Request and response headers by category — syntax, directives, security notes, and related headers/codes.
AuthorizationAuthorization is the request header a client uses to present its credentials to the server. It carries a scheme (Basic, Bearer, Digest, ...) plus matching credentials and is the primary means of accessing protected resources.Proxy-AuthenticateProxy-Authenticate is the response header by which a proxy tells the client which authentication scheme to use when the proxy demands authentication. It is sent with a 407 Proxy Authentication Required response.Proxy-AuthorizationProxy-Authorization is the request header a client uses to authenticate itself to an intermediate proxy, carrying credentials. It is sent in response to the proxy's 407 and Proxy-Authenticate demand.WWW-AuthenticateWWW-Authenticate rides on a 401 Unauthorized response to tell the client which authentication scheme it must use to present credentials. It acts as the server's authentication challenge.Access-Control-Allow-CredentialsAccess-Control-Allow-Credentials is the CORS header that specifies whether the browser may hand a response to scripts when a cross-origin request carries credentials such as cookies, HTTP auth, or client certificates.Access-Control-Allow-HeadersAccess-Control-Allow-Headers is the CORS preflight-response header that declares which custom or non-simple request headers a cross-origin actual request may send. Including a header not permitted here in the real request gets blocked by the browser.Access-Control-Allow-MethodsAccess-Control-Allow-Methods is the header in a CORS preflight (OPTIONS) response that tells the browser which HTTP methods a cross-origin request may actually use. Sending a real request with a method not listed here is blocked by the browser.Access-Control-Allow-OriginAccess-Control-Allow-Origin (ACAO) is the core CORS header specifying which origin may read this response beyond the browser's Same-Origin Policy (SOP). If it's absent or doesn't match the request origin, the browser blocks access to the response body.Access-Control-Expose-HeadersAccess-Control-Expose-Headers is a CORS header that lists which response headers the browser will let client script read on a cross-origin response. Any header not named here is hidden from JavaScript beyond the safelist.Access-Control-Max-AgeAccess-Control-Max-Age is a response header specifying, in seconds, how long the browser may cache the result of a CORS preflight (OPTIONS) — the allowed methods and headers. While cached, matching requests skip the preflight, cutting a round trip.Access-Control-Request-HeadersAccess-Control-Request-Headers is a request header the browser automatically adds to a CORS preflight to tell the server which custom or non-safelisted request headers the upcoming actual request will send. The server replies with Access-Control-Allow-Headers to grant them.Access-Control-Request-MethodAccess-Control-Request-Method is a request header the browser automatically adds to a CORS preflight (OPTIONS) to tell the server which HTTP method the upcoming actual request will use. The server decides whether to allow it and answers with Access-Control-Allow-Methods.OriginOrigin is the request header that tells the server the origin (scheme + host + port) that initiated the request. Unlike Referer it omits path and query, making it more privacy-friendly, and it is central to CORS and CSRF checks.Timing-Allow-OriginTiming-Allow-Origin (TAO) is a response header that grants which origins' scripts may read the detailed timing (DNS, TCP, TTFB, transfer size, and more) that the Resource Timing API exposes for a cross-origin resource. Without it, sensitive cross-origin timing values are masked to zero.AgeAge is a header stating, in seconds, how long a response has been sitting in a cache since it was generated at the origin. It is typically added when a shared cache like a CDN or proxy serves a stored response.Cache-ControlCache-Control carries a list of directives that dictate caching behavior on both requests and responses. On a response it tells browsers, CDNs, and proxies how long and how to store and reuse the response. It is the de facto standard for HTTP caching policy.ExpiresExpires is a caching header that specifies the absolute time at which a response becomes stale. Until that time, a cache may reuse the stored response without re-asking the server.VaryVary tells caches which request-header values this response depends on. Even for the same URL, a cache treats differing values of the listed headers as separate cache entries, preventing the wrong representation from being served to the wrong user.Accept-CHAccept-CH is an opt-in response header by which the server tells the browser which Client Hints headers it wants on future requests. High-entropy hints (device model, platform version, memory, etc.) are sent by the browser only after being explicitly requested here.DPRDPR (Device Pixel Ratio) is a Client Hint request header that reports the ratio