[ { "name": "Accept", "direction": "request", "description": "Media types the client can understand, used in content negotiation.", "example": "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8", "standard": "RFC 9110", "deprecated": false }, { "name": "Accept-CH", "direction": "response", "description": "Lists the client hint headers a server is willing to receive in subsequent requests.", "example": "Accept-CH: Sec-CH-UA, Sec-CH-UA-Mobile", "standard": "RFC 8942", "deprecated": false }, { "name": "Accept-Charset", "direction": "request", "description": "Character sets the client accepts. Deprecated; servers should ignore it and use UTF-8.", "example": "Accept-Charset: utf-8", "standard": "RFC 9110", "deprecated": true }, { "name": "Accept-Encoding", "direction": "request", "description": "Content encodings (compression algorithms) the client supports.", "example": "Accept-Encoding: gzip, deflate, br", "standard": "RFC 9110", "deprecated": false }, { "name": "Accept-Language", "direction": "request", "description": "Natural languages the client prefers, used in content negotiation.", "example": "Accept-Language: en-US,en;q=0.9", "standard": "RFC 9110", "deprecated": false }, { "name": "Accept-Patch", "direction": "response", "description": "Media types accepted by the server in a PATCH request.", "example": "Accept-Patch: application/json-patch+json", "standard": "RFC 5789", "deprecated": false }, { "name": "Accept-Ranges", "direction": "response", "description": "Indicates whether the server supports range requests for the resource.", "example": "Accept-Ranges: bytes", "standard": "RFC 9110", "deprecated": false }, { "name": "Access-Control-Allow-Credentials", "direction": "response", "description": "Tells the browser whether to expose the response when the request's credentials mode is include.", "example": "Access-Control-Allow-Credentials: true", "standard": "WHATWG Fetch", "deprecated": false }, { "name": "Access-Control-Allow-Headers", "direction": "response", "description": "Headers allowed in the actual request, returned in response to a CORS preflight.", "example": "Access-Control-Allow-Headers: Content-Type, Authorization", "standard": "WHATWG Fetch", "deprecated": false }, { "name": "Access-Control-Allow-Methods", "direction": "response", "description": "Methods allowed when accessing the resource, returned in response to a CORS preflight.", "example": "Access-Control-Allow-Methods: GET, POST, PUT, DELETE", "standard": "WHATWG Fetch", "deprecated": false }, { "name": "Access-Control-Allow-Origin", "direction": "response", "description": "Specifies which origins may access the resource via CORS.", "example": "Access-Control-Allow-Origin: https://example.com", "standard": "WHATWG Fetch", "deprecated": false }, { "name": "Access-Control-Expose-Headers", "direction": "response", "description": "Lists response headers that browsers are allowed to expose to client-side script.", "example": "Access-Control-Expose-Headers: X-Request-Id", "standard": "WHATWG Fetch", "deprecated": false }, { "name": "Access-Control-Max-Age", "direction": "response", "description": "How long (seconds) the results of a CORS preflight request can be cached.", "example": "Access-Control-Max-Age: 86400", "standard": "WHATWG Fetch", "deprecated": false }, { "name": "Access-Control-Request-Headers", "direction": "request", "description": "Used in a CORS preflight to tell the server which headers the actual request will include.", "example": "Access-Control-Request-Headers: Content-Type", "standard": "WHATWG Fetch", "deprecated": false }, { "name": "Access-Control-Request-Method", "direction": "request", "description": "Used in a CORS preflight to tell the server which method the actual request will use.", "example": "Access-Control-Request-Method: POST", "standard": "WHATWG Fetch", "deprecated": false }, { "name": "Age", "direction": "response", "description": "Estimated time in seconds the object has been in a proxy cache.", "example": "Age: 24", "standard": "RFC 9111", "deprecated": false }, { "name": "Allow", "direction": "response", "description": "Lists the HTTP methods supported by the target resource. Sent with 