HTTP header reference

213 headers, 65 of them with a security meaning. Type to filter by name or description; the full list is on the page for readers without JavaScript.

213 of 213 shown

• :authorityRequest header

  HTTP/2 pseudo-header specifying the authority portion of the target URI. Replaces the Host header.

  Common values: example.com, api.example.com:8443

• :methodRequest header

  HTTP/2 pseudo-header specifying the HTTP method. Replaces the request line from HTTP/1.x.

  Common values: GET, POST, PUT, PATCH, DELETE, HEAD and 1 more

• :pathRequest header

  HTTP/2 pseudo-header specifying the request target path and query string.

  Common values: /, /api/v1/resource, /api/v1/resource?page=1&limit=10

• :schemeRequest header

  HTTP/2 pseudo-header specifying the URI scheme (http or https).

  Common values: https, http

• :statusResponse header

  HTTP/2 pseudo-header specifying the HTTP status code in the response.

  Common values: 200, 201, 204, 301, 302, 400 and 4 more

• A-IMRequest header

  Acceptable instance-manipulations for the request (RFC 3229). Used for delta encoding.

  Common values: feed

• AcceptRequest header

  Informs the server about the media types that the client is able to understand. Content negotiation selects one of the proposals.

  Common values: application/json, application/xml, text/html, text/plain, */*, application/json, text/plain, */* and 3 more

• Accept-CHResponse header

  Specifies which Client Hints headers the server wishes to receive from the client.

  Common values: Sec-CH-UA, Sec-CH-UA-Mobile, Sec-CH-UA-Platform, Sec-CH-UA, Sec-CH-UA-Mobile, Sec-CH-UA-Platform, Sec-CH-UA-Arch, Sec-CH-Prefers-Color-Scheme

• Accept-CharsetRequest headerDeprecated

  Indicates the character encodings the client can understand. Largely obsolete since UTF-8 is now standard.

  Common values: utf-8, iso-8859-1, utf-8, iso-8859-1;q=0.5, *

• Accept-EncodingRequest header

  Indicates the content-coding the client can understand (usually a compression algorithm).

  Common values: gzip, deflate, br, zstd, identity, gzip, deflate, br and 2 more

• Accept-LanguageRequest header

  Indicates which natural languages the client prefers. Used for content negotiation.

  Common values: en-US, en-US,en;q=0.9, en-GB,en;q=0.9, fr-FR,fr;q=0.9,en-US;q=0.8, de-DE,de;q=0.9, ja-JP,ja;q=0.9 and 3 more

• Accept-PatchResponse header

  Indicates which media types are accepted by the server for HTTP PATCH requests.

  Common values: application/json-patch+json, application/merge-patch+json

• Accept-PostResponse header

  Indicates which media types are accepted by the server for HTTP POST requests.

  Common values: application/json, multipart/form-data, */*

• Accept-RangesResponse header

  Indicates that the server supports range requests for the target resource.

  Common values: bytes, none

• Access-Control-Allow-CredentialsResponse headerSecurity

  Indicates whether the response to the request can be exposed when the credentials flag is true.

  Common values: true

• Access-Control-Allow-HeadersResponse headerSecurity

  Used in response to a preflight request to indicate which HTTP headers can be used during the actual request.

  Common values: Content-Type, Authorization, Content-Type, Authorization, X-Requested-With, Accept, Content-Type, Authorization, X-Request-ID, *

• Access-Control-Allow-MethodsResponse headerSecurity

  Specifies the methods allowed when accessing the resource in response to a preflight request.

  Common values: GET, POST, PUT, DELETE, OPTIONS, GET, POST, OPTIONS, GET, HEAD, OPTIONS, *

• Access-Control-Allow-OriginResponse headerSecurity

  Indicates whether the response can be shared with requesting code from the given origin.

  Common values: *, https://example.com, null

• Access-Control-Expose-HeadersResponse headerSecurity

  Indicates which headers can be exposed as part of the response by listing their names.

  Common values: Content-Length, X-Request-ID, X-Total-Count, X-Page-Count, *

• Access-Control-Max-AgeResponse headerSecurity

  Indicates how long the results of a preflight request can be cached (in seconds).

  Common values: 600, 3600, 86400, 7200

• Access-Control-Request-HeadersRequest headerSecurity

  Used in preflight requests to indicate which headers will be used in the actual request.

  Common values: Content-Type, Authorization, Content-Type, Authorization

• Access-Control-Request-MethodRequest headerSecurity

  Used in preflight requests to indicate which HTTP method will be used in the actual request.

  Common values: GET, POST, PUT, PATCH, DELETE

• AgeResponse header

  The time in seconds the object has been in a proxy cache. A non-zero value indicates a cached response.

  Common values: 0, 60, 3600, 86400

• AllowResponse header

  Lists the set of request methods supported by a resource. Sent in 405 Method Not Allowed responses.

  Common values: GET, HEAD, GET, POST, PUT, DELETE, GET, HEAD, OPTIONS, OPTIONS, GET, POST, PATCH, DELETE

• Alt-SvcResponse header

  Advertises alternate services through which the same resource can be reached. Used for HTTP/2 and HTTP/3 discovery.