of physical pixels to CSS pixels on the client's screen, letting the server know whether it's a high-density (Retina) display.Device-MemoryDevice-Memory is a Client Hint request header conveying the client device's approximate physical memory (RAM) in GiB. A high-entropy hint that helps servers serve lighter resources to low-end devices, it is sent only after an explicit Accept-CH opt-in.DownlinkDownlink is a Network Information Client Hint request header conveying the client's estimated downlink (download) bandwidth in Mbps. Together with ECT and RTT it reports network quality to the server for adaptive serving that adjusts resource weight to the connection.ECTECT (Effective Connection Type) is a Network Information Client Hint request header summarizing the client's effective connection into four tiers: slow-2g, 2g, 3g, and 4g. By bundling raw bandwidth and latency into one practical grade, it makes it easy for servers to devise serving strategies matched to link quality.RTTRTT (Round-Trip Time) is a Network Information Client Hint request header conveying the client's estimated application-layer round-trip latency in milliseconds. Together with Downlink (bandwidth) and ECT (tier) it reports the network's latency characteristics to the server.Save-DataSave-Data is a Client Hint request header telling the server that the user has enabled a 'Data Saver' mode in the browser or OS. It is sent only as on, and the server can respond with adaptive serving — lowering image quality or dropping heavy resources to reduce data usage.Sec-CH-UASec-CH-UA is the flagship User-Agent Client Hints header, conveying the browser's brands and major versions in a structured form. It is a low-entropy hint (sent by default) meant to replace the long, easily spoofed traditional User-Agent string.Sec-CH-UA-MobileSec-CH-UA-Mobile is a low-entropy User-Agent Client Hint conveying, as a boolean, whether the client is a mobile device. The value is always sent — ?1 for true, ?0 for false — so the server can branch mobile vs desktop representations.Sec-CH-UA-PlatformSec-CH-UA-Platform is a low-entropy User-Agent Client Hint conveying the client's operating system (platform) name as a quoted string. With values like Windows, macOS, Linux, Android, or iOS, servers use it to branch OS-specific downloads, guidance, and features.Viewport-WidthViewport-Width is a Client Hint request header that reports the client's layout viewport width to the server as an integer in CSS pixels. It lets the server pick images and layouts suited to the screen width.WidthWidth is a Client Hint request header that reports the physical pixel width at which the requested image resource will actually be rendered. The server can then choose an image of exactly the needed size.ETagAn ETag (Entity Tag) is an opaque string identifying a specific version of a resource representation. When the content changes, the ETag changes, so client and server compare it to decide whether a cache is still valid or to perform optimistic concurrency control.If-MatchIf-Match is a conditional request header that lets the request proceed only if the client's ETag matches the server's current ETag. It is mainly used on writes (PUT, DELETE) as optimistic locking to prevent concurrent-edit conflicts.If-Modified-SinceIf-Modified-Since is a conditional request header where the client sends the last-modified time of its cached copy, asking the server to return the body only if the resource changed after that time. It provides date-based cache revalidation.If-None-MatchIf-None-Match is a conditional request header where the client sends the ETag of its cached representation, asking the server to return the body only if it differs from that ETag. It is the most precise means of cache revalidation.If-Unmodified-SinceIf-Unmodified-Since is a conditional request header that lets the request proceed only if the resource has not changed since the given time. It is used for time-based concurrent-edit protection and is the opposite of If-Modified-Since.Last-ModifiedLast-Modified is a response header telling the client when the server believes the resource last changed. The client stores this timestamp and uses it in conditional requests to reuse its cache if nothing changed since.ConnectionConnection controls how the current transport connection is handled: whether to keep it open for reuse (keep-alive), close it after the response (close), or switch protocols (upgrade). It is central to persistent-connection management in HTTP/1.1.Transfer-EncodingTransfer-Encoding is a hop-by-hop header specifying the encoding applied to safely transfer the message body over the network. Its main value, `chunked`, splits the body into size-prefixed pieces and enables streaming when the total size isn't known in advance.AcceptAccept tells the server which media (MIME) types the client is willing to receive in the response body, kicking off content negotiation. The server picks the most suitable representation according to these