HTTP Header Fields

Requests

Accept

Content types that are acceptable for the response

Accept: text/plain

Status: Permanent

Accept-Charset

Character sets that are acceptable

Accept-Charset: utf-8

Status: Permanent

Accept-Encoding

List of acceptable encodings

Accept-Encoding: gzip, deflate

Status: Permanent

Accept-Language

List of acceptable human languages for response

Accept-Language: en-US

Status: Permanent

Authorization

Authentication credentials for HTTP authentication

Authorization: Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==

Status: Permanent

Cache-Control

Used to specify directives that MUST be obeyed by all caching mechanisms along the request/response chain

Cache-Control: no-cache

Status: Permanent

Connection

What type of connection the user-agent would prefer

Connection: keep-alive

Status: Permanent

Content-Length

The length of the request body in octets (8-bit bytes)

Content-Length: 348

Status: Permanent

Content-MD5

A Base64-encoded binary MD5 sum of the content of the request body

Content-MD5: Q2hlY2sgSW50ZWdyaXR5IQ==

Status: Permanent

Content-Type

The MIME type of the body of the request (used with POST and PUT requests)

Content-Type: application/json

Status: Permanent

Date

The date and time that the message was sent (in HTTP-date format as defined by RFC 2616)

Date: Tue, 15 Nov 1994 08:12:31 GMT

Status: Permanent

Expect

Indicates that particular server behaviors are required by the client

Expect: 100-continue

Status: Permanent

From

The email address of the user making the request

From: user@example.com

Status: Permanent

Host

The domain name of the server (for virtual hosting), and the TCP port number on which the server is listening. The port number may be omitted if the port is the standard port for the service requested. Mandatory since HTTP/1.1. Although domain name are specified as case-insensitive, it is not specified whether the contents of the Host field should be interpreted in a case-insensitive manner and in practice some implementations of virtual hosting interpret the contents of the Host field in a case-sensitive manner

Host: en.wikipedia.org

Status: Permanent

If-Match

Only perform the action if the client supplied entity matches the same entity on the server. This is mainly for methods like PUT to only update a resource if it has not been modified since the user last updated it

If-Match: "737060cd8c284d8af7ad3082f209582d"

Status: Permanent

If-Modified-Since

Allows a 304 Not Modified to be returned if content is unchanged

If-Modified-Since: Sat, 29 Oct 1994 19:43:31 GMT

Status: Permanent

If-None-Match

Allows a 304 Not Modified to be returned if content is unchanged

If-None-Match: "737060cd8c284d8af7ad3082f209582d"

Status: Permanent

If-Range

If the entity is unchanged, send me the part(s) that I am missing; otherwise, send me the entire new entity

If-Range: "737060cd8c284d8af7ad3082f209582d"

Status: Permanent

If-Unmodified-Since

Only send the response if the entity has not been modified since a specific time

If-Unmodified-Since: Sat, 29 Oct 1994 19:43:31 GMT

Status: Permanent

Max-Forwards

Limit the number of times the message can be forwarded through proxies or gateways

Max-Forwards: 10

Status: Permanent

Pragma

Implementation-specific headers that may have various effects anywhere along the request-response chain

Pragma: no-cache

Status: Permanent

Proxy-Authorization

Authorization credentials for connecting to a proxy

Proxy-Authorization: Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==

Status: Permanent

Range

Request only part of an entity. Bytes are numbered from 0

Range: bytes=500-999

Status: Permanent

Referer

This is the address of the previous web page from which a link to the currently requested page was followed. The word “referrer” is misspelled in the RFC as well as in most implementations

Referer: http://en.wikipedia.org/wiki/Main_Page

Status: Permanent

TE

The transfer encodings the user agent is willing to accept: the same values as for the response header Transfer-Encoding can be used, plus the trailers value (related to the chunked transfer method) to notify the server it expects to receive additional headers (the trailers) after the last, zero-sized, chunk