  Common values: h2=":443"; ma=2592000, h3=":443"; ma=86400, h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, clear

• AuthorizationRequest headerSecurity

  Contains the credentials to authenticate a user-agent with a server, usually after the server has responded with a 401.

  Common values: Bearer <token>, Basic <base64-credentials>, Digest <params>, HOBA <challenge>, Mutual <params>, Negotiate <token> and 6 more

• BaggageRequest header

  W3C Baggage header for propagating key-value pairs across service boundaries in distributed systems.

  Common values: userId=alice,serverNode=DF28,isProduction=false

• Cache-ControlRequest and response

  Directives for caching mechanisms in both requests and responses. Controls how, and for how long, the response is cached.

  Common values: no-cache, no-store, no-transform, max-age=0, max-age=3600, max-age=86400 and 14 more

• CDN-Cache-ControlResponse header

  Cache directives specifically for CDN caches, taking precedence over Cache-Control for CDN behavior.

  Common values: max-age=3600, no-store, s-maxage=86400

• CF-Connecting-IPRequest header

  Cloudflare header providing the client's real IP address.

  Common values: 203.0.113.195

• CF-IPCountryRequest header

  Cloudflare header providing the ISO 3166-1 alpha-2 country code of the client.

  Common values: US, GB, DE, JP, IN

• CF-RayResponse header

  Cloudflare-specific identifier for the request. Useful for debugging with Cloudflare support.

  Common values: 7a1b2c3d4e5f6g7h-IAD

• Clear-Site-DataResponse headerSecurity

  Clears browsing data (cookies, storage, cache) associated with the requesting website.

  Common values: "cache", "cookies", "storage", "executionContexts", "cache", "cookies", "storage", "*"

• ConnectionRequest and response

  Controls whether the network connection stays open after the current transaction finishes.

  Common values: keep-alive, close, upgrade

• Content-DigestRequest and response

  Provides a digest of the representation content for integrity verification (RFC 9530, replaces Digest).

  Common values: sha-256=:X48E9qOokqqrvdts8nOJRJN3OWDUoyWxBf7kbu9DBPE=:

• Content-DispositionResponse header

  Indicates if the content should be displayed inline or as a downloadable attachment.

  Common values: inline, attachment, attachment; filename="report.pdf", attachment; filename*=UTF-8''report%20%282026%29.pdf, form-data; name="file"; filename="upload.jpg"

• Content-EncodingRequest and response

  Indicates the encoding transformations applied to the representation. Used to compress the body.

  Common values: gzip, deflate, br, zstd, identity

• Content-LanguageRequest and response

  Describes the natural language(s) of the intended audience for the representation.

  Common values: en, en-US, fr, de, ja, zh-CN and 3 more

• Content-LengthRequest and response

  Indicates the size of the message body in bytes sent to the recipient.

  Common values: 0, 128, 1024, 4096, 1048576

• Content-LocationResponse header

  Indicates an alternate location for the returned data. Points to the direct URL of the resource.

  Common values: /api/resource/123, https://cdn.example.com/file.json

• Content-MD5Request and responseDeprecated

  An MD5 digest of the entity-body for the purpose of providing an end-to-end message integrity check.

  Common values: Q2hlY2sgSW50ZWdyaXR5IQ==

• Content-RangeResponse header

  Indicates where in a full body message a partial message belongs.

  Common values: bytes 0-499/1234, bytes 500-999/1234, bytes */1234

• Content-Security-PolicyResponse headerSecurity

  Controls resources the user-agent is allowed to load for a given page. Helps prevent XSS and other injection attacks.

  Common values: default-src 'self', default-src 'self'; script-src 'self' 'unsafe-inline', default-src 'none'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self', default-src 'self'; connect-src 'self' https://api.example.com, frame-ancestors 'none'

• Content-Security-Policy-Report-OnlyResponse headerSecurity

  Like Content-Security-Policy but only reports violations without enforcing. Useful for testing policies.

  Common values: default-src 'self'; report-uri /csp-report, default-src 'self'; report-to csp-endpoint

• Content-TypeRequest and response

  Indicates the media type of the resource or the data in the request/response body.

  Common values: application/json, application/json; charset=utf-8, application/xml, application/x-www-form-urlencoded, application/javascript, application/octet-stream and 39 more

• CookieRequest headerSecurity

  Contains stored HTTP cookies previously sent by the server with the Set-Cookie header.

  Common values: name=value, session_id=abc123; user=john, JSESSIONID=xyz

• Critical-CHResponse header

  Specifies Client Hints that are critical for correct content selection, triggering a retry if not provided.

  Common values: Sec-CH-UA-Platform, Sec-CH-Prefers-Color-Scheme

• Cross-Origin-Embedder-PolicyResponse headerSecurity

  Prevents a document from loading any cross-origin resources that do not explicitly grant the document permission.

