HTTP Headers Reference
HTTP headers are key-value metadata carried in requests and responses. This table lists the most common request and response headers with kind and notes for quick lookup while debugging APIs.
| Header | Kind | Meaning |
|---|---|---|
| Accept | Request | Media types the client can handle (e.g. application/json, text/html) |
| Accept-Encoding | Request | Acceptable compression (gzip, br, deflate) |
| Accept-Language | Request | Preferred natural languages and weights (e.g. zh-CN,en;q=0.8) |
| Authorization | Request | Auth credential, e.g. Bearer <token> or Basic <base64> |
| Cache-Control | General | Cache directives (no-cache, max-age=3600, private) |
| Cookie | Request | Cookies set by server via Set-Cookie |
| Content-Type | General | Media type of request or response body (e.g. application/json; charset=utf-8) |
| Host | Request | Target host and port, required by HTTP/1.1 |
| Origin | Request | Source origin for cross-origin requests, used in CORS |
| Referer | Request | URL of the page making the request (spelled Referer) |
| User-Agent | Request | Client software identifier (browser / crawler / lib name & version) |
| If-None-Match | Request | Conditional request; carries last ETag for cache validation |
| If-Modified-Since | Request | Conditional request; return only if modified after this time |
| Access-Control-Allow-Origin | Response | CORS allowed origin (* or specific) |
| Content-Length | Response | Byte length of the response body |
| Content-Encoding | Response | Compression applied to response body (gzip, br) |
| Set-Cookie | Response | Server issues cookie, may set HttpOnly/Secure/SameSite |
| ETag | Response | Version identifier of the resource for cache validation |
| Last-Modified | Response | Last modification time of the resource |
| Location | Response | Target URL for 3xx redirect |
| Expires | Response | Absolute expiry time (superseded by Cache-Control) |
| Server | Response | Server software name and version |
| WWW-Authenticate | Response | Auth challenge on 401 (e.g. Basic) |
| Retry-After | Response | Suggested retry delay in seconds on 503/429 |
| Strict-Transport-Security | Response | HSTS, force HTTPS for future requests |
| Connection | General | Connection management (keep-alive or close) |
| Date | General | Message generation date-time (GMT) |
Frequently Asked Questions
What is the difference between request and response headers?
Request headers are sent by the client (Accept, Authorization, Cookie) telling the server what it wants and who it is. Response headers come from the server (Content-Type, Set-Cookie, Cache-Control) describing what was returned and how to handle it. Some headers like Content-Type and Cache-Control appear on both sides.
What are common Cache-Control directives?
no-store (never cache), no-cache (revalidate), max-age=seconds (freshness lifetime), public/private (proxy-cacheable), must-revalidate (revalidate after expiry).
Which headers relate to CORS?
On the request side Origin; on the response side Access-Control-Allow-Origin (allowed origin), Access-Control-Allow-Methods, Access-Control-Allow-Headers, and Access-Control-Allow-Credentials.
How do ETag and Last-Modified work with caching?
Both are validators. The client stores the ETag/Last-Modified from the first response and sends If-None-Match/If-Modified-Since on later requests; if unchanged the server returns 304 Not Modified and the client reuses the cache, saving bandwidth.