Searchable reference for common HTTP request and response headers and what they do.
Specifies the media types the client can understand.
Content encodings the client can decompress (e.g. gzip, br).
Natural languages the client prefers for the response.
Indicates whether the server supports byte-range requests.
Tells browsers which origins may access the resource (CORS).
Seconds the object has been cached by an intermediate proxy.
Lists the HTTP methods a resource supports.
Carries credentials for HTTP authentication.
Directives that control caching behavior in requests and responses.
Controls whether the network connection stays open after the transaction.
Encodings applied to the body, e.g. gzip, deflate.
Natural language of the intended audience of the resource.
Size of the message body in bytes (octets).
Media type of the resource (e.g. application/json).
Cookies previously set by the server, sent back by the client.
Date and time the message was generated.
Entity tag used for cache revalidation (If-None-Match).
Date/time after which the response is considered stale.
Domain name and port of the requested resource — required in HTTP/1.1.
Date/time the resource was last modified.
URL to redirect the client to (used with 3xx status).
Origin of the request, used in CORS and POST requests.
Requests a specific byte range of the resource.
Address of the page that linked to the current resource.
How long the client should wait before retrying (rate limits, 503).
Information about the software used by the origin server.
Sends a cookie from the server to the client.
Transfer encoding applied to the message, e.g. chunked.
Protocols the client asks the server to switch to (e.g. WebSocket).
Identifying information about the client software.
Proxies and gateways the message has passed through.
Challenges the client to authenticate (used with 401).
Informational reference — actual behavior can vary by browser and server implementation.