HTTP Headers Cheatsheet

A quick reference for common HTTP request and response headers — authentication, caching, content negotiation, CORS, and security headers.

Updated Apr 11, 2026

Sections

Common Request Headers
Common Response Headers
Cache-Control Directives
CORS Headers
Security Headers

Common Request Headers

Header	Example Value	Description
`Accept`	application/json, text/html	Media types the client can handle
`Accept-Language`	en-US,en;q=0.9	Preferred response language
`Accept-Encoding`	gzip, deflate, br	Supported content encodings
`Authorization`	Bearer <token>	Authentication credentials
`Content-Type`	application/json	Media type of the request body
`Content-Length`	348	Size of the request body in bytes
`Cookie`	session=abc123	Stored cookies sent to the server
`Host`	api.example.com	Target host (required in HTTP/1.1)
`Origin`	https://example.com	Origin of a cross-site request
`Referer`	https://example.com/page	URL of the referring page
`User-Agent`	Mozilla/5.0 …	Client software identifier
`X-Requested-With`	XMLHttpRequest	Identifies AJAX requests (non-standard)
`If-None-Match`	"abc123"	Conditional request — return 304 if ETag matches
`If-Modified-Since`	Mon, 01 Jan 2024 00:00:00 GMT	Conditional request — return 304 if not modified

Common Response Headers

Header	Example Value	Description
`Content-Type`	application/json; charset=utf-8	Media type of the response body
`Content-Length`	1234	Size of the response body in bytes
`Content-Encoding`	gzip	Encoding applied to the response body
`Set-Cookie`	session=abc; HttpOnly; Secure	Set a cookie on the client
`Location`	https://example.com/new-path	Redirect destination (used with 3xx status)
`ETag`	"33a64df5"	Identifier for a specific resource version
`Last-Modified`	Mon, 01 Jan 2024 00:00:00 GMT	Date the resource was last changed
`Vary`	Accept-Encoding, Accept-Language	Tells caches which request headers affect the response
`WWW-Authenticate`	Bearer realm="api"	Authentication challenge for 401 responses
`Retry-After`	120	Seconds to wait before retrying (429 / 503)

Cache-Control Directives

Directive	Used In	Description
`no-store`	Request / Response	Do not cache at all — for sensitive data
`no-cache`	Request / Response	Revalidate with server before using cached copy
`max-age=<seconds>`	Response	Cache for up to N seconds
`s-maxage=<seconds>`	Response	Shared cache (CDN) TTL — overrides max-age for proxies
`public`	Response	May be cached by any cache (browser, CDN)
`private`	Response	Only the user's browser may cache it
`must-revalidate`	Response	Once stale, must revalidate before use
`immutable`	Response	Content will never change — skip revalidation during max-age
`stale-while-revalidate=<s>`	Response	Serve stale while fetching fresh copy in background

CORS Headers

Header	Direction	Description
`Origin`	Request	Sent automatically by browser on cross-origin requests
`Access-Control-Allow-Origin`	Response	Which origins may read the response (* or specific origin)
`Access-Control-Allow-Methods`	Response	Allowed HTTP methods for the actual request
`Access-Control-Allow-Headers`	Response	Allowed request headers in the actual request
`Access-Control-Allow-Credentials`	Response	true to allow cookies / auth headers in cross-origin requests
`Access-Control-Max-Age`	Response	How long (seconds) to cache preflight response
`Access-Control-Expose-Headers`	Response	Response headers the browser JS may access

Security Headers

Header	Example Value	Description
`Strict-Transport-Security`	max-age=31536000; includeSubDomains	HSTS — force HTTPS for all requests
`Content-Security-Policy`	default-src 'self'; script-src 'self'	CSP — restrict resource origins to prevent XSS
`X-Content-Type-Options`	nosniff	Prevent MIME-type sniffing
`X-Frame-Options`	DENY or SAMEORIGIN	Prevent clickjacking via iframes
`Referrer-Policy`	strict-origin-when-cross-origin	Control how much referrer info is sent
`Permissions-Policy`	camera=(), microphone=()	Restrict browser feature access
`Cross-Origin-Opener-Policy`	same-origin	Isolate the browsing context from cross-origin windows
`Cross-Origin-Resource-Policy`	same-origin	Prevent other origins from loading this resource

How to Read HTTP Headers

A practical guide to HTTP headers — request vs response headers, what the most important ones mean, how to inspect them in the browser and curl, and security headers you should be setting.

Read guide →