  Common values: require-corp, unsafe-none, credentialless

• Cross-Origin-Opener-PolicyResponse headerSecurity

  Allows you to ensure a top-level document does not share a browsing context group with cross-origin documents.

  Common values: same-origin, same-origin-allow-popups, unsafe-none

• Cross-Origin-Resource-PolicyResponse headerSecurity

  Indicates that the browser should block no-cors cross-origin/cross-site requests to the given resource.

  Common values: same-site, same-origin, cross-origin

• DateRequest and response

  The date and time at which the message was originated, in HTTP-date format (RFC 7231).

  Common values: Thu, 01 Jan 2026 00:00:00 GMT

• Delta-BaseResponse header

  The ETag of the base instance in a delta encoding (RFC 3229).

  Common values: "abc"

• DeprecationResponse header

  Indicates that the API endpoint or resource is deprecated, with an optional date.

  Common values: true, Sat, 01 Jan 2026 00:00:00 GMT

• Device-MemoryRequest header

  Approximate amount of device RAM in gigabytes. Used for adaptive content delivery.

  Common values: 0.25, 0.5, 1, 2, 4, 8

• DigestRequest and responseDeprecated

  Provides a digest of the representation data for integrity verification (RFC 3230). Superseded by Content-Digest.

  Common values: sha-256=X48E9qOokqqrvdts8nOJRJN3OWDUoyWxBf7kbu9DBPE=

• DNTRequest headerDeprecated

  Indicates the user's tracking preference. "1" means the user does not want to be tracked.

  Common values: 0, 1, null

• DownlinkRequest header

  Approximate bandwidth of the client's connection in Mbps.

  Common values: 0.5, 1.5, 10, 30

• DPoPRequest headerSecurity

  Demonstrating Proof of Possession -- contains a DPoP proof JWT for OAuth 2.0.

  Common values: eyJ...

• DPoP-NonceResponse headerSecurity

  Server-provided nonce that must be included in the next DPoP proof.

  Common values: eyJ0eXAiOiJkcG9wK2p3dCIsImFsZyI6IkVTMjU2In0

• Early-DataRequest headerSecurity

  Indicates that the request was conveyed in TLS 1.3 early data (0-RTT). The server should be careful about replay.

  Common values: 1

• ECTRequest header

  Effective connection type (slow-2g, 2g, 3g, 4g) based on round-trip time and downlink values.

  Common values: slow-2g, 2g, 3g, 4g

• ETagResponse header

  A unique identifier for a specific version of a resource. Used for cache validation and conditional requests.

  Common values: "33a64df551425fcc55e4d42a148795d9f25f89d4", W/"weak-etag-value"

• ExpectRequest header

  Indicates expectations that need to be fulfilled by the server in order to properly handle the request.

  Common values: 100-continue

• Expect-CTResponse headerSecurityDeprecated

  Allows sites to opt in to reporting and/or enforcement of Certificate Transparency requirements.

  Common values: max-age=86400, enforce, max-age=86400, enforce, report-uri="https://example.com/ct-report"

• ExpiresResponse header

  Gives the date/time after which the response is considered stale. Ignored if Cache-Control max-age is set.

  Common values: 0, -1, Thu, 01 Dec 2026 16:00:00 GMT

• Feature-PolicyResponse headerSecurityDeprecated

  Controls which browser features and APIs can be used. Deprecated in favor of Permissions-Policy.

  Common values: camera 'none'; microphone 'none'; geolocation 'none', camera 'self'; microphone 'self'

• Fetch-PriorityRequest header

  Provides a hint about the relative priority of a particular resource fetch.

  Common values: high, low, auto

• ForwardedRequest header

  Standard header for identifying the originating IP, protocol, and host. Replaces X-Forwarded-* headers.

  Common values: for=192.0.2.60;proto=https;by=203.0.113.43;host=example.com, for="[2001:db8::1]";proto=https, for=192.0.2.43, for=198.51.100.178

• FromRequest header

  Contains an Internet email address for a human user who controls the requesting user-agent.

  Common values: user@example.com

• Grpc-MessageResponse header

  Contains a human-readable error message from the gRPC server.

  Common values: OK, Not Found, Internal Server Error

• Grpc-StatusResponse header

  Contains the gRPC status code of the response (0=OK, 1=CANCELLED, etc.).

  Common values: 0, 1, 2, 3, 4, 5 and 2 more

• Grpc-TimeoutRequest header

  Specifies the timeout for a gRPC call (e.g., 10S for 10 seconds).

  Common values: 1S, 5S, 10S, 30S, 100m, 1H

• HostRequest header

  Specifies the host and port number of the server to which the request is being sent. Required in HTTP/1.1.

  Common values: example.com, api.example.com, localhost:3000, example.com:8080

• Idempotency-KeyRequest header

  A unique key used to ensure idempotent processing of a request. Prevents duplicate operations on retry.

  Common values: 550e8400-e29b-41d4-a716-446655440000, idem_abc123

• If-MatchRequest header

  Makes the request conditional; the server will only return the resource if it matches one of the listed ETags.

