HTTP Headers

Common request and response headers — auth, caching, security, CORS

HTTP Headers Cheatsheet

49 entries · click to copy

📤 Request — General

Target host (required in HTTP/1.1)

Client browser / app identity

Acceptable response MIME types

Preferred response language

Acceptable content encodings

Keep TCP connection alive

Origin for CORS requests

Previous page URL

🔐 Request — Auth & Content

JWT / OAuth bearer token

Basic auth — base64(user:pass)

Request body type (JSON)

File upload body type

HTML form body type

Body size in bytes

Send stored cookies

Custom API key header

Client-generated request trace ID

📥 Response — Status & Content

Response body MIME + encoding

Body size in bytes

Body is gzip compressed

Body sent in chunks (streaming)

Version identifier for caching

When resource was last changed

Redirect target URL

Seconds before retry (rate limit / 503)

💾 Response — Caching

Must revalidate before using cached copy

Never cache (sensitive data)

Cache for 3600 seconds

Shared cache for 1 day

Only browser cache, not CDN

Content never changes (versioned assets)

HTTP/1.0 no-cache (legacy)

Legacy expiry date

Cache key includes this header

🛡️ Response — Security

Force HTTPS for 1 year (HSTS)

Restrict resource origins (CSP)

Prevent MIME type sniffing

Block page from iframes (clickjacking)

Control referrer info sent

Disable browser features

Secure cookie attributes

Isolate browsing context (for SharedArrayBuffer)

🌐 CORS Headers

Allow all origins

Allow specific origin

Allowed HTTP methods

Allowed request headers

Preflight cache duration (seconds)

Allow cookies/auth in cross-origin requests

Expose custom headers to JS

Loading tool…