HTTP headers

HTTP headers let the client and the server pass additional information with a message in a request or response. In HTTP/1.X, a header is a case-insensitive name followed by a colon, then optional whitespace which will be ignored, and finally by its value (for example: Allow: POST). In HTTP/2 and above, headers are displayed in lowercase when viewed in developer tools (accept: */*), and prefixed with a colon for a special group of pseudo-headers (:status: 200). You can find more information on the syntax in each protocol version in the HTTP messages page.

Custom proprietary headers have historically been used with an X- prefix, but this convention was deprecated in 2012 because of the inconveniences it caused when nonstandard fields became standard in RFC 6648; others are listed in the IANA HTTP Field Name Registry, whose original content was defined in RFC 4229. The IANA registry lists headers, including information about their status.

Headers can be grouped according to their contexts:

Request headers

Contain more information about the resource to be fetched, or about the client requesting the resource.

Response headers

Hold additional information about the response, like its location or about the server providing it.

Representation headers

Contain information about the body of the resource, like its MIME type, or encoding/compression applied.

Payload headers

Contain representation-independent information about payload data, including content length and the encoding used for transport.

Headers can also be grouped according to how proxies handle them:

End-to-end headers

These headers must be transmitted to the final recipient of the message: the server for a request, or the client for a response. Intermediate proxies must retransmit these headers unmodified and caches must store them.

Hop-by-hop headers

These headers are meaningful only for a single transport-level connection, and must not be retransmitted by proxies or cached. Note that only hop-by-hop headers may be set using the Connection header.

Authentication

WWW-Authenticate

Defines the authentication method that should be used to access a resource.

Authorization

Contains the credentials to authenticate a user-agent with a server.

Proxy-Authenticate

Defines the authentication method that should be used to access a resource behind a proxy server.

Proxy-Authorization

Contains the credentials to authenticate a user agent with a proxy server.

Caching

Age

The time, in seconds, that the object has been in a proxy cache.

Cache-Control

Directives for caching mechanisms in both requests and responses.

Clear-Site-Data

Clears browsing data (e.g., cookies, storage, cache) associated with the requesting website.

Expires

The date/time after which the response is considered stale.

Specifies a set of rules that define how a URL's query parameters will affect cache matching. These rules dictate whether the same URL with different URL parameters should be saved as separate browser cache entries.

Conditionals

Last-Modified

The last modification date of the resource, used to compare several versions of the same resource. It is less accurate than