  Common values: "etag-value", "etag1", "etag2", *

• If-Modified-SinceRequest header

  Makes the request conditional; the server returns 304 if the resource has not been modified since the given date.

  Common values: Thu, 01 Jan 2026 00:00:00 GMT

• If-None-MatchRequest header

  Makes the request conditional; the server returns 304 Not Modified if the current ETag matches one of the given values.

  Common values: "etag-value", "etag1", "etag2", *

• If-RangeRequest header

  Used with Range header to make the range request conditional. If the entity is unchanged, send the missing parts; otherwise, send the entire resource.

  Common values: "etag-value", Thu, 01 Jan 2026 00:00:00 GMT

• If-Unmodified-SinceRequest header

  Makes the request conditional; the server will perform the action only if the resource has not been modified since the given date.

  Common values: Thu, 01 Jan 2026 00:00:00 GMT

• IMResponse header

  Instance manipulation applied to the response (RFC 3229).

  Common values: feed

• Keep-AliveRequest and response

  Controls how long a persistent connection should stay open. Parameters: timeout (seconds), max (requests).

  Common values: timeout=5, max=100, timeout=30, max=1000

• Last-Event-IDRequest header

  Contains the last event ID string sent by the server in an SSE stream. Used to resume connections.

  Common values: 42, evt-2026-01-01-001

• Last-ModifiedResponse header

  Contains the date and time at which the origin server believes the resource was last modified.

  Common values: Thu, 01 Jan 2026 00:00:00 GMT

• LinkResponse header

  Provides links to related resources. Commonly used for pagination (rel=next, prev, first, last) per RFC 8288.

  Common values: </api/items?page=2>; rel="next", </api/items?page=50>; rel="last", </api/items?page=1>; rel="first", </api/items?page=3>; rel="prev", </api/items?page=5>; rel="next"

• LocationResponse header

  Indicates the URL to redirect a page to. Only meaningful when served with a 3xx (redirection) or 201 (created) status.

  Common values: https://example.com/new-location, /api/resource/123, /login

• Max-ForwardsRequest header

  Limits the number of times a request can be forwarded through proxies or gateways. Used with TRACE and OPTIONS methods.

  Common values: 0, 5, 10

• NELResponse headerSecurity

  Network Error Logging -- configures the browser to report network errors for the origin.

  Common values: {"report_to":"default","max_age":2592000,"include_subdomains":true}

• OriginRequest headerSecurity

  Indicates the origin (scheme, host, and port) that caused the request. Used in CORS and same-origin policy checks.

  Common values: https://example.com, http://localhost:3000, null

• Permissions-PolicyResponse headerSecurity

  Controls which browser features and APIs can be used in the document. Replaces Feature-Policy.

  Common values: camera=(), microphone=(), geolocation=(), camera=(self), microphone=(self), geolocation=(self "https://maps.example.com"), fullscreen=*, autoplay=(self), payment=(self), interest-cohort=()

• PragmaRequest and responseDeprecated

  Implementation-specific header that may have various effects along the request-response chain. Used for backwards compatibility with HTTP/1.0 caches.

  Common values: no-cache

• PreferRequest header

  Allows clients to request certain behaviors from the server (e.g., respond-async, return=minimal).

  Common values: return=minimal, return=representation, respond-async, wait=30, handling=lenient, handling=strict

• Preference-AppliedResponse header

  Indicates which preferences from the Prefer header were honored by the server.

  Common values: return=minimal, return=representation, respond-async

• PriorityRequest header

  Indicates the priority of the HTTP request relative to other requests. Uses Extensible Priorities scheme (RFC 9218).

  Common values: u=0, u=1, u=2, u=3, u=4, u=5 and 3 more

• Proxy-AuthenticateResponse headerSecurity

  Defines the authentication method that should be used to gain access to a resource behind a proxy.

  Common values: Basic realm="proxy", Digest realm="proxy"

• Proxy-AuthorizationRequest headerSecurity

  Contains the credentials to authenticate a user-agent to a proxy server.

  Common values: Basic <credentials>, Bearer <token>

• Public-Key-PinsResponse headerSecurityDeprecated

  HTTP Public Key Pinning header to associate a specific cryptographic public key with a web server. Deprecated due to complexity and risk.

  Common values: pin-sha256="base64=="; max-age=5184000

• PurposeRequest headerDeprecated

  Indicates the purpose of the request. Older alternative to Sec-Purpose.

  Common values: prefetch

• RangeRequest header

  Indicates the part of a document that the server should return. Used for resumable downloads and streaming.

  Common values: bytes=0-499, bytes=500-999, bytes=0-, bytes=-500

• RateLimit-LimitResponse header

  Standard rate limit header (IETF draft) indicating the request quota in the current window.

  Common values: 100, 1000

• RateLimit-PolicyResponse header

  Describes the rate limit policy in effect (e.g., quota per time window).

  Common values: 100;w=60, 1000;w=3600

• RateLimit-RemainingResponse header

  Standard rate limit header indicating remaining requests in the current window.

  Common values: 99, 0

• RateLimit-ResetResponse header

  Standard rate limit header indicating seconds until the quota resets.

