← devnestio

HTTP Headers Reference

All
Request
Response
Both
Header Direction Category Description Example

What is HTTP Headers Reference?

HTTP Headers Reference documents all standard HTTP request and response headers with their syntax, valid values, and security implications. Look up headers like Content-Type, Authorization, Cache-Control, Accept-Encoding, Set-Cookie, CORS headers, and more. Each entry includes the header's purpose, example values, relevant RFCs, and whether it's a request header, response header, or both.

HTTP headers are metadata sent with every HTTP request and response -- they control caching, authentication, content negotiation, security policies, and connection management. Headers are case-insensitive (RFC 7230) and consist of a header name followed by a colon and value. Custom headers traditionally use X- prefix (deprecated in RFC 6648) -- modern custom headers should use descriptive names without the X- prefix.

Key header categories: Content negotiation (Content-Type, Accept, Content-Encoding, Accept-Encoding). Caching (Cache-Control, ETag, Last-Modified, If-None-Match). Security (Authorization, WWW-Authenticate, CORS headers). Connection (Connection, Keep-Alive, Upgrade). Cookies (Set-Cookie, Cookie). Proxies (X-Forwarded-For, X-Real-IP, Via).

How to Use

  1. Search by header name (e.g., 'Cache-Control', 'Authorization').
  2. Filter by category: caching, authentication, CORS, security, content.
  3. Click any header to see syntax, valid values, and example usage.
  4. See the 'Request' or 'Response' badge to know which direction the header travels.
  5. Use the 'Security notes' panel for headers with security implications.

Examples

Cache-Control

Result: Cache-Control: max-age=3600, public -> cache for 1 hour, shareable by CDNs

Authorization Bearer

Result: Authorization: Bearer eyJhbGc... -> JWT token for API authentication

Content-Type

Result: Content-Type: application/json; charset=UTF-8 -> JSON response body in UTF-8

Frequently Asked Questions

What is the difference between Cache-Control and Expires?

Cache-Control (HTTP/1.1): flexible directive-based header. max-age=3600 means cache for 3600 seconds from request time. no-cache means revalidate with server before using cached version. no-store means never cache. private means only browser can cache (not CDN). Expires (HTTP/1.0): absolute date-time when the cached response expires: Expires: Wed, 26 Jul 2026 12:00:00 GMT. Cache-Control takes precedence when both are present. Use Cache-Control for modern applications -- it is more expressive and widely supported.

How does HTTP authentication work?

The WWW-Authenticate/Authorization header pair implements HTTP authentication. Process: (1) Client requests protected resource. (2) Server responds 401 Unauthorized with WWW-Authenticate: Basic realm='Admin'. (3) Client sends Authorization: Basic base64(username:password). Schemes: Basic (base64 encoded, no encryption -- use only over HTTPS), Digest (MD5 hashed, deprecated), Bearer (token-based -- JWT or OAuth2 access token), API-Key (custom header or query parameter). Modern APIs use Bearer tokens via OAuth2. Basic Auth is simpler but less flexible.

What are the CORS response headers?

CORS (Cross-Origin Resource Sharing) uses these response headers: Access-Control-Allow-Origin: * or specific origin (allows cross-origin access). Access-Control-Allow-Methods: GET, POST, PUT, DELETE (allowed HTTP methods). Access-Control-Allow-Headers: Content-Type, Authorization (allowed request headers). Access-Control-Allow-Credentials: true (allows cookies/auth in cross-origin requests -- cannot be used with Allow-Origin: *). Access-Control-Max-Age: 86400 (how long to cache preflight results in seconds). Access-Control-Expose-Headers: X-Custom-Header (response headers the browser can access from JS).

What is the difference between Cookie and Set-Cookie?

Set-Cookie is a response header -- the server sends it to set a cookie in the browser: Set-Cookie: sessionId=abc123; Path=/; HttpOnly; Secure; SameSite=Strict. Cookie is a request header -- the browser automatically sends matching cookies back with subsequent requests: Cookie: sessionId=abc123. Key Set-Cookie attributes: HttpOnly (JS cannot read the cookie -- prevents XSS cookie theft). Secure (cookie only sent over HTTPS). SameSite=Strict (cookie not sent with cross-site requests -- prevents CSRF). Max-Age or Expires (session cookie vs persistent).

What is the X-Forwarded-For header?

X-Forwarded-For (XFF) is a de facto standard header added by proxies and load balancers to identify the originating client IP address. Format: X-Forwarded-For: client, proxy1, proxy2. The leftmost IP is the original client (but can be spoofed by the client). The rightmost IP is the last trusted proxy. Cloudflare adds CF-Connecting-IP with the client IP. AWS ALB adds X-Forwarded-For. In Node.js behind a proxy: set app.set('trust proxy', 1) in Express to use req.ip (reads from X-Forwarded-For). Never trust XFF for security decisions unless you control the entire proxy chain.

Related Tools