HTTP Headers Quick Reference
The request and response headers that control caching, content, auth, CORS, and security — what each one does and sane values.
Content & negotiation
- Content-Type
- Body’s media type:
application/json,text/html; charset=utf-8 - Accept
- What the client wants back:
Accept: application/json - Content-Encoding
gzip/br— compression applied to the body- Content-Disposition
attachment; filename="a.pdf"— force download
Caching
- Cache-Control
max-age=3600·no-store(never cache) ·private/public- Immutable assets
Cache-Control: public, max-age=31536000, immutable(hashed filenames)- ETag / If-None-Match
- Validator; server replies
304 Not Modifiedif unchanged - Last-Modified
- Timestamp validator; paired with
If-Modified-Since
Auth & CORS
- Authorization
Bearer <token>·Basic <base64>- Set-Cookie
- Add
HttpOnly; Secure; SameSite=Lax— the safe default - Access-Control-Allow-Origin
- CORS: which origins may read the response. Avoid blind
*with credentials. - Access-Control-Allow-Methods
- Allowed methods on the resource (preflight response)
Security headers
- Strict-Transport-Security
max-age=63072000; includeSubDomains— force HTTPS (HSTS)- Content-Security-Policy
- Whitelist sources; the strongest defense against XSS
- X-Content-Type-Options
nosniff— stop MIME sniffing- X-Frame-Options
DENY— prevent clickjacking (or use CSP frame-ancestors)- Referrer-Policy
strict-origin-when-cross-origin— limit referrer leakage