  Common values: 60, 3600

• RefererRequest header

  Contains the address of the previous web page from which a link to the currently requested page was followed.

  Common values: https://example.com/page, https://www.google.com/

• Referrer-PolicyResponse headerSecurity

  Controls how much referrer information should be included with requests made from the site.

  Common values: no-referrer, no-referrer-when-downgrade, origin, origin-when-cross-origin, same-origin, strict-origin and 2 more

• RefreshResponse header

  Used in HTML meta refresh equivalent; redirects the client after a specified delay.

  Common values: 5; url=https://example.com, 0; url=/new-page

• Report-ToResponse header

  Defines reporting endpoints for the Reporting API. Used with NEL, CSP, and other reporting features.

  Common values: {"group":"default","max_age":10886400,"endpoints":[{"url":"https://example.com/reports"}]}

• Reporting-EndpointsResponse header

  Defines named reporting endpoints for the Reporting API (newer than Report-To).

  Common values: default="https://example.com/reports", csp-endpoint="https://example.com/csp-reports", nel-endpoint="https://example.com/nel-reports"

• Repr-DigestRequest and response

  Provides a digest of the selected representation for integrity verification (RFC 9530).

  Common values: sha-256=:X48E9qOokqqrvdts8nOJRJN3OWDUoyWxBf7kbu9DBPE=:

• Retry-AfterResponse header

  Indicates how long the user-agent should wait before making a follow-up request after receiving a 503 or 429.

  Common values: 120, 300, 3600, Thu, 01 Jan 2026 00:00:00 GMT

• RTTRequest header

  Approximate round-trip time of the network connection in milliseconds.

  Common values: 50, 100, 150, 300, 600

• Save-DataRequest header

  Indicates the client's preference for reduced data usage.

  Common values: on

• Sec-CH-Prefers-Color-SchemeRequest headerSecurity

  Indicates the user's preference for light or dark color scheme.

  Common values: dark, light

• Sec-CH-Prefers-Reduced-MotionRequest headerSecurity

  Indicates whether the user has requested reduced motion.

  Common values: no-preference, reduce

• Sec-CH-UARequest headerSecurity

  User-Agent Client Hint providing the browser brand and significant version.

  Common values: "Chromium";v="120", "Google Chrome";v="120", "Not=A?Brand";v="99", "Microsoft Edge";v="120", "Chromium";v="120"

• Sec-CH-UA-ArchRequest headerSecurity

  Provides the underlying CPU architecture of the user-agent.

  Common values: "x86", "arm", "arm64"

• Sec-CH-UA-BitnessRequest headerSecurity

  Provides the bitness of the architecture of the user-agent.

  Common values: "32", "64"

• Sec-CH-UA-Full-Version-ListRequest headerSecurity

  Provides the full version for each brand in the brand list.

  Common values: "Chromium";v="120.0.6099.109", "Google Chrome";v="120.0.6099.109"

• Sec-CH-UA-MobileRequest headerSecurity

  Indicates whether the browser is on a mobile device.

  Common values: ?0, ?1

• Sec-CH-UA-ModelRequest headerSecurity

  Provides the device model on which the browser is running.

  Common values: "Pixel 7", "Galaxy S24", ""

• Sec-CH-UA-PlatformRequest headerSecurity

  Indicates the platform/operating system on which the user-agent is running.

  Common values: "Windows", "macOS", "Linux", "Android", "iOS", "Chrome OS"

• Sec-CH-UA-Platform-VersionRequest headerSecurity

  Provides the version of the operating system on which the user-agent is running.

  Common values: "10.0.0", "14.1.0", "22.04"

• Sec-Fetch-DestRequest headerSecurity

  Indicates the request's destination -- the type of content being fetched.

  Common values: audio, audioworklet, document, embed, empty, font and 15 more

• Sec-Fetch-ModeRequest headerSecurity

  Indicates the mode of the request (e.g., cors, navigate, no-cors).

  Common values: cors, navigate, no-cors, same-origin, websocket

• Sec-Fetch-SiteRequest headerSecurity

  Indicates the relationship between a request initiator's origin and the origin of the requested resource.

  Common values: cross-site, same-origin, same-site, none

• Sec-Fetch-UserRequest headerSecurity

  Indicates whether the navigation request was triggered by user activation (e.g., a click).

  Common values: ?1

• Sec-GPCRequest headerSecurity

  Global Privacy Control signal indicating the user does not want their data sold or shared.

  Common values: 1

• Sec-PurposeRequest header

  Indicates the purpose of the request (e.g., prefetch). Helps servers decide how to handle speculative loads.

  Common values: prefetch, prerender

• Sec-WebSocket-AcceptResponse headerSecurity

  The server's response to Sec-WebSocket-Key in the WebSocket opening handshake.

  Common values: s3pPLMBiTxaQ9kYGzzhZRbK+xOo=

• Sec-WebSocket-ExtensionsRequest and response

  Specifies WebSocket extensions the client wishes to use.