405 responses.", "example": "Allow: GET, HEAD, POST", "standard": "RFC 9110", "deprecated": false }, { "name": "Alt-Svc", "direction": "response", "description": "Advertises alternative services (e.g. HTTP/3 endpoints) for the same resource.", "example": "Alt-Svc: h3=\":443\"; ma=86400", "standard": "RFC 7838", "deprecated": false }, { "name": "Authorization", "direction": "request", "description": "Credentials authenticating the client with the server.", "example": "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...", "standard": "RFC 9110", "deprecated": false }, { "name": "Cache-Control", "direction": "both", "description": "Directives for caching mechanisms in both requests and responses.", "example": "Cache-Control: public, max-age=3600, immutable", "standard": "RFC 9111", "deprecated": false }, { "name": "Clear-Site-Data", "direction": "response", "description": "Instructs the browser to clear browsing data (cookies, storage, cache) for the origin.", "example": "Clear-Site-Data: \"cache\", \"cookies\"", "standard": "W3C Clear Site Data", "deprecated": false }, { "name": "Connection", "direction": "both", "description": "Controls whether the network connection stays open after the current transaction. Hop-by-hop; not used in HTTP/2+.", "example": "Connection: keep-alive", "standard": "RFC 9110", "deprecated": false }, { "name": "Content-Disposition", "direction": "response", "description": "Indicates whether content is displayed inline or treated as a downloadable attachment.", "example": "Content-Disposition: attachment; filename=\"report.pdf\"", "standard": "RFC 6266", "deprecated": false }, { "name": "Content-Encoding", "direction": "both", "description": "The compression algorithm applied to the message body.", "example": "Content-Encoding: gzip", "standard": "RFC 9110", "deprecated": false }, { "name": "Content-Language", "direction": "both", "description": "The natural language(s) of the intended audience for the body.", "example": "Content-Language: en-US", "standard": "RFC 9110", "deprecated": false }, { "name": "Content-Length", "direction": "both", "description": "The size of the message body in bytes.", "example": "Content-Length: 3495", "standard": "RFC 9110", "deprecated": false }, { "name": "Content-Location", "direction": "response", "description": "An alternate location for the returned data.", "example": "Content-Location: /documents/report.pdf", "standard": "RFC 9110", "deprecated": false }, { "name": "Content-Range", "direction": "response", "description": "Indicates where a partial body belongs within the full resource.", "example": "Content-Range: bytes 200-1000/67589", "standard": "RFC 9110", "deprecated": false }, { "name": "Content-Security-Policy", "direction": "response", "description": "Controls which resources the browser may load, mitigating XSS and injection attacks.", "example": "Content-Security-Policy: default-src 'self'; img-src *", "standard": "W3C CSP Level 3", "deprecated": false }, { "name": "Content-Security-Policy-Report-Only", "direction": "response", "description": "Reports CSP violations without enforcing the policy.", "example": "Content-Security-Policy-Report-Only: default-src 'self'; report-uri /csp", "standard": "W3C CSP Level 3", "deprecated": false }, { "name": "Content-Type", "direction": "both", "description": "The media type of the message body.", "example": "Content-Type: application/json; charset=utf-8", "standard": "RFC 9110", "deprecated": false }, { "name": "Cookie", "direction": "request", "description": "Stored HTTP cookies previously sent by the server with Set-Cookie.", "example": "Cookie: session=abc123; theme=dark", "standard": "RFC 6265", "deprecated": false }, { "name": "Cross-Origin-Embedder-Policy", "direction": "response", "description": "Controls whether a document can load cross-origin resources that lack explicit permission.", "example": "Cross-Origin-Embedder-Policy: require-corp", "standard": "WHATWG HTML", "deprecated": false }, { "name": "Cross-Origin-Opener-Policy", "direction": "response", "description": "Isolates the document's browsing context group from cross-origin documents.", "example": "Cross-Origin-Opener-Policy: same-origin", "standard": "WHATWG HTML", "deprecated": false }, { "name": "Cross-Origin-Resource-Policy", "direction": "response", "description": "Declares which origins may include this resource via no-cors fetches.", "example": "Cross-Origin-Resource-Policy: same-site", "standard": "WHATWG Fetch", "deprecated": false }, { "name": "Date", "direction": "both", "description": "The date and time the message originated.", "example": "Date: Wed, 21 Oct 2026 07:28:00 GMT", "standard": "RFC 9110", "deprecated": false }, { "name": "ETag", "direction": "response", "description": "An opaque identifier for a specific version of a resource, used for cache validation.", "example": "ETag: \"33a64df551425fcc55e4d42a148795d9f25f89d4\"", "standard": "RFC 9110", "deprecated": false }, { "name": "Expect", "direction": "request", "description": "Indicates expectations the server must meet, primarily 100-continue.", "example": "Expect: 100-continue", "standard": "RFC 9110", "deprecated": false }, { "name": "Expires", "direction": "response", "description": "The date/time after which the response is considered stale. Ignored if Cache-Control: max-age is present.", "example": "Expires: Wed, 21 Oct 2026 07:28:00 GMT", "standard": "RFC 9111", "deprecated": false }, { "name": "Forwarded", "direction": "request", "description": "Discloses information altered by proxies in the request chain (client, protocol, host).", "example": "Forwarded: for=192.0.2.60; proto=https; by=203.0.113.43", "standard": "RFC 7239", "deprecated": false }, { "name": "From", "direction": "request", "description": "Email address of the human controlling the requesting user agent.", "example": "From: webmaster@example.com", "standard": "RFC 9110", "deprecated": false }, { "name": "Host", "direction": "request", "description": "The domain name and optional port of the target server. Mandatory in HTTP/1.1.", "example": "Host: example.com", "standard": "RFC 9110", "deprecated": false }, { "name": "If-Match", "direction": "request", "description": "Makes the request conditional on the resource matching one of the given ETags.", "example": "If-Match: \"33a64df5\"", "standard": "RFC 9110", "deprecated": false }, { "name": "If-Modified-Since", "direction": "request", "description": "Returns the resource only if it changed after the given date; otherwise 304.", "example": "If-Modified-Since: Wed, 21 Oct 2026 07:28:00 GMT", "standard": "RFC 9110", "deprecated": false }, { "name": "If-None-Match", "direction": "request", "description": "Returns the resource only if none of the given ETags match; otherwise 304.", "example": "If-None-Match: \"33a64df5\"", "standard": "RFC 9110", "deprecated": false }, { "name": "If-Range", "direction": "request", "description": "Serves a range only if the resource is unchanged, otherwise the full resource.", "example": "If-Range: \"33a64df5\"", "standard": "RFC 9110", "deprecated": false }, { "name": "If-Unmodified-Since", "direction": "request", "description": "Performs the request only if the resource is unchanged since the given date.", "example": "If-Unmodified-Since: Wed, 21 Oct 2026 07:28:00 GMT", "standard": "RFC 9110", "deprecated": false }, { "name": "Keep-Alive", "direction": "both", "description": "Parameters for a persistent connection, such as timeout and max requests. Defined in RFC 2068 (not carried into RFC 9112); prohibited in HTTP/2 and HTTP/3.", "example": "Keep-Alive: timeout=5, max=1000", "standard": "RFC 2068", "deprecated": false }, { "name": "Last-Modified", "direction": "response", "description": "The date and time the resource was last modified, used for cache validation.", "example": "Last-Modified: Wed, 21 Oct 2026 07:28:00 GMT", "standard": "RFC 9110", "deprecated": false }, { "name": "Link", "direction": "response", "description": "Serializes relationships to other resources, equivalent to HTML link elements.", "example": "Link: ; rel=preload; as=style", "standard": "RFC 8288", "deprecated": false }, { "name": "Location", "direction": "response", "description": "The URL to redirect to (3xx) or the URL of a newly created resource (201).", "example": "Location: https://example.com/new-page", "standard": "RFC 