HTTP Header Reference

example.com:8080

Target host and port; required since HTTP/1.1, used for virtual hosts and TLS SNI routing.

application/json; charset=utf-8

Media type and charset of the body; garbled API responses usually trace back to this.

Watch out: A charset mismatch makes browsers decode with the wrong encoding; for JSON, plain application/json is safest.

1024

Body size in bytes, not characters; a CJK character usually takes 3 bytes.

gzip

Body compression such as gzip, br, or zstd; it compresses the bytes counted by Content-Length.

Watch out: When both are present, Content-Length counts the uncompressed size.

zh-Hans

Natural language of the body; multilingual sites negotiate it with Accept-Language.

attachment; filename="report.csv"

Tells the browser to display inline or download, and supplies the filename.

Watch out: For non-ASCII filenames use filename*=UTF-8, otherwise the name arrives garbled.

chunked

Chunked transfer; must not be combined with Content-Length.

Watch out: Sending both with Content-Length makes gateways treat the message as smuggling.

keep-alive

Connection management: close ends the connection, upgrade switches protocols.

timeout=5, max=1000

Keep-alive parameters for connection reuse: idle timeout and max requests.

1.1 varnish

Records proxies and gateways the message passed through, useful for tracing and cache tiers.

Sun, 20 Sep 2026 03:30:00 GMT

When the message was created; must use the GMT format.

text/html,application/json;q=0.9

Media types the client accepts, with q values for priority.

Watch out: If the backend answers 406, compare this header with the response Content-Type first.

gzip, br

Compression algorithms the client supports; the server decides whether to compress.

zh-CN,zh;q=0.9,en;q=0.8

Preferred natural languages; how multilingual sites pick a locale.

Watch out: Switching language on this header alone lets crawlers index one URL in several languages; pair it with Vary.

utf-8

Character sets the client accepts; modern browsers mostly report utf-8 only.

Mozilla/5.0 (Windows NT 10.0; Win64; x64)

Client identifier used by servers for compatibility and risk control.

Watch out: Do not gate capabilities on it: modern browsers spoof it and tablets look like phones.

https://example.com/list

Referrer page URL, used for hotlink protection and referrer analytics.

Watch out: Browsers drop it when navigating from HTTPS to HTTP, which breaks naive hotlink rules.

sessionid=abc123; theme=dark

Cookie pairs the client sends back; how server-side sessions are carried.

Bearer eyJhbGciOi...

Credentials, commonly Bearer tokens or Basic base64 pairs.

Watch out: On 401 check that the header is sent at all and that Bearer is followed by exactly one space.

Basic dXNlcjpwYXNz

Authenticates to a proxy; separate from Authorization.

Watch out: A 407 needs this header; putting the value in Authorization has no effect.

bytes=0-1023

Requests only part of a resource; powers resumable downloads and video seeking.

Watch out: The server should answer 206; a 200 means ranges are not supported.

100-continue

Asks the server whether to send a large body before uploading it.

Watch out: Gateways that do not forward Expect stall into a timeout; drop the header for large uploads.

websocket

Requests a protocol upgrade; key to the WebSocket handshake.

Watch out: The reverse proxy must forward both Upgrade and Connection: upgrade or the handshake fails.

for=203.0.113.1;proto=https

Standardized proxy chain info, the official replacement for X-Forwarded-*.

203.0.113.1, 10.0.0.5

Chain of client IPs appended per hop; the leftmost entry is the client.

Watch out: Clients can forge it; only trust your own proxy hop or a custom header.

https

Original request scheme; how apps behind a proxy decide if HTTPS was used.

203.0.113.1

Single-value client IP header commonly set by Nginx.

nginx/1.24.0

Server software identifier; leaking the version helps attackers.

Watch out: Hide the version in production, for example with server_tokens off.

sessionid=abc123; Path=/; HttpOnly; Secure; SameSite=Lax

Sets a cookie; its attributes define the security boundary.

Watch out: Session cookies need HttpOnly, Secure, and SameSite; missing any one widens the attack surface.

Basic realm="api"

Declares the authentication scheme; sent together with 401.

Watch out: Answering 403 instead of 401 leaves clients unsure whether to prompt for credentials.

Basic realm="proxy"

Proxy challenges for authentication; paired with 407.

https://example.com/new

Redirect target, used together with a 3xx status code.

Watch out: Relative targets break under sub-path deployments; cross-host redirects need an absolute URL.

