HTTP headers, with the gotchas included
Not the full IANA registry — the 43 headers you actually meet while debugging, each with a real example and the way it typically bites.
Request headers
What the client tells the server.
Authorization
Carries the credentials for the request: Bearer tokens, Basic base64 pairs, Digest challenges, or signature schemes like AWS SigV4.
Accept
Tells the server which media types the client can handle, with optional quality weights (q=).
Accept-Encoding
Lists the compression algorithms the client understands.
Accept-Language
Expresses the user's preferred languages for content negotiation.
If-None-Match
Conditional GET: "give me the resource only if its ETag changed".
If-Match
Conditional write: "apply my PUT/PATCH/DELETE only if the resource still has this ETag".
If-Modified-Since
Conditional GET by date: unchanged since this timestamp → 304.
Cookie
Sends the stored cookies back to the server, semicolon-separated in a single header.
Origin
The scheme+host+port of the page making the request.
Referer
The URL of the page that triggered the request (yes, misspelled in the spec since 1996).
User-Agent
Identifies the client software making the request.
Host
The hostname (and optional port) the request targets — mandatory in HTTP/1.
Range
Requests only part of a resource — download resume, video seeking.
X-Forwarded-For
The de-facto chain of client IPs appended by each proxy hop.
X-Forwarded-Proto
Tells the origin which scheme the client actually used before TLS terminated at the load balancer.
Idempotency-Key
A client-generated key letting the server deduplicate retries of unsafe operations — send the same key, get the same result instead of a double charge.
Response headers
What the server tells the client (and every cache in between).
WWW-Authenticate
Sent with 401 responses to tell the client which authentication scheme and parameters the server expects.
Content-Encoding
Declares how the body bytes are compressed (gzip, br, zstd).
Transfer-Encoding
Streams the body in length-prefixed chunks when the total size is unknown upfront — common for dynamically generated responses and SSE-ish streams.
ETag
An opaque version identifier for the response.
Last-Modified
Timestamp-based cache validator, the simpler sibling of ETag.
Expires
Legacy absolute-time cache expiry.
Location
Where to go next: the redirect target on 3xx responses, or the URL of the freshly created resource on 201.
Set-Cookie
The server storing state in the client: one cookie per Set-Cookie header, with attributes controlling scope (Domain/Path), lifetime (Max-Age), and security (Secure/HttpOnly/SameSite).
Content-Range
Labels which slice of the full resource this 206 response carries, and the total size after the slash.
Accept-Ranges
Advertises that the server supports Range requests on this resource.
Access-Control-Allow-Origin
The core CORS response header: which Origin may read this response from browser JavaScript.
Access-Control-Allow-Methods
Preflight answer: which HTTP methods the cross-origin caller may use.
Access-Control-Allow-Headers
Preflight answer: which request headers the cross-origin caller may send.
Access-Control-Allow-Credentials
Permits cross-origin requests to include cookies/credentials — requires the JS side to set credentials: "include".
Strict-Transport-Security
HSTS: instructs browsers to use HTTPS only for this host for max-age seconds, killing protocol-downgrade attacks.
Content-Security-Policy
Declares which sources the browser may load scripts, styles, images and more from — the big anti-XSS control.
X-Content-Type-Options
Forbids browsers from MIME-sniffing the body into a different type than Content-Type declares — blocks a class of XSS via mislabeled uploads.
X-Frame-Options
Controls whether the page may be embedded in an iframe — the classic clickjacking defense (DENY / SAMEORIGIN).
Referrer-Policy
Controls how much of the current URL leaks in the Referer header of outgoing requests.
Retry-After
How long to wait before retrying, in seconds or as an HTTP date.
Vary
Tells caches which request headers change the response — each combination gets its own cache entry.
Content-Disposition
Whether the body displays inline or downloads as an attachment, with the suggested filename.
Both directions
Headers that travel both ways.
Content-Type
Declares the media type of the body — what the bytes mean.
Content-Length
The exact size of the body in bytes.
Cache-Control
The caching rulebook: how long (max-age), where (public/private), and whether to cache at all (no-store).
Connection
Controls whether the TCP connection survives after the response (keep-alive) or closes (close), plus which hop-by-hop headers to strip.
X-Request-Id
A correlation ID for one request across services and logs.
See every header on every request.
ReqPad shows auto-generated and custom headers for all six protocols — edit, send, inspect, from your phone.