HTTP Headers Reference
A reference of 60+ common request and response headers with usage, examples and security notes — filterable live by name, direction and category.
| HEADER | DIR | CAT | Description | Example |
|---|---|---|---|---|
| Authorization | req | Auth | Request credentials: Basic / Bearer / Digest schemes | Bearer eyJhbGciOi… |
| Proxy-Authorization | req | Auth | Credentials for a proxy server | Basic dXNlcjpwYXNz |
| WWW-Authenticate | res | Auth | Declares the auth method in 401 responses | Bearer realm="api" |
| Cookie | req | Other | Sends stored cookies back to the server | sid=abc123; theme=dark |
| Set-Cookie | res | Other | Sets cookies with HttpOnly / Secure / SameSite attributes | sid=abc; HttpOnly; SameSite=Lax |
| X-Api-Key | req | Auth | De-facto API key header (non-RFC) | ak_live_9f2e… |
| X-CSRF-Token | req | Auth | CSRF protection token (framework convention) | 9f8e7d6c-… |
| Cache-Control | both | Caching | Master caching policy: max-age / no-cache / immutable… | public, max-age=31536000, immutable |
| Pragma | both | Caching | HTTP/1.0 legacy equivalent of no-cache | no-cache |
| ETag | res | Caching | Resource fingerprint, pairs with If-None-Match for 304 | "a3f2-19" |
| Expires | res | Caching | Absolute expiry (HTTP/1.0 legacy, weaker than Cache-Control) | Wed, 21 Oct 2026 07:28:00 GMT |
| Age | res | Caching | Seconds the object has sat in a proxy cache | 24 |
| Vary | res | Caching | Request headers that key the cache entry | Accept-Encoding, User-Agent |
| Clear-Site-Data | res | Caching | Clears browser site data (cache / cookies / storage) | "cache", "cookies" |
| If-None-Match | req | Conditional | Carries the last ETag; 304 when it matches | "a3f2-19" |
| If-Modified-Since | req | Conditional | Date-based conditional request (weaker than ETag) | Wed, 21 Oct 2026 07:28:00 GMT |
| If-Match | req | Conditional | Optimistic locking: apply only if the ETag matches | "a3f2-19" |
| If-Unmodified-Since | req | Conditional | Date-based optimistic locking | Wed, 21 Oct 2026 07:28:00 GMT |
| If-Range | req | Conditional | Guards Range requests: serve the slice only if unchanged | "a3f2-19" |
| Content-Type | both | Content | Body media type and charset | application/json; charset=utf-8 |
| Content-Length | both | Content | Body size in decimal bytes | 3481 |
| Content-Encoding | res | Content | Body compression: gzip / br / zstd | br |
| Content-Language | both | Content | Language the body is intended for | zh-CN |
| Content-Disposition | res | Content | Inline display vs attachment download with filename | attachment; filename="a.pdf" |
| Content-Range | res | Content | Byte range served in 206 responses | bytes 0-1023/146515 |
| Content-Location | res | Content | Alternate location for the returned body | /docs/en/index.html |
| Accept | req | Content | Acceptable media types (content negotiation) | application/json, text/*;q=0.8 |
| Accept-Encoding | req | Content | Acceptable compressions | gzip, deflate, br |
| Accept-Language | req | Content | Preferred languages with weights | zh-CN, en;q=0.8 |
| Accept-Ranges | res | Content | Advertises support for Range requests | bytes |
| Origin | req | CORS | Request origin (scheme+host+port); sent with CORS and POST | https://dev.miaokit.tech |
| Access-Control-Allow-Origin | res | CORS | Origins allowed to read the response cross-origin | https://dev.miaokit.tech |
| Access-Control-Allow-Methods | res | CORS | Preflight response: allowed HTTP methods | GET, POST, PUT |
| Access-Control-Allow-Headers | res | CORS | Preflight response: allowed request headers | Content-Type, Authorization |
| Access-Control-Allow-Credentials | res | CORS | Allows credentialed requests (origin cannot be *) | true |
| Access-Control-Expose-Headers | res | CORS | Extra response headers readable by JS | X-Request-Id |
| Access-Control-Max-Age | res | CORS | How long the preflight result may be cached | 86400 |
| Timing-Allow-Origin | res | CORS | Permits Resource Timing high-resolution timings | * |
| Host | req | Other | Target host and port; mandatory in HTTP/1.1 (vhost routing) | dev.miaokit.tech |
| User-Agent | req | Other | Client software identifier | Mozilla/5.0 … Chrome/130.0 |
| Referer | req | Other | Referring page (historic misspelling, fixed by spec) | https://dev.miaokit.tech/ |
| Referrer-Policy | both | Other | Controls how much referrer is sent | strict-origin-when-cross-origin |
| Range | req | Conditional | Byte range of the body (resumable downloads) | bytes=1048576- |
| Connection | both | Other | Connection management: keep-alive / close | keep-alive |
| Upgrade | req | Other | Protocol upgrade (with Connection, e.g. WebSocket) | websocket |