  Common values: permessage-deflate, permessage-deflate; client_max_window_bits

• Sec-WebSocket-KeyRequest headerSecurity

  A base64-encoded random value that is used in the WebSocket opening handshake.

  Common values: dGhlIHNhbXBsZSBub25jZQ==

• Sec-WebSocket-ProtocolRequest and response

  Specifies one or more WebSocket sub-protocols the client wishes to use, ordered by preference.

  Common values: graphql-ws, graphql-transport-ws, chat, superchat, mqtt

• Sec-WebSocket-VersionRequest header

  Indicates the WebSocket protocol version the client wishes to use.

  Common values: 13

• ServerResponse header

  Contains information about the software used by the origin server to handle the request.

  Common values: Apache/2.4.57, nginx/1.25.3, Microsoft-IIS/10.0, cloudflare, envoy

• Server-TimingResponse header

  Communicates one or more server-side timing metrics about the request-response cycle. Visible in DevTools.

  Common values: db;dur=53, app;dur=47.2, cache;desc="Cache Read";dur=23.2, db;dur=53, app;dur=47.2, total;dur=123.4

• Service-Worker-AllowedResponse header

  Overrides the path restriction for service worker scope, allowing broader scope registration.

  Common values: /, /app/

• Service-Worker-Navigation-PreloadRequest header

  A custom value set with NavigationPreloadManager.setHeaderValue() to distinguish preload from normal fetch.

  Common values: true, json-body

• Set-CookieResponse headerSecurity

  Sends cookies from the server to the user-agent. The client stores them and sends them back with subsequent requests.

  Common values: session_id=abc123; Path=/; HttpOnly; Secure; SameSite=Strict, token=xyz; Max-Age=3600; Path=/; Secure, prefs=dark; Expires=Thu, 01 Jan 2027 00:00:00 GMT; Path=/

• SourceMapResponse header

  Links the generated code to a source map file, enabling browsers to reconstruct the original source.

  Common values: /path/to/file.js.map, https://cdn.example.com/file.js.map

• Strict-Transport-SecurityResponse headerSecurity

  Tells browsers to only access the site using HTTPS. Prevents protocol downgrade attacks and cookie hijacking.

  Common values: max-age=31536000, max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains; preload, max-age=63072000; includeSubDomains; preload

• SunsetResponse header

  Indicates the date after which the resource is expected to become unresponsive (API deprecation signal).

  Common values: Sat, 01 Jun 2026 00:00:00 GMT, Wed, 31 Dec 2026 23:59:59 GMT

• TERequest header

  Specifies the transfer encodings the user-agent is willing to accept, and whether trailers are supported.

  Common values: trailers, gzip, deflate;q=0.5, trailers, deflate;q=0.5

• Timing-Allow-OriginResponse header

  Specifies origins that are allowed to see values of attributes retrieved via the Resource Timing API.

  Common values: *, https://example.com

• TkResponse headerDeprecated

  Tracking status header indicating the tracking status that applied to the corresponding request.

  Common values: N, T, C, P, D, U and 2 more

• TraceparentRequest header

  W3C Trace Context header identifying a distributed trace and the parent span.

  Common values: 00-4bf92f3577b34da6a3ce929d0e0e4736-00f067aa0ba902b7-01

• TracestateRequest header

  W3C Trace Context header carrying vendor-specific trace identification data.

  Common values: congo=t61rcWkgMzE,rojo=00f067aa0ba902b7

• TrailerRequest and response

  Allows the sender to include additional fields at the end of chunked messages.

  Common values: Expires, Content-MD5

• Transfer-EncodingRequest and response

  Specifies the form of encoding used to safely transfer the payload body to the user.

  Common values: chunked, compress, deflate, gzip, identity

• UpgradeRequest and response

  Asks the server to switch to another protocol. Used for WebSocket upgrades and HTTP/2 negotiation.

  Common values: websocket, h2c, TLS/1.3

• Upgrade-Insecure-RequestsRequest header

  Sends a signal to the server expressing the client's preference for an encrypted and authenticated response.

  Common values: 1

• User-AgentRequest header

  Contains a string identifying the requesting user-agent (browser, crawler, or application name and version).

  Common values: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36, Mozilla/5.0 (Macintosh; Intel Mac OS X 14_0) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15, Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0, PostmanRuntime/7.36.0, curl/8.4.0, python-requests/2.31.0 and 3 more

• VaryResponse header

  Determines how to match future request headers to decide whether a cached response can be used rather than requesting a fresh one.

  Common values: Accept, Accept-Encoding, Origin, Accept, Accept-Encoding, *

• ViaRequest and response

  Informs the server of proxies through which the request was sent. Added by proxies, both forward and reverse.

  Common values: 1.0 proxy1, 1.1 proxy2, 1.1 vegur, HTTP/1.1 GWA

• Want-Content-DigestRequest header

  Indicates which content digest algorithms the sender would like to receive (RFC 9530).

  Common values: sha-256=3, sha-256=5, sha-512=3

• Want-Repr-DigestRequest header

  Indicates which representation digest algorithms the sender would like to receive (RFC 9530).