preferences.Accept-EncodingAccept-Encoding tells the server which content compression schemes the client can decode. The server picks one, compresses the body, and reports the scheme actually used in the Content-Encoding header.Accept-LanguageAccept-Language tells the server the natural languages (Korean, English, etc.) the user prefers, with priorities. Multilingual sites use it to decide which language of content to serve.Accept-PostAccept-Post is a response header by which the server states which media type(s) a particular resource accepts in a POST request body. It lets clients learn in advance what they may POST.Content-DispositionContent-Disposition tells the browser whether to display the response body inline in the page or handle it as a download (attachment). For downloads it can also suggest a filename for the save dialog.Content-EncodingContent-Encoding states the compression/transformation actually applied to the body. The receiver reads it, restores (decodes) the body to its original form, then interprets it per Content-Type.Content-LanguageContent-Language states the natural language(s) of the response body (representation) the server actually returned. It is the counterpart to the request's Accept-Language: that one expresses desire, this one reports what was served.Content-LengthContent-Length states the size of the message body as a decimal number of bytes. The receiver uses it to know exactly how far to read the body — that is, the message boundary.Content-LocationContent-Location gives a specific URL where the exact representation just returned can be accessed directly. It points to the canonical address of the particular representation chosen by content negotiation.Content-TypeContent-Type indicates the media (MIME) type of the message body. In a request it declares the format being sent; in a response it declares the format being received, so the other side interprets the data correctly.DigestDigest carries a cryptographic checksum of the message's selected representation (usually the body) so integrity can be verified in transit. It can appear on both requests and responses.LinkThe Link header expresses the same link relations as HTML's `<link>` element, but as an HTTP response header. It lets browsers and crawlers learn about related resources (styles, fonts, the next page, the canonical URL) before the body is even parsed.CookieCookie is the request header a browser uses to send back the cookies a server previously planted via Set-Cookie. It is the core mechanism for keeping session, login, and personalization state on top of stateless HTTP.Set-CookieSet-Cookie is a response header that instructs the client to store a cookie. The browser saves it and sends it back on subsequent requests to the same site via the Cookie header, enabling session management, keeping auth state, and personalization.DateDate reports the time at which the message was generated (originated at the server). It appears mostly on responses, but the spec allows it on requests too, so it is defined for both directions.FromFrom tells the server the email address of the entity (usually a human operator) making the request. It is mainly used by automated bots and crawlers to disclose a point of contact.Max-ForwardsMax-Forwards limits the maximum number of proxy/gateway hops a request may traverse before reaching the final server. It is defined only for the TRACE and OPTIONS methods.Retry-AfterRetry-After is a response header telling the client when it may retry. It is used during overload/maintenance (503) or rate-limit overruns (429) to prevent reckless retries and give the server time to recover.ServerServer reports the software the origin server used to produce the response. Think of it as the server-side identity string that mirrors the request's User-Agent.TETE tells the server which transfer codings the client will accept in the response, and whether it will accept trailers. Think of it as the 'transfer (hop-by-hop)' analog of Accept-Encoding.TrailerTrailer announces, ahead of time, the names of trailing headers (trailers) that will follow the body in chunked transfer (Transfer-Encoding: chunked). The recipient uses this list to expect and process trailers at the end of the body.UpgradeUpgrade proposes switching an already-open connection to a different protocol. On requests the client lists protocols it wants; on responses the server states the protocol it switched to.User-AgentUser-Agent tells the server the type and version of the client software (browser, bot, library) that sent the request. Servers use it to tailor content, gather analytics, block clients, or apply compatibility workarounds.Alt-SvcAlt-Svc (Alternative Services) is a response header by which the server that answered advertises that 'the same content is also available over another protocol/endpoint.' It is the standard path to enable HTTP/3 (QUIC).Alt-UsedAlt-Used tells the server that the client actually connected via an alternative service (a different endpoint) advertised