9110", "deprecated": false }, { "name": "Max-Forwards", "direction": "request", "description": "Limits the number of proxies a TRACE or OPTIONS request may pass through.", "example": "Max-Forwards: 10", "standard": "RFC 9110", "deprecated": false }, { "name": "Origin", "direction": "request", "description": "The origin that caused the request; sent with CORS requests and POSTs.", "example": "Origin: https://example.com", "standard": "RFC 6454", "deprecated": false }, { "name": "Permissions-Policy", "direction": "response", "description": "Controls which browser features and APIs the document may use.", "example": "Permissions-Policy: geolocation=(), camera=(self)", "standard": "W3C Permissions Policy", "deprecated": false }, { "name": "Pragma", "direction": "both", "description": "HTTP/1.0 caching directive. Deprecated in favor of Cache-Control.", "example": "Pragma: no-cache", "standard": "RFC 9111", "deprecated": true }, { "name": "Proxy-Authenticate", "direction": "response", "description": "Authentication method that should be used to access a resource behind a proxy.", "example": "Proxy-Authenticate: Basic realm=\"Access to proxy\"", "standard": "RFC 9110", "deprecated": false }, { "name": "Proxy-Authorization", "direction": "request", "description": "Credentials to authenticate the client with a proxy.", "example": "Proxy-Authorization: Basic dXNlcjpwYXNz", "standard": "RFC 9110", "deprecated": false }, { "name": "Range", "direction": "request", "description": "Requests only part of a resource, by byte range.", "example": "Range: bytes=0-1023", "standard": "RFC 9110", "deprecated": false }, { "name": "Referer", "direction": "request", "description": "The address of the page that linked to the requested resource. (Misspelling is canonical.)", "example": "Referer: https://example.com/page", "standard": "RFC 9110", "deprecated": false }, { "name": "Referrer-Policy", "direction": "response", "description": "Governs how much referrer information is included with requests.", "example": "Referrer-Policy: strict-origin-when-cross-origin", "standard": "W3C Referrer Policy", "deprecated": false }, { "name": "Retry-After", "direction": "response", "description": "How long to wait before making a follow-up request, after a 503 or 429.", "example": "Retry-After: 120", "standard": "RFC 9110", "deprecated": false }, { "name": "Sec-Fetch-Dest", "direction": "request", "description": "The request's destination (the type of resource being requested).", "example": "Sec-Fetch-Dest: image", "standard": "W3C Fetch Metadata", "deprecated": false }, { "name": "Sec-Fetch-Mode", "direction": "request", "description": "The mode of the request (navigate, cors, no-cors, same-origin).", "example": "Sec-Fetch-Mode: navigate", "standard": "W3C Fetch Metadata", "deprecated": false }, { "name": "Sec-Fetch-Site", "direction": "request", "description": "The relationship between the request initiator's origin and the target origin.", "example": "Sec-Fetch-Site: same-origin", "standard": "W3C Fetch Metadata", "deprecated": false }, { "name": "Sec-Fetch-User", "direction": "request", "description": "Whether a navigation request was triggered by user activation.", "example": "Sec-Fetch-User: ?1", "standard": "W3C Fetch Metadata", "deprecated": false }, { "name": "Sec-WebSocket-Accept", "direction": "response", "description": "Confirms a WebSocket handshake by echoing a hashed key.", "example": "Sec-WebSocket-Accept: s3pPLMBiTxaQ9kYGzzhZRbK+xOo=", "standard": "RFC 6455", "deprecated": false }, { "name": "Sec-WebSocket-Key", "direction": "request", "description": "A base64 nonce sent by the client to initiate a WebSocket handshake.", "example": "Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==", "standard": "RFC 6455", "deprecated": false }, { "name": "Server", "direction": "response", "description": "Software handling the request on the origin server.", "example": "Server: nginx/1.25.3", "standard": "RFC 9110", "deprecated": false }, { "name": "Server-Timing", "direction": "response", "description": "Communicates server performance metrics to the browser for the request.", "example": "Server-Timing: db;dur=53, app;dur=47.2", "standard": "W3C