  Common values: sha-256=3

• WarningRequest and responseDeprecated

  General warning information about possible problems with the entity body.

  Common values: 199 Miscellaneous warning, 299 Miscellaneous persistent warning

• WWW-AuthenticateResponse headerSecurity

  Defines the authentication method that should be used to access a resource. Sent in a 401 Unauthorized response.

  Common values: Basic realm="Access to the API", Bearer realm="API", error="invalid_token", Digest realm="API", qop="auth", nonce="abc123"

• X-Amz-Content-SHA256Request headerSecurity

  AWS Signature V4 header containing the SHA-256 hash of the request payload.

  Common values: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855, UNSIGNED-PAYLOAD

• X-Amz-DateRequest headerSecurity

  AWS Signature Version 4 date header, specifying the date used in signing the request.

  Common values: 20260101T000000Z

• X-Amz-Request-IdResponse header

  AWS request ID for tracking and debugging API calls.

  Common values: EXAMPLE75DTLW8EXAMPLE

• X-Amz-Security-TokenRequest headerSecurity

  AWS temporary security credentials session token.

  Common values: FwoGZXIvYXdzEBAaDH...

• X-Amzn-Trace-IdRequest header

  AWS X-Ray trace identifier for distributed tracing in AWS services.

  Common values: Root=1-5e35f2a1-1b28f8f87e3e4f04d9b8c6aa

• X-API-KeyRequest headerSecurity

  A custom header used to pass an API key for authentication. Common in REST APIs.

  Common values: your-api-key-here

• X-API-VersionRequest header

  Specifies the API version to use. An alternative to URL-based versioning.

  Common values: 1, 2, 2024-01-01, v1, v2

• X-Apollo-TracingRequest header

  Enables Apollo Server tracing extensions in the GraphQL response.

  Common values: 1

• X-Auth-TokenRequest headerSecurity

  A custom authentication token header, often used as an alternative to the Authorization header.

  Common values: your-auth-token-here

• X-B3-ParentSpanIdRequest header

  Zipkin B3 propagation header carrying the parent span identifier.

  Common values: 05e3ac9a4f6e3b90

• X-B3-SampledRequest header

  Zipkin B3 propagation header indicating the sampling decision.

  Common values: 0, 1

• X-B3-SpanIdRequest header

  Zipkin B3 propagation header carrying the 64-bit span identifier.

  Common values: e457b5a2e4d86bd1

• X-B3-TraceIdRequest header

  Zipkin B3 propagation header carrying the 128-bit trace identifier.

  Common values: 80f198ee56343ba864fe8b2a57d3eff7

• X-CacheResponse header

  Indicates whether the response was served from a CDN/proxy cache.

  Common values: HIT, MISS, BYPASS, STALE, UPDATING, REVALIDATED

• X-Cache-HitsResponse header

  The number of times the cached response has been served (Varnish/Fastly convention).

  Common values: 0, 1, 5, 100

• X-Cloud-Trace-ContextRequest header

  Google Cloud Trace context header for distributed tracing across GCP services.

  Common values: 105445aa7843bc8bf206b12000100000/1;o=1

• X-Content-Security-PolicyResponse headerSecurityDeprecated

  Legacy Content Security Policy header used by older versions of Internet Explorer and Firefox.

  Common values: default-src 'self'

• X-Content-Type-OptionsResponse headerSecurity

  Prevents browsers from MIME-sniffing a response away from the declared Content-Type.

  Common values: nosniff

• X-Correlation-IDRequest and response

  A unique identifier used to correlate related requests across microservices in distributed tracing.

  Common values: corr-550e8400-e29b-41d4-a716-446655440000, trace-abc123

• X-CSRF-TokenRequest headerSecurity

  Contains a CSRF token to protect against cross-site request forgery attacks.

  Common values: token-value-here

• X-DNS-Prefetch-ControlResponse headerSecurity

  Controls DNS prefetching, a feature by which browsers proactively perform DNS resolution on links.

  Common values: on, off

• X-Download-OptionsResponse headerSecurity

  Prevents Internet Explorer from executing downloads in the site's context (IE-specific).

  Common values: noopen

• X-Forwarded-ForRequest header

  Identifies the originating IP address of a client connecting through a proxy or load balancer.

  Common values: 203.0.113.195, 203.0.113.195, 70.41.3.18, 150.172.238.178

• X-Forwarded-HostRequest header

  Identifies the original host requested by the client in the Host HTTP request header.

  Common values: example.com, api.example.com

• X-Forwarded-PortRequest header

  Identifies the port the client used to connect to the proxy or load balancer.

  Common values: 443, 80, 8080

• X-Forwarded-PrefixRequest header

  Indicates the original path prefix before the reverse proxy stripped it.

  Common values: /api/v1, /service-name

• X-Forwarded-ProtoRequest header

  Identifies the protocol (HTTP or HTTPS) that a client used to connect to the proxy or load balancer.

  Common values: https, http

• X-Frame-OptionsResponse headerSecurity

  Indicates whether a browser should be allowed to render a page in a <frame>, <iframe>, <embed>, or <object>.