by Alt-Svc. It is the request-direction counterpart to Alt-Svc.Keep-AliveKeep-Alive conveys parameters that fine-tune how a persistent connection is maintained — hints about how long (timeout) and for how many requests (max) the connection may be reused.PriorityPriority is the HTTP Priorities (RFC 9218) header expressing the relative priority of a requested resource. The client sends its preference on the request, and the server may override it on the response — so it is bidirectional.Server-TimingServer-Timing carries server-measured performance metrics (per-stage durations, etc.) in the response, exposing them to browser dev tools and client scripts. It lets you see server-side latency alongside front-end performance data in one place.Accept-RangesAccept-Ranges is a response header telling the client whether the server supports range requests (Range) for this resource. A value of bytes means the client can attempt partial fetches for resuming or seeking.Content-RangeContent-Range tells the client, in a partial response (206 Partial Content), where the bytes being sent fit within the full resource. The client uses this to stitch multiple chunks together in the right place.RangeRange requests only a portion of a resource (usually a byte range) rather than the whole thing. It is essential for resuming large downloads, seeking in media streams, and parallel segmented downloads.AllowAllow is a response header listing the HTTP methods a specific resource supports. It lets clients learn which operations (GET, POST, DELETE, etc.) they may perform on that resource.ForwardedForwarded is the standardized header (RFC 7239) by which a reverse proxy passes the original client, protocol, and host to backend servers in a single, well-defined header. It unifies the sprawl of ad hoc `X-Forwarded-*` headers.HostHost carries the domain name (and optional port) of the server the request targets, and it is the only mandatory request header in HTTP/1.1. In virtual hosting, where many domains share one IP address, the server reads this value to decide which site to serve.LocationLocation is a response header that points to a redirect target or the URL of a newly created resource. On 3xx responses the browser auto-navigates to it; on 201 Created it tells you where the just-created resource lives.ViaVia records, in order, the proxies and gateways a request or response passed through between the original sender and the final recipient. Each intermediary appends itself to the list.X-Forwarded-ForX-Forwarded-For (XFF) is the de facto header that conveys the original client IP — hidden by reverse proxies and load balancers — to backend servers. It is the most widely used convention corresponding to the Forwarded standard's `for` parameter.X-Forwarded-HostX-Forwarded-Host (XFH) is the de facto header a proxy uses to pass the client's original Host value to the backend. It corresponds to the Forwarded standard's `host` parameter.X-Forwarded-ProtoX-Forwarded-Proto (XFP) is the de facto header that conveys the original scheme (`http` or `https`) the client used to reach the proxy to the backend. It corresponds to the Forwarded standard's `proto` parameter.X-Real-IPX-Real-IP is a non-standard convention header that carries a single 'real client IP' as determined by the proxy to the backend. Unlike X-Forwarded-For, which lists a chain of IPs, it holds just one value.Clear-Site-DataClear-Site-Data is a security header by which a server instructs the browser to delete data stored for a given origin (cookies, cache, localStorage, Service Workers, and more). It is used at logout, account switch, or incident response to wipe sensitive client-side data in one shot.Content-Security-PolicyContent-Security-Policy (CSP) is a security header that finely controls, via directives, which sources of scripts, styles, images, frames, and more the browser may load or execute on a page. By blocking untrusted resources it strongly mitigates XSS, data exfiltration, and clickjacking.Content-Security-Policy-Report-OnlyContent-Security-Policy-Report-Only tells the browser not to actually enforce a CSP but to report what violations would have occurred had it been enforced. It is a 'dry-run' mode for safely observing side effects before applying a policy in production.Cross-Origin-Embedder-PolicyCross-Origin-Embedder-Policy (COEP) is a security header that forces every cross-origin subresource a document loads (images, scripts, iframes, etc.) to have explicitly opted in to being embedded before it may load. With require-corp, cross-origin resources without permission are blocked.Cross-Origin-Opener-PolicyCross-Origin-Opener-Policy (COOP) is a security header controlling whether this document shares a 'browsing context group' with other contexts it is linked to (popups, its opener) via window.open() or links. Setting same-origin severs the window.opener reference to cross-origin documents, achieving process-level isolation.Cross-Origin-Resource-PolicyCross-Origin-Resource-Policy (CORP) is a security header by which a server declares which origins' documents may fetch (embed) this resource in no-cors mode. The resource owner narrows the embedding scope to same-origin/same-site/cross-origin to defend against Spectre-class side-channel leaks.NELNEL (Network Error Logging) is a header that has the browser observe network-level request success/failure for an origin (DNS failures, TCP resets, TLS errors, protocol errors, etc.) and report them to the server. It captures, from the client's vantage point, even 'never connected' failures that never reach server logs.Permissions-PolicyPermissions-Policy is a security header that allows or blocks, at origin granularity, which origins may use powerful browser features (camera, microphone, geolocation, fullscreen, payment, gyroscope, etc.) in this document and its iframes. It is the successor to the legacy Feature-Policy header.RefererReferer is the request header that names the URL of the previous page — the page whose link or resource led the user to this request. It is used for traffic-source analytics, referral stats, and basic access control.Referrer-PolicyReferrer-Policy is a security/privacy header controlling how much origin information the browser includes in the Referer header when navigating to another page or requesting a resource. You can choose between the full URL, origin only, or nothing.Report-ToReport-To is the older Reporting API configuration header: it defines named 'groups' and endpoints telling the browser where to send various reports (CSP violations, network errors via NEL, deprecations, etc.). It is being superseded by the simpler Reporting-Endpoints.Reporting-EndpointsReporting-Endpoints is the Reporting API v1 configuration header, simply mapping report-group names to receiving URLs as name="url" pairs. It is the modern, recommended way to define destinations for collecting CSP, COOP, COEP, deprecation, and other reports.Sec-Fetch-DestSec-Fetch-Dest is a Fetch Metadata header the browser adds automatically, telling how the requested resource will ultimately be used (document, image, script, style, font, worker, empty fetch, etc.). Servers can detect misuse from a mismatch between the destination and the actual content type.Sec-Fetch-ModeSec-Fetch-Mode is a Fetch Metadata header the browser adds automatically, telling the server the request's mode (document navigation, CORS fetch, no-cors resource load, or WebSocket). Together with Sec-Fetch-Site and Dest it helps the server precisely understand a request's nature.Sec-Fetch-SiteSec-Fetch-Site is a Fetch Metadata request header the browser adds automatically, revealing the relationship between the request's initiator and its target (same-origin, same-site, cross-site, or direct navigation). Servers can use it to identify cross-site requests and defend against CSRF and information leaks.Sec-Fetch-UserSec-Fetch-User is a Fetch Metadata header the browser adds only to top-level document navigation (navigate) requests, indicating whether the navigation was triggered by a genuine user action (click, Enter, form submit — user activation). It is sent as ?1 only when true, and is entirely absent for automatic or script-triggered navigations.Strict-Transport-SecurityStrict-Transport-Security (HSTS) is a security header telling the browser to only ever connect to this site over HTTPS. Once received, for the duration of max-age the browser auto-upgrades any http:// attempt to https:// and won't let the user click through certificate errors.X-Content-Type-OptionsX-Content-Type-Options: nosniff is a security header that turns off the browser's habit of inspecting a response's actual bytes and guessing its Content-Type (MIME sniffing). It makes the browser trust the server-declared Content-Type verbatim.X-DNS-Prefetch-ControlX-DNS-Prefetch-Control turns on or off the browser's 'DNS prefetching' — resolving the domain names of links and resources in the document before the user clicks. The server controls the trade-off between performance (lower perceived latency) and privacy (pre-emptive lookups leaking intent).X-Frame-OptionsX-Frame-Options is a security header that controls whether this page may be embedded inside another page's <iframe>, <frame>, or <object>. Its main purpose is clickjacking defense — stopping an attacker from overlaying your page as a transparent frame to hijack the user's clicks.X-Permitted-Cross-Domain-PoliciesX-Permitted-Cross-Domain-Policies specifies how far to trust cross-domain policy files (crossdomain.xml) that clients like Adobe Flash and Adobe Reader (PDF) consult when accessing this domain's resources. It is usually set to none to categorically block legacy plugins from accessing data.X-XSS-ProtectionX-XSS-Protection controlled the behavior of a reflected-XSS auditor (filter) that some browsers once built in. That filter has since been deprecated because it could itself create security holes, and the recommended setting is to turn it off with X-XSS-Protection: 0.