TE: trailers, deflate

Status: Permanent

User-Agent

The user agent string of the user agent

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.116 Safari/537.36

Status: Permanent

Via

Informs the server of proxies through which the request was sent

Via: 1.0 fred, 1.1 example.com (Apache/1.1)

Status: Permanent

Warning

A general warning about possible problems with the entity body

Warning: 199 Miscellaneous warning

Status: Permanent

Cookie

An HTTP cookie previously sent by the server with Set-Cookie

Cookie: $Version=1; Skin=new;

Status: Permanent - Standard

Origin

Initiates a request for cross-origin resource sharing (asks server for an Access-Control-Allow-Origin response header)

Origin: http://www.example-social-network.com

Status: Permanent - Standard

Accept-Datetime

Acceptable version in time

Accept-Datetime: Thu, 31 May 2007 20:35:00 GMT

Status: Provisional

Common Non-Standard Request Headers

X-Requested-With

Mainly used to identify Ajax requests. Some JavaScript frameworks send this field with value of XMLHttpRequest, such as jQuery.

  • XMLHttpRequest - Ajax request
X-Requested-With: XMLHttpRequest

Responses

Accept

Content-Types that are acceptable for the response

Accept: text/plain

Status: Permanent

Access-Control-Allow-Origin

Specifying which web sites can participate in cross-origin resource sharing

Access-Control-Allow-Origin: *

Status: Provisional

Refresh

Used in redirection, or when a new resource has been created. This refresh redirects after 5 seconds:

Refresh: 5; url=http://www.w3.org/pub/WWW/People.html

Status: Proprietary/non-standard: a header extension introduced by Netscape and supported by most web browsers

Expires

Gives the date/time after which the response is considered stale

Expires: Thu, 01 Dec 1994 16:00:00 GMT

Status: Permanent - Standard

Set-Cookie

An HTTP cookie

Set-Cookie: UserID=JohnDoe; Max-Age=3600; Version=

Status: Permanent - Standard

Strict-Transport-Security

A HSTS Policy informing the HTTP client how long to cache the HTTPS only policy and whether this applies to subdomains

Strict-Transport-Security: max-age=16070400; includeSubDomains

Status: Permanent - Standard

Accept-Patch

Specifies which patch document formats this server supports

Accept-Patch: text/example;charset=utf-8

Status: Permanent

Accept-Ranges

What partial content range types this server supports

Accept-Ranges: bytes

Status: Permanent

Age

The age the object has been in a proxy cache in seconds

Age: 12

Status: Permanent

Allow

Valid actions for a specified resource. To be used for a 405 Method not allowed

Allow: GET, HEAD

Status: Permanent

Cache-Control

Tells all caching mechanisms from server to client whether they may cache this object. It is measured in seconds

Cache-Control: max-age=3600

Status: Permanent

Connection

Options that are desired for the connection

Connection: close

Status: Permanent

Content-Encoding

The type of encoding used on the data

Content-Encoding: gzip

Status: Permanent

Content-Language

The language the content is in

Content-Language: da

Status: Permanent

Content-Length

The length of the response body in octets (8-bit bytes)

Content-Length: 348

Status: Permanent

Content-Location

An alternate location for the returned data

Content-Location: /index.htm

Status: Permanent

Content-MD5

A Base64-encoded binary MD5 sum of the content of the response

Content-MD5: Q2hlY2sgSW50ZWdyaXR5IQ==

Status: Permanent

Content-Disposition

An opportunity to raise a "File Download" dialogue box for a known MIME type with binary format or suggest a filename for dynamic content. Quotes are necessary with special characters

Content-Disposition: attachment; filename="fname.ext"

Status: Permanent

Content-Range

Where in a full body message this partial message belongs

Content-Range: bytes 21010-47021/47022

Status: Permanent

Content-Type

The MIME type of this content

Content-Type: text/html; charset=utf-8

Status: Permanent

Date

The date and time that the message was sent (in HTTP-date format as defined by RFC 2616)