  Common values: DENY, SAMEORIGIN, ALLOW-FROM https://example.com

• X-GitHub-Api-VersionRequest header

  GitHub API version header specifying which API version to use.

  Common values: 2022-11-28

• X-GitHub-DeliveryRequest header

  A GUID to identify the webhook delivery.

  Common values: 72d3162e-cc78-11e3-81ab-4c9367dc0958

• X-GitHub-EventRequest header

  GitHub webhook event name indicating the type of event that triggered the webhook delivery.

  Common values: push, pull_request, issues, release, workflow_run

• X-GraphQL-Operation-NameRequest header

  Conveys the GraphQL operation name for logging and tracing purposes.

  Common values: GetUser, CreatePost, IntrospectionQuery

• X-Grpc-WebRequest header

  Indicates that the request is a gRPC-Web call, used by gRPC-Web proxies.

  Common values: 1

• X-Hub-Signature-256Request headerSecurity

  GitHub webhook HMAC-SHA256 signature for verifying the payload integrity.

  Common values: sha256=aaaaaaaaaa...

• X-Ms-Client-Request-IdRequest header

  Client-generated tracking ID for Azure requests, used for end-to-end tracing.

  Common values: 550e8400-e29b-41d4-a716-446655440000

• X-Ms-Request-IdResponse header

  Azure request tracking ID assigned by the server.

  Common values: 550e8400-e29b-41d4-a716-446655440000

• X-PageResponse header

  The current page number in a paginated response.

  Common values: 1, 2, 10

• X-Page-CountResponse header

  The total number of pages in the paginated collection.

  Common values: 10, 50

• X-Per-PageResponse header

  The number of items per page in a paginated response.

  Common values: 10, 20, 25, 50, 100

• X-Permitted-Cross-Domain-PoliciesResponse headerSecurity

  Controls which cross-domain policies (e.g., Adobe Flash, PDF) are allowed.

  Common values: none, master-only, by-content-type, all

• X-Powered-ByResponse header

  Specifies the technology (e.g., Express, ASP.NET) supporting the web application. Often removed for security.

  Common values: Express, ASP.NET, PHP/8.3, Next.js, Django, Rails

• X-RateLimit-LimitResponse header

  The maximum number of requests the client is permitted to make in the given time window.

  Common values: 60, 100, 1000, 10000

• X-RateLimit-RemainingResponse header

  The number of requests remaining in the current rate limit window.

  Common values: 59, 99, 0

• X-RateLimit-ResetResponse header

  The UTC epoch time at which the current rate limit window resets.

  Common values: 1704067200, 1704153600

• X-Real-IPRequest header

  The real IP address of the client, typically set by reverse proxies like nginx.

  Common values: 203.0.113.195

• X-Request-IDRequest and response

  A unique identifier for the request, used for tracing and debugging across distributed systems.

  Common values: 550e8400-e29b-41d4-a716-446655440000, req_abc123xyz

• X-Request-StartRequest header

  Timestamp (usually Unix epoch in ms or s) indicating when the request first entered the infrastructure.

  Common values: t=1704067200000, 1704067200.000

• X-Requested-WithRequest headerSecurity

  Indicates the type of request (commonly XMLHttpRequest). Used for CSRF protection in some frameworks.

  Common values: XMLHttpRequest, Fetch

• X-Response-TimeResponse header

  Non-standard header indicating the time the server took to process the request (in milliseconds).

  Common values: 123ms, 45.6ms, 1.2s

• X-Robots-TagResponse header

  Controls search engine indexing behavior for a specific resource (alternative to robots meta tag).

  Common values: noindex, nofollow, noindex, nofollow, noarchive, nosnippet, max-snippet:50 and 1 more

• X-Served-ByResponse header

  Identifies the CDN edge server that served the response.

  Common values: cache-iad-kiad7000023-IAD

• X-Total-CountResponse header

  The total number of items in the collection (common in paginated API responses).

  Common values: 100, 1000, 42

• X-Trace-IDRequest and response

  A trace identifier used in distributed tracing systems like Jaeger, Zipkin, or OpenTelemetry.

  Common values: abc123def456, 00-4bf92f3577b34da6a3ce929d0e0e4736-00f067aa0ba902b7-01

• X-UA-CompatibleResponse headerDeprecated

  Used by Internet Explorer to specify the document compatibility mode.

  Common values: IE=edge, IE=11, chrome=1

• X-WebKit-CSPResponse headerSecurityDeprecated

  Legacy Content Security Policy header for WebKit-based browsers.

  Common values: default-src 'self'

• X-XSRF-TokenRequest headerSecurity

  Angular-style CSRF token header (read from XSRF-TOKEN cookie by convention).

  Common values: token-value-here

• X-XSS-ProtectionResponse headerSecurityDeprecated

  Enables cross-site scripting (XSS) filter built into most browsers. Largely superseded by CSP.

  Common values: 0, 1, 1; mode=block, 1; report=https://example.com/xss-report