HTTP Headers Reference
Explore the most commonly used HTTP headers, understand what they do and learn when to use them in web applications, APIs and browsers.
HTTP headers are metadata exchanged between clients and servers during every HTTP request and response. They provide additional information about the message, such as the content type, authentication details, caching instructions, compression methods and browser capabilities. Without headers, modern web applications and APIs would not function efficiently or securely.
Although hundreds of standardized and custom HTTP headers exist, developers typically work with a relatively small set of frequently used headers. Understanding their purpose makes it much easier to build APIs, troubleshoot networking problems and optimize website performance.
What Are HTTP Headers?
HTTP headers are key-value pairs included before the message body in HTTP requests and responses. Each header provides specific information that helps clients and servers communicate correctly without affecting the actual content being transferred.
Where Headers Appear
| Message | Contains Headers |
|---|---|
| HTTP Request | Yes |
| HTTP Response | Yes |
Request Headers vs Response Headers
Some headers are sent by clients to describe the request, while others are returned by servers to describe the response. Certain headers may appear in both directions depending on the communication scenario.
| Header Type | Purpose |
|---|---|
| Request headers | Describe client capabilities and request details |
| Response headers | Describe the returned resource and server behavior |
| General headers | Apply to both requests and responses |
HTTP Header Format
Each HTTP header consists of a name followed by a colon and a value. Multiple headers are sent together before the message body.
Content-Type: application/jsonMost Common Request Headers
| Header | Purpose |
|---|---|
| Host | Identifies the destination host |
| User-Agent | Identifies the client application |
| Accept | Specifies acceptable response formats |
| Authorization | Provides authentication credentials |
| Content-Type | Describes the request body |
| Origin | Identifies the requesting origin |
| Referer | Indicates the previous page |
| Cookie | Sends stored cookies |
Most Common Response Headers
| Header | Purpose |
|---|---|
| Content-Type | Describes the response body |
| Content-Length | Specifies response size |
| Cache-Control | Controls caching behavior |
| Set-Cookie | Creates or updates cookies |
| Location | Provides redirect destination |
| ETag | Supports cache validation |
| Access-Control-Allow-Origin | Controls CORS access |
| Content-Encoding | Specifies compression |
General Headers
Some headers are not limited to requests or responses. These general headers describe aspects of the HTTP message itself and may appear in both directions depending on the protocol version and implementation.
| Header | Common Usage |
|---|---|
| Date | Timestamp |
| Connection | Connection management |
| Transfer-Encoding | Message transfer method |
| Via | Proxy information |
Content Negotiation Headers
Content negotiation allows clients and servers to agree on the best representation of a resource. Browsers and API clients send preference headers, while servers return content matching those preferences whenever possible.
| Header | Purpose |
|---|---|
| Accept | Preferred response media types |
| Accept-Encoding | Supported compression algorithms |
| Accept-Language | Preferred languages |
| Accept-Charset | Preferred character encodings |
Authentication Headers
Authentication headers help identify users or applications. REST APIs commonly use bearer tokens, while some enterprise systems continue to use Basic authentication or custom authorization schemes.
| Header | Typical Usage |
|---|---|
| Authorization | Bearer tokens, Basic authentication |
| WWW-Authenticate | Authentication challenge |
| Proxy-Authorization | Proxy authentication |
Authorization: Bearer eyJhbGciOi...Caching Headers
Caching headers reduce unnecessary network requests by allowing browsers, CDNs and proxies to reuse previously downloaded resources. Proper cache configuration improves performance while reducing server load.
| Header | Purpose |
|---|---|
| Cache-Control | Caching directives |
| ETag | Cache validation identifier |
| If-None-Match | Conditional request using ETag |
| Last-Modified | Resource modification date |
| If-Modified-Since | Conditional request by date |
| Expires | Cache expiration time |
Compression Headers
Modern web servers compress responses before sending them to clients. Compression headers indicate which algorithms are supported and which algorithm was actually used for the response.
| Header | Purpose |
|---|---|
| Accept-Encoding | Supported compression |
| Content-Encoding | Applied compression |
CORS Headers
Cross-Origin Resource Sharing (CORS) headers determine whether browsers allow JavaScript running on one origin to access resources hosted on another origin. These headers are essential for modern APIs consumed by web applications.