Server Timing", "deprecated": false }, { "name": "Set-Cookie", "direction": "response", "description": "Sends a cookie from the server to be stored by the client.", "example": "Set-Cookie: session=abc123; HttpOnly; Secure; SameSite=Lax", "standard": "RFC 6265", "deprecated": false }, { "name": "Strict-Transport-Security", "direction": "response", "description": "Forces the browser to use HTTPS for the domain for a given period (HSTS).", "example": "Strict-Transport-Security: max-age=63072000; includeSubDomains; preload", "standard": "RFC 6797", "deprecated": false }, { "name": "TE", "direction": "request", "description": "Transfer encodings the client is willing to accept in the response.", "example": "TE: trailers, deflate", "standard": "RFC 9110", "deprecated": false }, { "name": "Trailer", "direction": "both", "description": "Lists header fields sent in the trailer of a chunked-encoded message.", "example": "Trailer: Expires", "standard": "RFC 9110", "deprecated": false }, { "name": "Transfer-Encoding", "direction": "both", "description": "The form of encoding used to transfer the body, e.g. chunked. Hop-by-hop.", "example": "Transfer-Encoding: chunked", "standard": "RFC 9112", "deprecated": false }, { "name": "Upgrade", "direction": "both", "description": "Asks the server to switch to a different protocol, such as WebSocket.", "example": "Upgrade: websocket", "standard": "RFC 9110", "deprecated": false }, { "name": "Upgrade-Insecure-Requests", "direction": "request", "description": "Signals the client's preference for an encrypted, authenticated response.", "example": "Upgrade-Insecure-Requests: 1", "standard": "W3C Upgrade Insecure Requests", "deprecated": false }, { "name": "User-Agent", "direction": "request", "description": "A string identifying the client software making the request.", "example": "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)", "standard": "RFC 9110", "deprecated": false }, { "name": "Vary", "direction": "response", "description": "Lists request headers that influence which cached response is served.", "example": "Vary: Accept-Encoding, User-Agent", "standard": "RFC 9110", "deprecated": false }, { "name": "Via", "direction": "both", "description": "Records the proxies a message passed through, for loop detection and debugging.", "example": "Via: 1.1 vegur, 1.1 varnish", "standard": "RFC 9110", "deprecated": false }, { "name": "WWW-Authenticate", "direction": "response", "description": "The authentication method(s) the client should use to access the resource. Sent with 401.", "example": "WWW-Authenticate: Bearer realm=\"api\", error=\"invalid_token\"", "standard": "RFC 9110", "deprecated": false }, { "name": "X-Content-Type-Options", "direction": "response", "description": "Disables MIME-type sniffing, forcing the declared Content-Type.", "example": "X-Content-Type-Options: nosniff", "standard": "WHATWG Fetch", "deprecated": false }, { "name": "X-Forwarded-For", "direction": "request", "description": "De facto header identifying the originating client IP through proxies. Standardized as Forwarded.", "example": "X-Forwarded-For: 203.0.113.195, 70.41.3.18", "standard": "Non-standard", "deprecated": false }, { "name": "X-Forwarded-Host", "direction": "request", "description": "De facto header identifying the original Host requested by the client.", "example": "X-Forwarded-Host: example.com", "standard": "Non-standard", "deprecated": false }, { "name": "X-Forwarded-Proto", "direction": "request", "description": "De facto header identifying the protocol (http/https) used by the client.", "example": "X-Forwarded-Proto: https", "standard": "Non-standard", "deprecated": false }, { "name": "X-Frame-Options", "direction": "response", "description": "Controls whether the page may be rendered in a frame, to prevent clickjacking.", "example": "X-Frame-Options: DENY", "standard": "WHATWG HTML", "deprecated": false }, { "name": "X-XSS-Protection", "direction": "response", "description": "Legacy header that toggled browser XSS filtering. Deprecated; use Content-Security-Policy.", "example": "X-XSS-Protection: 0", "standard": "Non-standard", "deprecated": true } ]