supported but Reporting-Endpoints is preferred.

Report-To: {"group":"csp","max_age":10886400,"endpoints":[{"url":"https://example.com/csp"}]}

Opt-in to Network Error Logging. Browser collects DNS/TCP/TLS failures and POSTs them to a configured reporting endpoint, giving you visibility into clients that never reached the server.

NEL: {"report_to":"default","max_age":2592000,"include_subdomains":true}

Developer note: Pair with a Reporting-Endpoints entry named 'default'. NEL is the only way to see failures that happen before your request handler runs.

Control options for the current connection. Common: 'keep-alive', 'close', 'Upgrade' (for WebSocket).

Connection: Upgrade

Requests a protocol upgrade on the connection. Used for WebSocket, HTTP/2 over h2c.

Upgrade: websocket

HTTP/1.1 connection persistence parameters (timeout, max requests per connection). HTTP/2 and HTTP/3 ignore this, multiplexing replaces it.

Keep-Alive: timeout=60, max=100

Hop-by-hop encoding applied to the message body. Almost always 'chunked' for streaming responses of unknown length.

Transfer-Encoding: chunked

Developer note: HTTP/2 and HTTP/3 prohibit this header, they have native framing. Sending it over h2 is a protocol error.

Transfer encodings the client is willing to accept (other than 'chunked'). Rarely seen in modern traffic except 'TE: trailers' to opt into Trailer headers over HTTP/2.

TE: trailers

Lists header fields that will appear in the trailer section after a chunked-encoded body. Used by gRPC-Web to send status codes after the response stream.

Trailer: Grpc-Status, Grpc-Message

Hostname and port of the target server. Required for HTTP/1.1 (used for virtual hosting).

Host: api.alldevtoolshub.com:443

Original client IP(s) when the request has passed through a proxy chain. Comma-separated list, leftmost is the original client.

X-Forwarded-For: 203.0.113.7, 198.51.100.4

Developer note: Untrusted, anyone can set this header. Configure your proxy chain so only your trusted edge appends, then trust only the leftmost N hops.

Original protocol used by the client (http or https) when terminated at a TLS-offloading proxy.

X-Forwarded-Proto: https

Standardized version of X-Forwarded-*. Combines for=, by=, proto=, host= into one header. Less widely supported in practice.

Forwarded: for=203.0.113.7;proto=https;by=198.51.100.1

Intermediaries (proxies, gateways) the message has traversed.

Via: 1.1 vegur, 2.0 alldevtoolshub-edge

Single IP of the original client, set by a reverse proxy. Simpler alternative to X-Forwarded-For's comma-separated chain, but with the same trust caveats.

X-Real-IP: 203.0.113.42

Developer note: Trust only when set by your own infrastructure. Strip from inbound client requests before any internal hop reads it.

Original Host header before the reverse proxy rewrote it. Lets the backend reconstruct the public URL for redirects and absolute links.

X-Forwarded-Host: app.example.com

Decremented by each proxy on TRACE and OPTIONS requests. When it reaches 0, the next proxy responds with its own state, useful for debugging proxy chains.

Max-Forwards: 10

Identifies the client software (browser, library, bot).

User-Agent: Mozilla/5.0 (Macintosh; ...) AppleWebKit/...

Identifies the server software handling the response.

Server: cloudflare

Developer note: Many security-conscious deployments strip or genericize this header. Information leakage > marketing.

W3C standard distributed-tracing context: version, trace-id, span-id, trace-flags. Used by OpenTelemetry, Datadog, Honeycomb.

traceparent: 00-0af7651916cd43dd8448eb211c80319c-b7ad6b7169203331-01

Vendor-specific trace metadata that travels alongside traceparent.

tracestate: dd=s:1;o:rum,congo=t61rcWkgMzE

Unique identifier for the request, propagated across services for log correlation.

X-Request-ID: f47ac10b-58cc-4372-a567-0e02b2c3d479

Companion to traceparent for propagating arbitrary key-value metadata (user ID, tenant, feature flags) along a distributed trace.

baggage: user.id=42,tenant=acme,feature.x=on

Developer note: Never put PII or secrets here. baggage flows to every downstream service and may be logged at each hop.

Server-side performance metrics surfaced to the browser. Shows up in DevTools and the Performance API. Names + optional duration + description.

Server-Timing: db;dur=53.2, cache;dur=8.1;desc="redis hit"

Advertises alternative services (typically HTTP/3 over QUIC) the client should prefer for subsequent connections to this origin.

Alt-Svc: h3=":443"; ma=86400

Sent by the client to indicate which alternative service (from a prior Alt-Svc) it actually used. Helps origin servers debug HTTP/3 rollouts.

Alt-Used: alt.example.com:443

HTTP/2 and HTTP/3 priority signal: 'u' (urgency 0–7) and 'i' (incremental). Lets clients/servers hint relative importance to influence multiplexed-stream ordering.

Priority: u=1, i

Set to '1' on requests sent as TLS 1.3 0-RTT early data. Servers should reject early-data on non-idempotent methods to defend against replay.

Early-Data: 1

Typed relationships between the current resource and other resources, pagination, alternate representations, preload hints, web APIs. Most common modern use: HTTP/2 server-push and preload signals.

<style.css>; rel=preload; as=style

Server-side equivalent of the <meta name="robots"> tag. Lets you control crawler indexing for non-HTML responses (PDFs, images, JSON) where you cannot inject HTML meta.

X-Robots-Tag: noindex, nofollow

Allows a service worker registration to control a scope broader than its own path. Sent on the SW script response.

Service-Worker-Allowed: /

URL to redirect to (3xx responses) or the URL of a newly created resource (201 Created).

Location: https://api.alldevtoolshub.com/v2/users/42

How long the client should wait before retrying. Sent with 429, 503, and some 3xx responses. Seconds (integer) or HTTP-date.

Retry-After: 120

Methods supported on the target resource. Required on 405 Method Not Allowed responses.

Allow: GET, POST, OPTIONS