| Header | Purpose |
|---|---|
| Access-Control-Allow-Origin | Allowed origins |
| Access-Control-Allow-Methods | Allowed HTTP methods |
| Access-Control-Allow-Headers | Allowed request headers |
| Access-Control-Allow-Credentials | Credential support |
| Access-Control-Max-Age | Preflight cache duration |
Cookie Headers
Cookies are transferred using dedicated HTTP headers. Browsers send stored cookies to servers using the Cookie header, while servers create or update cookies through the Set-Cookie response header.
| Header | Direction |
|---|---|
| Cookie | Request |
| Set-Cookie | Response |
Security Headers
Security headers help browsers defend against common web attacks including clickjacking, MIME sniffing and cross-site scripting. Properly configuring these headers is an important part of securing modern web applications.
| Header | Purpose |
|---|---|
| Content-Security-Policy | Restricts resource loading |
| Strict-Transport-Security | Forces HTTPS |
| X-Content-Type-Options | Disables MIME sniffing |
| X-Frame-Options | Prevents clickjacking |
| Referrer-Policy | Controls referrer information |
| Permissions-Policy | Restricts browser features |
HTTP/2 and HTTP/3 Headers
Although HTTP/2 and HTTP/3 significantly changed how HTTP messages are transmitted, the concept of headers remains the same. Modern protocol versions compress headers more efficiently and transmit them in binary form internally, reducing bandwidth usage and improving performance while preserving the familiar header names developers already know.
Custom HTTP Headers
Applications can define their own HTTP headers to exchange additional metadata. Custom headers are commonly used for request tracing, API versioning, feature flags, client identification and internal debugging. Choosing descriptive names helps keep APIs consistent and easier to maintain.
| Example Header | Typical Purpose |
|---|---|
| X-Request-ID | Request tracing |
| X-Correlation-ID | Distributed logging |
| API-Version | API version selection |
| X-Client-Version | Application version |
| Idempotency-Key | Prevent duplicate operations |
Inspecting HTTP Headers
Developers inspect HTTP headers regularly when debugging APIs, troubleshooting browser issues or optimizing performance. Browser Developer Tools, command-line utilities and API clients all display request and response headers, making it possible to verify authentication, caching, compression and CORS configuration.
Common Header Mistakes
- Returning an incorrect Content-Type.
- Forgetting Cache-Control on cacheable resources.
- Sending overly permissive CORS headers.
- Including sensitive information in custom headers.
- Using deprecated security headers instead of modern alternatives.
- Assuming header names are translated or localized.
Best Practices
- Return only headers that are actually needed.
- Use standardized header names whenever possible.
- Configure appropriate caching policies.
- Secure applications with modern HTTP security headers.
- Verify request and response headers during API testing.
- Document custom headers used by your API.
Frequently Asked Questions
What are HTTP headers?
HTTP headers are key-value pairs exchanged between clients and servers that provide metadata about requests and responses, such as content type, authentication, caching and security policies.
What's the difference between request and response headers?
Request headers are sent by the client to describe the request, while response headers are returned by the server to describe the resource and how it should be handled.
Can applications define custom HTTP headers?
Yes. APIs frequently use custom headers for request tracking, versioning, diagnostics and other application-specific purposes, although standardized headers should be preferred whenever possible.
Which HTTP headers are most important for APIs?
Common API headers include Authorization, Content-Type, Accept, Cache-Control, ETag, Access-Control-Allow-Origin and various authentication or versioning headers depending on the API design.
How can I inspect HTTP headers?
You can inspect them using browser Developer Tools, API testing tools, command-line clients such as curl or server-side logging during request processing.
Helpful HTTP Tools
An HTTP Header Viewer lets you inspect complete request and response headers, an HTTP Header Generator helps build correctly formatted headers for testing, an HTTP Headers Parser converts raw header blocks into structured output, an HTTP Request Builder simplifies creating custom requests with specific headers, and an HTTP Response Formatter makes server responses easier to analyze while verifying returned header values.
Conclusion
HTTP headers are the foundation of communication between browsers, servers and APIs. They control everything from content negotiation and authentication to caching, compression, cookies, security and cross-origin access. While there are many standardized headers, understanding the most commonly used ones is enough for the majority of web development tasks. Keeping a reliable HTTP headers reference nearby makes debugging faster, simplifies API development and helps ensure applications remain secure, performant and standards-compliant.