120

Tells the client how long to wait before retrying, in seconds or an HTTP date.

Watch out: Send it with 429 and 503, otherwise clients retry immediately and add load.

GET, POST, HEAD

Methods allowed on the resource; paired with 405.

bytes

Declares range request support; required for resumable downloads.

bytes 0-1023/4096

Range and total size of a partial response; paired with 206.

<https://example.com/next>; rel="next"

Declares related resources, used for pagination and preloading.

Express

Framework fingerprint; better disabled to reduce information exposure.

*

Which origins may read Performance timing data, needed for cross-origin RUM.

h3=":443"; ma=86400

Advertises alternative service endpoints; how HTTP/3 is discovered.

public, max-age=3600

The main caching directive: no-store forbids storage, no-cache forces revalidation.

Watch out: no-cache means revalidate every time, not skip caching; use no-store to avoid storage.

Sun, 20 Sep 2026 04:30:00 GMT

HTTP/1.0 expiry time; Cache-Control takes precedence.

no-cache

Legacy HTTP/1.0 header kept for old clients, same meaning as no-cache.

"686897696a7c876b7e"

Resource version fingerprint used by conditional requests.

Watch out: Servers computing different ETags behind a load balancer keep busting the cache; disable or unify them.

Sat, 19 Sep 2026 12:00:00 GMT

When the resource was last modified, with second-level precision.

"686897696a7c876b7e"

Sends the previous ETag so the server can answer 304 when unchanged.

Watch out: When revalidation seems broken, compare what the browser sends with the response ETag.

Sat, 19 Sep 2026 12:00:00 GMT

Conditional request by modification time; coarser but widely supported.

"686897696a7c876b7e"

Requires a matching version before writing; how optimistic locking is done.

Watch out: Write endpoints without it lose updates; pair it with 412.

Sat, 19 Sep 2026 12:00:00 GMT

Like If-Match but by time; returns 412 when the condition fails.

3600

Seconds the response has been in cache, compared with max-age to check freshness.

Accept-Encoding, Accept-Language

Declares which request headers change the response; caches must key on them.

Watch out: Omitting Vary may serve a compressed body to a client that cannot decode it, or mix language versions.

https://app.example.com

The requesting origin, added by the browser and not forgeable by page scripts.

https://app.example.com

Allowed cross-origin source; using * forbids credentials.

Watch out: With cookies the value must echo the exact origin; a star makes the browser discard the response.

GET, POST, PUT, DELETE

Methods allowed in a preflight request.

Content-Type, Authorization

Custom request headers allowed in a preflight request.

Watch out: A custom header missing from the list fails the preflight, and the console only says CORS.

true

Whether cookies and credentials may be sent.

Watch out: Once true, the frontend must send withCredentials; missing either side yields no data.

Content-Disposition

Response headers page scripts may read; only a few are readable by default.

Watch out: Not seeing the download filename usually means Content-Disposition is not exposed.

600

How long a preflight result may be cached, cutting OPTIONS requests.

PUT

Declares the intended method in a preflight; set automatically by the browser.

Authorization

Declares the custom headers the real request will use.

max-age=63072000; includeSubDomains; preload

Forces HTTPS for future visits, preventing downgrade and cookie hijacking.

Watch out: Preload is hard to undo; validate with a small max-age before submitting.

default-src "self"; object-src "none"

Content security policy limiting where scripts, styles, and images may load from; the main XSS defense.

Watch out: Roll out with Content-Security-Policy-Report-Only first, then switch to the enforcing header.

SAMEORIGIN

Whether the page may be framed, preventing clickjacking.

Watch out: When both are present, the CSP frame-ancestors directive wins.

nosniff

Stops browsers from sniffing types, preventing text from being run as script.

strict-origin-when-cross-origin

Controls how much referrer information is sent when navigating away.

camera=(), geolocation=(self)

Enables or disables browser features such as camera, location, and microphone.

same-origin

Isolates browsing contexts; a prerequisite for high-resolution timers and SharedArrayBuffer.

require-corp

Requires every embedded resource to opt in.

same-origin

Restricts the resource to same-origin pages, blocking cross-site reads.

"cache", "cookies"

Asks the browser to clear cache and cookies for the site, often on logout.

Watch out: It only works over HTTPS, and wrong quoting fails silently.

0

Legacy XSS filter toggle for old browsers; deprecated, best set to 0.

Watch out: Setting 1 introduces side-channel issues; modern practice is to drop it and use CSP.