Date: Tue, 15 Nov 1994 08:12:31 GMT

Status: Permanent

ETag

An identifier for a specific version of a resource, often a message digest

ETag: "737060cd8c284d8af7ad3082f209582d"

Status: Permanent

Last-Modified

The last modified date for the requested object (in HTTP-date format as defined by RFC 2616)

Last-Modified: Tue, 15 Nov 1994 12:45:26 GMT

Status: Permanent

Link

Used to express a typed relationship with another resource, where the relation type is defined by RFC 5988

Link: </feed>; rel="alternate"

Status: Permanent

Location

Used in redirection, or when a new resource has been created

Location: http://www.w3.org/pub/WWW/People.html

Status: Permanent

P3P

This header is supposed to set P3P policy, in the form of P3P:CP="your_compact_policy". However, P3P did not take off, most browsers have never fully implemented it, a lot of websites set this header with fake policy text, that was enough to fool browsers the existence of P3P policy and grant permissions for third party cookies

P3P: CP="This is not a P3P policy! See http://www.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info."

Status: Permanent

Pragma

Implementation-specific headers that may have various effects anywhere along the request-response chain

Pragma: no-cache

Status: Permanent

Proxy-Authenticate

Request authentication to access the proxy

Proxy-Authenticate: Basic

Status: Permanent

Retry-After

If an entity is temporarily unavailable, this instructs the client to try again later. Value could be a specified period of time (in seconds) or a HTTP-date

Retry-After: 120; Retry-After: Fri, 07 Nov 2014 23:59:59 GMT

Status: Permanent

Server

A name for the server

Server: Apache/2.4.1 (Unix)

Status: Permanent

Trailer

The Trailer general field value indicates that the given set of header fields is present in the trailer of a message encoded with chunked transfer-coding

Trailer: Max-Forwards

Status: Permanent

Transfer-Encoding

The form of encoding used to safely transfer the entity to the user. Currently defined methods are: chunked, compress, deflate, gzip, identity

Transfer-Encoding: chunked

Status: Permanent

Upgrade

Ask the server to upgrade to another protocol

Upgrade: HTTP/2.0, SHTTP/1.3, IRC/6.9, RTA/x11

Status: Permanent

Vary

Tells downstream proxies how to match future request headers to decide whether the cached response can be used rather than requesting a fresh one from the origin server

Vary: *

Status: Permanent

Warning

A general warning about possible problems with the entity body

Warning: 199 Miscellaneous warning

Status: Permanent

WWW-Authenticate

Indicates the authentication scheme that should be used to access the requested entity

WWW-Authenticate: Basic

Status: Permanent

Status

The HTTP status of the response

Status: 200 OK

Common Non-Standard Response Headers

X-Frame-Options

Clickjacking protection:

  • deny - no rendering within a frame
  • sameorigin - no rendering if origin mismatch
X-Frame-Options: deny

X-XSS-Protection

Cross-site scripting (XSS) filter

X-XSS-Protection: 1; mode=block

Content-Security-Policy,
X-Content-Security-Policy,
X-WebKit-CSP

Content Security Policy definition

X-WebKit-CSP: default-src "self"

X-Content-Type-Options

The only defined value, nosniff, prevents Internet Explorer from MIME-sniffing a response away from the declared content-type. This also applies to Google Chrome, when downloading extensions

X-Content-Type-Options: nosniff

X-Powered-By

Specifies the technology (e.g. ASP.NET, PHP, JBoss) supporting the web application (version details are often in X-Runtime, X-Version, or X-AspNet-Version)

X-Powered-By: PHP/5.4.0

X-UA-Compatible

Recommends the preferred rendering engine (often a backward-compatibility mode) to use to display the content. Also used to activate Chrome Frame in Internet Explorer

X-UA-Compatible: IE=EmulateIE7; X-UA-Compatible: IE=edge; X-UA-Compatible: Chrome=1