Delimiter.live
29 entries

HTTP Headers

HTTP headers carry the metadata around a request or response: what content is being sent, how it may be cached, who may read it from another origin, and what security rules the browser should apply. This reference groups the headers you actually meet by the job they do, rather than listing every registered field name.

There are well over a hundred registered HTTP header fields, and most developers need perhaps thirty of them. The ones below are grouped by what they are for, because that is how you actually reach for them — you know you want to control caching, not that you want a header beginning with C.

Header names are case-insensitive. HTTP/2 and HTTP/3 send them lowercased on the wire, which is why tooling increasingly shows them that way.

Caching

6 entries

The headers that decide whether a request happens at all.

Header Direction Example Notes
Cache-Control Both public, max-age=31536000, immutable The one that matters. max-age is in seconds. immutable tells the browser not to revalidate even on reload — safe only for fingerprinted assets.
ETag Response "a1b2c3" An opaque version identifier. The client sends it back in If-None-Match, and the server answers 304 if it still matches.
Last-Modified Response Wed, 05 Aug 2026 10:00:00 GMT Weaker than ETag because it has one-second resolution. Paired with If-Modified-Since.
If-None-Match Request "a1b2c3" Conditional request. A matching ETag gets a 304 with no body, which is the cheapest possible response.
Vary Response Accept-Encoding Tells caches which request headers change the response. Omitting it is how the wrong cached variant gets served.
Age Response 3600 Seconds the response has been sitting in a cache. Useful for diagnosing a stale CDN.

Content

6 entries

What is being sent, in what format and encoding.

Header Direction Example Notes
Content-Type Both text/html; charset=utf-8 Always include the charset for text types. Getting this wrong is the single most common cause of mojibake.
Content-Length Both 4096 Size in bytes. Omitted when the response is chunked.
Content-Encoding Response br The compression applied — br, gzip or zstd. Not to be confused with Transfer-Encoding.
Accept Request application/json What the client would like back. Servers are free to ignore it.
Accept-Encoding Request gzip, br Which compressions the client understands.
Content-Disposition Response attachment; filename="report.csv" Forces a download rather than inline display, and names the file.

Security

6 entries

Headers that change what the browser will allow.

Header Direction Example Notes
Content-Security-Policy Response default-src 'self' The strongest defence against injected scripts. Use a nonce or hash rather than unsafe-inline.
Strict-Transport-Security Response max-age=31536000; includeSubDomains Forces HTTPS for the whole domain. Only sent over HTTPS, and hard to undo, so set max-age low while testing.
X-Content-Type-Options Response nosniff Stops the browser guessing a content type different from the one you declared.
Referrer-Policy Response strict-origin-when-cross-origin Controls how much of the referring URL is sent to other sites.
Permissions-Policy Response camera=(), microphone=() Disables browser features for the page and its frames.
X-Frame-Options Response DENY Anti-clickjacking. Superseded by CSP frame-ancestors, but still honoured.

CORS

5 entries

Cross-origin access. Set by the server being called, not the caller.

Header Direction Example Notes
Access-Control-Allow-Origin Response https://app.example.com A single origin or *. Cannot be * when credentials are included.
Access-Control-Allow-Methods Response GET, POST, PUT Answered to a preflight OPTIONS request, not to the real one.
Access-Control-Allow-Headers Response Content-Type, Authorization Any non-simple request header must be listed here or the preflight fails.
Access-Control-Allow-Credentials Response true Required for cookies to be sent cross-origin. Forces an explicit origin.
Origin Request https://app.example.com Sent by the browser automatically. Cannot be set by JavaScript.

Everything else

6 entries

Identity, redirection and connection handling.

Header Direction Example Notes
Authorization Request Bearer eyJhbGciOi… Basic is Base64, not encryption, so it requires HTTPS. Bearer carries a token.
Location Response https://example.com/new The redirect target. Only meaningful with a 3xx status, or 201.
User-Agent Request Mozilla/5.0 … Historically unreliable and full of compatibility fiction. Prefer feature detection.
Set-Cookie Response id=abc; HttpOnly; Secure; SameSite=Lax Always set HttpOnly and Secure for session cookies. SameSite=Lax is a sensible default.
Retry-After Response 120 Seconds to wait, or an HTTP date. Sent with 429 and 503.
X-Robots-Tag Response noindex Applies robots directives to non-HTML responses, where a meta tag is impossible.

Frequently asked questions

Are header names case-sensitive?
No. HTTP treats them as case-insensitive, so Content-Type and content-type are the same header. HTTP/2 and HTTP/3 transmit them lowercased, which is why modern tooling tends to display them that way.
What is the difference between Cache-Control and Expires?
Cache-Control is the modern header and takes precedence where both are present. Expires gives an absolute date and is only worth sending for very old clients. Use max-age in Cache-Control instead.
Why is my CORS request still failing?
Most often the preflight. A request with a custom header or a non-simple method triggers an OPTIONS request first, and every custom header must be named in Access-Control-Allow-Headers. The error in the console names the header that was rejected.
Which security headers should I set as a minimum?
Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options and Referrer-Policy. CSP is the one that takes real effort to get right; the other three are close to set-and-forget.

Related tools

All tools →
All references →

Last reviewed .