| Header | Direction | Category | Description | Example |
|---|
HTTP Headers Reference documents all standard HTTP request and response headers with their syntax, valid values, and security implications. Look up headers like Content-Type, Authorization, Cache-Control, Accept-Encoding, Set-Cookie, CORS headers, and more. Each entry includes the header's purpose, example values, relevant RFCs, and whether it's a request header, response header, or both.
HTTP headers are metadata sent with every HTTP request and response -- they control caching, authentication, content negotiation, security policies, and connection management. Headers are case-insensitive (RFC 7230) and consist of a header name followed by a colon and value. Custom headers traditionally use X- prefix (deprecated in RFC 6648) -- modern custom headers should use descriptive names without the X- prefix.
Key header categories: Content negotiation (Content-Type, Accept, Content-Encoding, Accept-Encoding). Caching (Cache-Control, ETag, Last-Modified, If-None-Match). Security (Authorization, WWW-Authenticate, CORS headers). Connection (Connection, Keep-Alive, Upgrade). Cookies (Set-Cookie, Cookie). Proxies (X-Forwarded-For, X-Real-IP, Via).
Cache-Control
Result: Cache-Control: max-age=3600, public -> cache for 1 hour, shareable by CDNs
Authorization Bearer
Result: Authorization: Bearer eyJhbGc... -> JWT token for API authentication
Content-Type
Result: Content-Type: application/json; charset=UTF-8 -> JSON response body in UTF-8
What is the difference between Cache-Control and Expires?
Cache-Control (HTTP/1.1): flexible directive-based header. max-age=3600 means cache for 3600 seconds from request time. no-cache means revalidate with server before using cached version. no-store means never cache. private means only browser can cache (not CDN). Expires (HTTP/1.0): absolute date-time when the cached response expires: Expires: Wed, 26 Jul 2026 12:00:00 GMT. Cache-Control takes precedence when both are present. Use Cache-Control for modern applications -- it is more expressive and widely supported.
How does HTTP authentication work?
The WWW-Authenticate/Authorization header pair implements HTTP authentication. Process: (1) Client requests protected resource. (2) Server responds 401 Unauthorized with WWW-Authenticate: Basic realm='Admin'. (3) Client sends Authorization: Basic base64(username:password). Schemes: Basic (base64 encoded, no encryption -- use only over HTTPS), Digest (MD5 hashed, deprecated), Bearer (token-based -- JWT or OAuth2 access token), API-Key (custom header or query parameter). Modern APIs use Bearer tokens via OAuth2. Basic Auth is simpler but less flexible.
What are the CORS response headers?
CORS (Cross-Origin Resource Sharing) uses these response headers: Access-Control-Allow-Origin: * or specific origin (allows cross-origin access). Access-Control-Allow-Methods: GET, POST, PUT, DELETE (allowed HTTP methods). Access-Control-Allow-Headers: Content-Type, Authorization (allowed request headers). Access-Control-Allow-Credentials: true (allows cookies/auth in cross-origin requests -- cannot be used with Allow-Origin: *). Access-Control-Max-Age: 86400 (how long to cache preflight results in seconds). Access-Control-Expose-Headers: X-Custom-Header (response headers the browser can access from JS).
What is the difference between Cookie and Set-Cookie?
Set-Cookie is a response header -- the server sends it to set a cookie in the browser: Set-Cookie: sessionId=abc123; Path=/; HttpOnly; Secure; SameSite=Strict. Cookie is a request header -- the browser automatically sends matching cookies back with subsequent requests: Cookie: sessionId=abc123. Key Set-Cookie attributes: HttpOnly (JS cannot read the cookie -- prevents XSS cookie theft). Secure (cookie only sent over HTTPS). SameSite=Strict (cookie not sent with cross-site requests -- prevents CSRF). Max-Age or Expires (session cookie vs persistent).
What is the X-Forwarded-For header?
X-Forwarded-For (XFF) is a de facto standard header added by proxies and load balancers to identify the originating client IP address. Format: X-Forwarded-For: client, proxy1, proxy2. The leftmost IP is the original client (but can be spoofed by the client). The rightmost IP is the last trusted proxy. Cloudflare adds CF-Connecting-IP with the client IP. AWS ALB adds X-Forwarded-For. In Node.js behind a proxy: set app.set('trust proxy', 1) in Express to use req.ip (reads from X-Forwarded-For). Never trust XFF for security decisions unless you control the entire proxy chain.