HTTP Headers Reference

Look up any HTTP request or response header to see its purpose, direction, example values, and whether it is standard or deprecated.

HTTP headers

SearchBy header name, keyword, or example

Direction

34 of 34 headers

AcceptRequestStandard

Media types the client can understand, used for content negotiation.

Accept: text/html, application/json;q=0.9

Accept-EncodingRequestStandard

Content encodings (compression) the client accepts.

Accept-Encoding: gzip, deflate, br

Accept-LanguageRequestStandard

Natural languages the client prefers.

Accept-Language: en-US, en;q=0.5

AuthorizationRequestStandard

Credentials to authenticate the user agent with the server.

Authorization: Bearer eyJhbGciOi...

Cache-ControlRequest & ResponseStandard

Directives for caching in both requests and responses.

Cache-Control: no-cache, max-age=0

Content-TypeRequest & ResponseStandard

The media type of the resource or request body.

Content-Type: application/json; charset=utf-8

Content-LengthRequest & ResponseStandard

Size of the message body, in bytes.

Content-Length: 348

Content-EncodingResponseStandard

Compression applied to the response body.

Content-Encoding: gzip

CookieRequestStandard

Stored cookies previously sent by the server via Set-Cookie.

Cookie: session=abc123; theme=dark

Set-CookieResponseStandard

Sends a cookie from the server to the user agent.

Set-Cookie: session=abc123; HttpOnly; Secure; SameSite=Lax

ETagResponseStandard

An identifier for a specific version of a resource, used for caching.

ETag: "33a64df551425fcc55e"

If-None-MatchRequestStandard

Makes the request conditional; server responds 304 if ETag matches.

If-None-Match: "33a64df551425fcc55e"

If-Modified-SinceRequestStandard

Conditional request based on the resource modification time.

If-Modified-Since: Wed, 21 Oct 2025 07:28:00 GMT

Last-ModifiedResponseStandard

The date and time the resource was last changed.

Last-Modified: Wed, 21 Oct 2025 07:28:00 GMT

HostRequestStandard

Domain name and optional port of the target server. Required in HTTP/1.1.

Host: example.com

User-AgentRequestStandard

Identifies the client software making the request.

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)

RefererRequestStandard

The address of the page that linked to the requested resource.

Referer: https://example.com/page

OriginRequestStandard

Indicates the origin that caused the request, used in CORS.

Origin: https://example.com

LocationResponseStandard

URL to redirect to, used with 3xx and 201 responses.

Location: https://example.com/new-path

Access-Control-Allow-OriginResponseStandard

Specifies which origins may access the resource (CORS).

Access-Control-Allow-Origin: *

Access-Control-Allow-MethodsResponseStandard

Methods allowed when accessing the resource in a CORS preflight.

Access-Control-Allow-Methods: GET, POST, PUT

Content-Security-PolicyResponseStandard

Controls resources the user agent is allowed to load, mitigating XSS.

Content-Security-Policy: default-src 'self'

Strict-Transport-SecurityResponseStandard

Forces browsers to use HTTPS for future requests (HSTS).

Strict-Transport-Security: max-age=63072000; includeSubDomains

X-Content-Type-OptionsResponseStandard

Prevents MIME-type sniffing when set to nosniff.

X-Content-Type-Options: nosniff

X-Frame-OptionsResponseStandard

Controls whether the page can be embedded in a frame (clickjacking defense).

X-Frame-Options: DENY

WWW-AuthenticateResponseStandard

Defines the authentication method to access a resource (with 401).

WWW-Authenticate: Basic realm="Access"

ConnectionRequest & ResponseStandard

Controls whether the network connection stays open after the transaction.

Connection: keep-alive

Transfer-EncodingResponseStandard

Form of encoding used to transfer the body, e.g. chunked.

Transfer-Encoding: chunked

RangeRequestStandard

Requests only part of a resource (byte ranges).

Range: bytes=0-1023

Retry-AfterResponseStandard

How long to wait before making a follow-up request (with 429/503).

Retry-After: 120

VaryResponseStandard

Lists request headers that affect cache key selection.

Vary: Accept-Encoding, User-Agent

DNTRequestDeprecated

Legacy "Do Not Track" preference. Deprecated and largely ignored.

DNT: 1

PragmaRequestDeprecated

HTTP/1.0 caching directive, superseded by Cache-Control.

Pragma: no-cache

X-XSS-ProtectionResponseDeprecated

Legacy XSS filter control. Deprecated; use Content-Security-Policy instead.

X-XSS-Protection: 0

.env to JSON

Parse a .env / dotenv file into a JSON object and convert JSON back into .env format, handling quotes, comments, and export prefixes.

Web & Dev

Accept-Language / Accept Parser

Parse and sort Accept-Language or Accept headers by quality value (q-factor).

Web & Dev

Asset Cache-Busting URL Builder

Appends a deterministic version/hash query param to a list of asset URLs.

Web & Dev

AsyncAPI Validator Preview

Validate common AsyncAPI structure and summarize channels, operations, messages, and servers.

Web & Dev

HTTP Headers Reference

Command Palette