Data lookups

HTTP headers

The purpose and syntax of common request and response headers.

All lookups

32 entries.

HeaderDirectionPurposeExample
Accept Request Content types the client can handle. Accept: text/html, application/json
Accept-Encoding Request Compression the client supports. Accept-Encoding: gzip, br
Accept-Language Request Preferred human languages. Accept-Language: en-GB, en;q=0.9
Authorization Request Credentials for the resource. Authorization: Bearer eyJhbGci…
Cache-Control Both Caching rules for browsers and proxies. Cache-Control: max-age=3600, public
Content-Disposition Response Show inline or download, and the filename. Content-Disposition: attachment; filename="report.pdf"
Content-Encoding Response Compression applied to the body. Content-Encoding: gzip
Content-Length Both Size of the body in bytes. Content-Length: 34821
Content-Security-Policy Response Restricts what the page may load — a key defence against XSS. Content-Security-Policy: default-src 'self'
Content-Type Both Media type of the body. Content-Type: application/json; charset=utf-8
Cookie Request Cookies the browser is sending back. Cookie: session=abc123
ETag Response Version identifier used for cache validation. ETag: "9f2a1c"
Expires Response Absolute expiry date for the cached copy. Expires: Wed, 21 Oct 2026 07:28:00 GMT
Host Request Which domain is being asked for — required in HTTP/1.1. Host: www.example.com
If-Modified-Since Request Only send the body if it changed since this date. If-Modified-Since: Sat, 29 Oct 2026 19:43:31 GMT
If-None-Match Request Only send the body if the ETag differs. If-None-Match: "9f2a1c"
Last-Modified Response When the resource last changed. Last-Modified: Sat, 29 Oct 2026 19:43:31 GMT
Location Response Where to redirect to. Location: https://example.com/new-page
Origin Request The origin making a cross-site request. Origin: https://example.com
Permissions-Policy Response Which browser features the page may use. Permissions-Policy: camera=(), geolocation=()
Referer Request The page that linked here. Misspelled in the original spec and never fixed. Referer: https://example.com/search
Referrer-Policy Response How much referrer information to share. Referrer-Policy: strict-origin-when-cross-origin
Retry-After Response How long to wait before retrying — pairs with 429 and 503. Retry-After: 120
Server Response Software running the server. Often hidden for security. Server: nginx
Set-Cookie Response Asks the browser to store a cookie. Set-Cookie: id=abc; HttpOnly; Secure; SameSite=Lax
Strict-Transport-Security Response Forces HTTPS for future visits (HSTS). Strict-Transport-Security: max-age=31536000
User-Agent Request Identifies the browser or client software. User-Agent: Mozilla/5.0 …
Vary Response Which request headers change the response, for correct caching. Vary: Accept-Encoding
X-Content-Type-Options Response Stops browsers guessing content types. X-Content-Type-Options: nosniff
X-Forwarded-For Request The original client IP, added by proxies. X-Forwarded-For: 203.0.113.7
X-Frame-Options Response Controls framing, to prevent clickjacking. X-Frame-Options: SAMEORIGIN
Access-Control-Allow-Origin Response Which origins may read the response (CORS). Access-Control-Allow-Origin: *
Header names are case-insensitive. "Request" headers are sent by the browser; "response" headers come back from the server.