HTTP headers
HTTP header lookup
Look up what common request and response headers mean, with short examples and references to the registry or spec.
| Header | Answer | Related |
|---|---|---|
| Accept | Accept tells the server which media types the client can read. | Content-Type, Vary, HTTP 200, HTTP 415 |
| Accept-Encoding | Accept-Encoding tells the server which compression formats the client supports. | Content-Encoding, Vary, HTTP 200 |
| Accept-Language | Accept-Language tells the server which languages the client prefers. | Vary, HTTP 200 |
| Authorization | Authorization sends credentials for the requested resource. | WWW-Authenticate, HTTP 401, HTTP 403 |
| WWW-Authenticate | WWW-Authenticate tells the client how to authenticate. | Authorization, HTTP 401 |
| Cache-Control | Cache-Control sets caching rules for browsers and shared caches. | CDN-Cache-Control, ETag, Expires, Age, Vary, HTTP 200, HTTP 304 |
| CDN-Cache-Control | CDN-Cache-Control gives cache directives specifically to CDN shared caches. | Cache-Control, Age, Vary, HTTP 200, HTTP 304 |
| ETag | ETag identifies a specific version of a resource representation. | If-None-Match, Last-Modified, Cache-Control, HTTP 200, HTTP 304, HTTP 412 |
| If-None-Match | If-None-Match asks the server to respond only if the ETag no longer matches. | ETag, Cache-Control, GET, HEAD, HTTP 304, HTTP 412 |
| If-Modified-Since | If-Modified-Since asks whether a resource changed after a timestamp. | Last-Modified, ETag, GET, HEAD, HTTP 304 |
| Last-Modified | Last-Modified gives the time a resource was last changed. | If-Modified-Since, ETag, Cache-Control, HTTP 200, HTTP 304 |
| Expires | Expires gives an absolute time when a response becomes stale. | Cache-Control, Age, HTTP 200, HTTP 304 |
| Age | Age says how many seconds a cached response has already been stored. | Cache-Control, CDN-Cache-Control, Expires, HTTP 200, HTTP 304 |
| Vary | Vary tells caches which request headers affect the response. | Accept, Accept-Encoding, Accept-Language, Cache-Control, HTTP 200, HTTP 304 |
| Content-Type | Content-Type identifies the media type of request or response content. | Accept, Content-Length, Content-Encoding, Content-Disposition, POST, PUT, PATCH, HTTP 200, HTTP 415 |
| Content-Length | Content-Length gives the body size in bytes. | Content-Type, Expect, POST, PUT, PATCH, HTTP 200, HTTP 400 |
| Content-Encoding | Content-Encoding says which encoding was applied to the body. | Accept-Encoding, Content-Type, Vary, HTTP 200, HTTP 415 |
| Content-Disposition | Content-Disposition hints whether content should display inline or download as a file. | Content-Type, Content-Length, HTTP 200 |
| Host | Host names the authority the client wants to reach. | Origin, Via, HTTP 400 |
| Location | Location gives the target URL for a redirect or newly created resource. | HTTP 201, HTTP 301, HTTP 302, HTTP 307, HTTP 308 |
| Referer | Referer reports the page or URL that led to the request. | Referrer-Policy, HTTP 200 |
| User-Agent | User-Agent identifies the client software making the request. | Vary, HTTP 200 |
| Expect | Expect asks the server to confirm before the client sends the body. | Content-Length, POST, PUT, HTTP 100 |
| Keep-Alive | Keep-Alive carries connection persistence parameters for legacy HTTP/1.x connections. | Upgrade, Via, HTTP 200 |
| Upgrade | Upgrade asks to switch the connection to another protocol. | Keep-Alive, Via, HTTP 101 |
| Via | Via records intermediaries that handled the message. | Host, Upgrade, Keep-Alive, HTTP 200 |
| Origin | Origin identifies the scheme, host, and port that initiated a request. | Access-Control-Allow-Origin, Access-Control-Request-Method, Host |
| Access-Control-Allow-Origin | Access-Control-Allow-Origin says which origin may read the response. | Origin, Access-Control-Allow-Credentials, Access-Control-Expose-Headers |
| Access-Control-Allow-Methods | Access-Control-Allow-Methods lists methods allowed by a CORS preflight. | Access-Control-Request-Method, Access-Control-Allow-Origin, OPTIONS |
| Access-Control-Allow-Headers | Access-Control-Allow-Headers lists request headers allowed by a CORS preflight. | Access-Control-Request-Headers, Access-Control-Allow-Origin, OPTIONS |
| Access-Control-Allow-Credentials | Access-Control-Allow-Credentials allows credentials on a CORS response. | Access-Control-Allow-Origin, Origin |
| Access-Control-Expose-Headers | Access-Control-Expose-Headers lists response headers browser JavaScript may read. | Access-Control-Allow-Origin |
| Access-Control-Request-Method | Access-Control-Request-Method tells the server which method a CORS preflight wants to use. | Origin, Access-Control-Allow-Methods, Access-Control-Allow-Origin, OPTIONS |
| Access-Control-Request-Headers | Access-Control-Request-Headers lists headers a CORS preflight wants to send. | Origin, Access-Control-Allow-Headers, Access-Control-Allow-Origin, OPTIONS |
| Strict-Transport-Security | Strict-Transport-Security tells browsers to use HTTPS for this host in the future. | Content-Security-Policy, Upgrade, HTTP 200 |
| Content-Security-Policy | Content-Security-Policy restricts where page resources can load from. | Cross-Origin-Resource-Policy, Referrer-Policy, X-Frame-Options, Strict-Transport-Security, HTTP 200 |
| Cross-Origin-Resource-Policy | Cross-Origin-Resource-Policy controls which origins can embed a resource. | Content-Security-Policy, Origin, Access-Control-Allow-Origin, HTTP 200 |
| Referrer-Policy | Referrer-Policy controls how much referrer information browsers send. | Referer, Content-Security-Policy, HTTP 200 |
| X-Frame-Options | X-Frame-Options controls whether a page can be embedded in a frame. | Content-Security-Policy, HTTP 200 |
| Cookie | Cookie sends stored cookie values to the server. | Set-Cookie, Cache-Control, HTTP 200, HTTP 401 |
| Set-Cookie | Set-Cookie asks the browser to store or update a cookie. | Cookie, Cache-Control, HTTP 200, HTTP 401 |
| Allow | Allow lists the HTTP methods supported by a resource. | OPTIONS, HTTP 204, HTTP 405 |
| Retry-After | Retry-After tells the client when to try the request again. | HTTP 429, HTTP 503 |