| Transfer-Encoding | res | Other | Chunked transfer encoding | chunked |
| Via | both | Other | Proxies and gateways traversed | 1.1 example-proxy |
| Date | both | Other | Time the message was produced | Wed, 21 Oct 2026 07:28:00 GMT |
| Expect | req | Other | Client expectation (100-continue for large bodies) | 100-continue |
| X-Forwarded-For | req | Other | Original client IP chain recorded by reverse proxies | 203.0.113.7, 70.41.3.18 |
| X-Forwarded-Proto | req | Other | Original scheme recorded by reverse proxies | https |
| X-Request-Id | both | Other | Correlation ID for request tracing | f4e1d2c3-0001 |
| X-Requested-With | req | Other | Ajax-era marker (XMLHttpRequest), rarely needed now | XMLHttpRequest |
| Idempotency-Key | req | Other | Idempotency key: retries never double-apply | b3c1d9e2-… |
| Server | res | Other | Server software banner (consider minimizing) | openresty |
| Location | res | Other | Redirect target (3xx) or new resource (201) | /en/t/json/ |
| Retry-After | res | Other | Suggested wait after 503/429 | 30 |
| Allow | res | Other | Supported methods listed in 405 responses | GET, HEAD, PUT |
| Link | res | Other | Resource relations (pagination next/prev, preload) | </page/2>; rel="next" |
| Refresh | res | Other | Non-standard timed refresh/redirect | 5; url=/new |
| Strict-Transport-Security | res | Other | HSTS: force HTTPS duration and subdomains | max-age=31536000; includeSubDomains |
| Content-Security-Policy | res | Other | CSP: allowlist for scripts, styles and more | default-src 'self' |
| X-Content-Type-Options | res | Other | Disables MIME sniffing (nosniff) | nosniff |
| X-Frame-Options | res | Other | Anti-framing (DENY/SAMEORIGIN; superseded by CSP frame-ancestors) | DENY |
| Permissions-Policy | res | Other | Browser feature grants: camera, geolocation… | camera=(), geolocation=(self) |
| X-RateLimit-Limit | res | Other | Rate-limit quota (usually with Remaining/Reset) | 600 |
| X-RateLimit-Remaining | res | Other | Quota remaining in the window | 587 |
| X-RateLimit-Reset | res | Other | When the quota resets (seconds or timestamp) | 1729900000 |
>_ USAGE GUIDE
Debugging an API usually means staring at headers: why did auth fail, why isn't the cache hitting, why is the cross-origin request blocked? This reference bundles 60+ common headers — request-side, response-side and bidirectional — each with a direction badge, category, bilingual description and example value, filterable live by keyword, direction and category. The data is bundled locally and works offline.
- Filter by keyword: type
auth,cacheorcors; name-prefix matches rank first - Narrow by direction: switch to Request or Response;
bothheaders like Cache-Control always stay - Focus by category: Auth / Caching / Content / CORS / Conditional / Other
- Read the examples: values you can paste almost verbatim, such as
public, max-age=31536000, immutable
>_ FAQ
Q1 · What is the correct Bearer format for Authorization?
Authorization: Bearer <token> — one space after Bearer, no quotes around the token. Basic auth is Basic base64(user:password). When debugging a 401, verify the format here before doubting the key itself; format errors usually surface as a vague "invalid credentials".
Q2 · Which response headers does CORS require?
The minimum is Access-Control-Allow-Origin; with cookies you also need Access-Control-Allow-Credentials: true and a specific origin (never *). Preflight (OPTIONS) responses require Access-Control-Allow-Methods and Access-Control-Allow-Headers; to read custom headers like X-Request-Id from JS, add Access-Control-Expose-Headers.
Q3 · What are the common Cache-Control recipes?
Hashed static assets: public, max-age=31536000, immutable. HTML entry pages: no-cache (revalidate every time). Sensitive APIs: no-store. Note that no-cache does not mean "never cache" — it means "validate before each use"; max-age=0, must-revalidate is similar but stricter.
Q4 · X-Frame-Options or CSP frame-ancestors?
Both prevent clickjacking. X-Frame-Options is the legacy standard with only DENY and SAMEORIGIN; CSP's frame-ancestors supports origin allowlists and richer semantics. Modern browsers prefer CSP; send both (the legacy header covers old browsers) — the description column notes this.
Q5 · ETag or Last-Modified for 304s?
ETag is a content fingerprint (strong or weak); Last-Modified is a second-resolution timestamp. Prefer ETag — it senses content changes while mtimes can be unreliable after deployments. When both are sent, If-None-Match takes precedence over If-Modified-Since; a matching conditional request returns 304 without a body.