HTTP Headers & RFC Reference

Lists media types the client can receive.

Accept: application/json

Lists content codings the client can decode.

Accept-Encoding: gzip, br, zstd

Lists preferred natural languages.

Accept-Language: en-US, en;q=0.9

Legacy header for acceptable character sets.

Accept-Charset: utf-8

Carries credentials for the target resource.

Authorization: Bearer eyJhbGciOi...

Challenges the client to authenticate.

WWW-Authenticate: Bearer realm="api"

Carries credentials for an intermediary proxy.

Proxy-Authorization: Basic dXNlcjpwYXNz

Challenges the client to authenticate to a proxy.

Proxy-Authenticate: Basic realm="proxy"

Identifies the media type of the message body.

Content-Type: application/json; charset=utf-8

States the body length in octets.

Content-Length: 348

Identifies content codings applied to the body.

Content-Encoding: gzip

Identifies the intended language of the representation.

Content-Language: en-US

Identifies a URI for the representation in the response body.

Content-Location: /reports/current.json

Suggests inline display or download handling for a body.

Content-Disposition: attachment; filename="report.pdf"

Identifies transfer codings for HTTP/1.1 message framing.

Transfer-Encoding: chunked

Identifies the authority of the target URI.

Host: api.example.com

Identifies software making the request.

User-Agent: Mozilla/5.0 ...

Identifies the referring resource URL when available.

Referer: https://example.com/docs

Identifies the origin that initiated a request.

Origin: https://app.example.com

Provides a target URI for redirects or newly created resources.

Location: https://example.com/new-path

Requests part of a representation.

Range: bytes=0-1023

Describes the byte range carried in a partial response.

Content-Range: bytes 0-1023/4096

Advertises whether range requests are supported.

Accept-Ranges: bytes

Expresses typed links related to the current resource.

Link: <https://api.example.com/page/2>; rel="next"

Tells clients when to retry after rate limiting or temporary unavailability.

Retry-After: 120

Controls caching, freshness, revalidation, and storage behavior.

Cache-Control: public, max-age=3600

Provides an entity tag for cache validation and concurrency checks.

ETag: "v3-report"

Sends ETags the client already has for conditional requests.

If-None-Match: "v3-report"

States when the representation was last changed.

Last-Modified: Tue, 15 Nov 1994 12:45:26 GMT

Asks for the resource only if modified after a date.

If-Modified-Since: Tue, 15 Nov 1994 12:45:26 GMT

Gives an absolute expiration time for cached content.

Expires: Tue, 15 Nov 1994 12:45:26 GMT

Lists request headers that affect the selected representation.

Vary: Accept-Language, Accept-Encoding

Indicates how long a cached response has been stored.

Age: 42

Legacy cache-related header retained for old clients.

Pragma: no-cache

Sends stored cookies to the server.

Cookie: session=abc123; theme=dark

Asks the user agent to store a cookie.

Set-Cookie: session=abc123; Path=/; Secure; HttpOnly; SameSite=Lax

Tells browsers which origin may read a cross-origin response.

Access-Control-Allow-Origin: https://app.example.com

Lists methods allowed by a CORS preflight response.

Access-Control-Allow-Methods: GET, POST, OPTIONS

Lists request headers allowed by CORS preflight.

Access-Control-Allow-Headers: Authorization, Content-Type

Allows browsers to expose credentialed CORS responses.

Access-Control-Allow-Credentials: true

Lists response headers visible to browser JavaScript.

Access-Control-Expose-Headers: X-Request-ID, RateLimit-Remaining

Controls how long browsers may cache a CORS preflight result.

Access-Control-Max-Age: 600

Names the method for an upcoming CORS request.

Access-Control-Request-Method: PATCH

Names headers for an upcoming CORS request.

Access-Control-Request-Headers: authorization, content-type

Controls which content sources the browser may load or execute.

Content-Security-Policy: default-src 'self'; script-src 'self'

Reports CSP violations without enforcing the policy.

Content-Security-Policy-Report-Only: default-src 'self'; report-to csp

Tells browsers to use HTTPS for future requests to the host.

Strict-Transport-Security: max-age=31536000; includeSubDomains

Prevents some browser MIME sniffing when set to nosniff.

X-Content-Type-Options: nosniff

Legacy clickjacking protection header.

X-Frame-Options: DENY

Controls how much referrer information browsers send.

Referrer-Policy: strict-origin-when-cross-origin

Controls access to browser features in documents and frames.

Permissions-Policy: geolocation=(), camera=()

Defines reporting endpoints for browser-generated reports.

Report-To: {"group":"csp","max_age":10886400,"endpoints":[{"url":"https://reports.example.com/csp"}]}

Provides browser brand client hints.

Sec-CH-UA: "Chromium";v="124", "Not:A-Brand";v="99"

Indicates when the response was generated.

Date: Tue, 15 Nov 1994 12:45:26 GMT

Identifies server software in a response.

Server: nginx

Standard proxy header for original client and protocol information.

Forwarded: for=203.0.113.43;proto=https;host=example.com

Communicates the maximum request quota in a rate-limit window.

RateLimit-Limit: 100

Communicates remaining requests in the current rate-limit window.

RateLimit-Remaining: 42

Communicates when rate-limit quota resets.

RateLimit-Reset: 60