Common HTTP headers
HTTP headers are key-value pairs sent at the start of every request and response. They carry metadata such as content type, caching rules and authentication. Use this sheet to recognise the headers you meet most often when building or debugging web traffic.
| Header | Direction | Purpose |
|---|---|---|
| Host | request | Identifies the server's host and port (from the URL). |
| User-Agent | request | Reports the client software (browser, OS, bot) making the request. |
| Accept | request | Lists the response media types (MIME) the client can handle. |
| Authorization | request | Carries credentials (token, Basic auth) to authenticate the client. |
| Content-Type | request/response | States the media type of the request or response body. |
| Content-Length | request/response | Gives the size in bytes of the request or response body. |
| Cookie | request | Sends stored key/value pairs from a previous response back to the server. |
| Set-Cookie | response | Server instructs the client to store a cookie for later requests. |
| Cache-Control | request/response | Directs caching behaviour: no-cache, max-age, private, etc. |
| ETag | response | Opaque identifier for a resource version, used for revalidation. |
| If-None-Match | request | Sends an ETag; server returns 304 if the resource is unchanged. |
| Location | response | Points the client to a new URL for redirects (3xx) or created resources. |
| Access-Control-Allow-Origin | response | Permits a browser to share a response across origins (CORS). |
| X-Forwarded-For | request | Records the client IP as seen through a proxy or load balancer. |
| Referer | request | Indicates the URL of the page that linked to the requested resource. |
Notes
- Header names are case-insensitive; convention writes them in Title-Case (e.g. Content-Type).
- Request headers describe the client; response headers describe the server's answer.
- Browsers set many headers (like Host and Referer) automatically — do not forge them.
Frequently asked questions
- What is the difference between a request and a response header?
- Request headers are sent by the client (browser or app) to the server; response headers are sent back by the server with its answer. Some headers, like Content-Type, appear on both sides.
- Are HTTP header names case-sensitive?
- No. Header names are case-insensitive per the HTTP spec, so Content-Type and content-type mean the same thing. The Title-Case style is only a convention.
- What does the Host header do?
- Host tells the server which domain the request targets. It is mandatory in HTTP/1.1 and lets one server host many websites by name.
- How does caching work with headers?
- Cache-Control sets how long a response may be cached, while ETag and If-None-Match let the client ask 'has this changed?' and receive a cheap 304 Not Modified.