❤ Like

🔖 Save

🔗 Share

Eric Hu

HTTP Headers

🌐 Metadata That Control How Your API Behaves

HTTP headers carry metadata about requests and responses. They tell the server how to handle the request and tell the client how to process the response.

📤 Request Headers

Sent from client to server. They tell the server what the client wants and what it can handle.

• Accept: What content types the client understands (application/json, text/html) • Accept-Encoding: What compression algorithms the client supports (gzip, br) • Authorization: Credentials for authenticating the client (Bearer token, Basic) • Cache-Control: Caching instructions for the request • Content-Type: Format of the request body (application/json) • Cookie: Stored cookies sent to the server • Host: Domain name of the server (required for virtual hosting) • If-Modified-Since: Only send resource if changed after this date • Origin: Where the request comes from (used for CORS) • Referer: URL of the page that made the request • User-Agent: Information about the client (browser, device)

📥 Response Headers

Sent from server to client. They tell the client how to process the response and provide metadata.

• Access-Control-Allow-Origin: Which origins can access the resource (CORS) • Cache-Control: Caching instructions for the response • Content-Disposition: Suggests a filename for the response (file downloads) • Content-Encoding: Compression algorithm used (gzip, br) • Content-Length: Size of the response body in bytes • Content-Type: Format of the response body (application/json) • ETag: Unique identifier for the resource version (cache validation) • Expires: Date/time when the response expires • Last-Modified: Date/time the resource was last changed • Location: URL for redirection (used with 301, 302, 303) • Set-Cookie: Stores cookies on the client • Vary: Tells caches which headers to use for cache key

🔄 Caching Headers

Control how and when responses are cached. Critical for performance.

• Cache-Control: The most important caching header

max-age: How long to cache (seconds)
no-cache: Revalidate with server before using cached version
no-store: Don't cache at all
public: Cacheable by browsers and proxies
private: Cacheable only by the browser
must-revalidate: Must check with server when expired

• ETag: Unique version identifier. Used for conditional requests. • Last-Modified: When the resource changed. Used for conditional requests. • Expires: Deprecated in favor of Cache-Control. Use max-age instead.

🔐 CORS Headers

Control cross-origin access. Essential for APIs that serve browsers.

• Access-Control-Allow-Origin: Which origins are allowed (* or specific domain) • Access-Control-Allow-Methods: Which HTTP methods are allowed (GET, POST, PUT, DELETE) • Access-Control-Allow-Headers: Which request headers are allowed • Access-Control-Allow-Credentials: Whether cookies can be included • Access-Control-Max-Age: How long preflight results can be cached

🛡️ Security Headers

Protect against common web vulnerabilities.

• Content-Security-Policy: Controls what resources can be loaded • X-Frame-Options: Prevents clickjacking (DENY, SAMEORIGIN) • X-Content-Type-Options: Prevents MIME type sniffing (nosniff) • Strict-Transport-Security: Forces HTTPS (HSTS) • Referrer-Policy: Controls what referrer information is sent • Permissions-Policy: Controls which browser features can be used

#http #api #headers #cors #caching #webdev #backend #coding #tips

HTTP headers are key-value pairs sent with requests and responses. They control caching, authentication, content types, and security.

This cheatsheet provides a quick reference to the headers you will use most.

Request headers

Sent by the client to provide context about the request.

Header	Description
`Accept`	Content types the client can process.
`Authorization`	Credentials for authentication.
`Content-Type`	Media type of the request body.
`Cookie`	Stored cookies sent to the server.
`If-None-Match`	Conditional request using an ETag.
`User-Agent`	Identifies the client software.

Response headers

Sent by the server with the response.

Header	Description
`Content-Type`	Media type of the response body.
`Content-Length`	Size of the body in bytes.
`Location`	URL of a created resource or redirect target.
`Set-Cookie`	Store a cookie on the client.
`ETag`	Identifier for a specific version.
`Retry-After`	How long to wait before retrying.
`WWW-Authenticate`	Authentication scheme required (with 401).

http

HTTP/1.1 201 Created
Content-Type: application/json
Location: /api/users/42
Set-Cookie: session=abc123; HttpOnly; Secure; SameSite=Strict

Caching headers

Control how responses are cached by browsers and CDNs.

Header	Description
`Cache-Control`	Main caching directive.
`ETag`	Version identifier for conditional requests.
`Last-Modified`	When the resource last changed.
`Expires`	Absolute expiration date (legacy, use Cache-Control).
`Age`	How long the response has been in a cache.

Common Cache-Control directives.

Directive	Meaning
`no-cache`	Revalidate with the server before using cache.
`no-store`	Never cache. For sensitive data.
`max-age=N`	Fresh for N seconds.
`public`	Any cache may store it.
`private`	Only the browser may store it.

CORS headers

Control cross-origin access to your API.

Header	Description
`Access-Control-Allow-Origin`	Origins allowed to access the resource.
`Access-Control-Allow-Methods`	Methods allowed for cross-origin requests.
`Access-Control-Allow-Headers`	Headers allowed in the actual request.
`Access-Control-Allow-Credentials`	Whether cookies can be sent.
`Access-Control-Max-Age`	How long preflight results are cached.

http

Access-Control-Allow-Origin: https://app.example.com
Access-Control-Allow-Methods: GET, POST, PUT, DELETE
Access-Control-Allow-Headers: Content-Type, Authorization
Access-Control-Allow-Credentials: true
Access-Control-Max-Age: 86400

Security headers

Protect your app from common attacks.

Header	Description
`Strict-Transport-Security`	Force HTTPS connections.
`Content-Security-Policy`	Control which resources can load.
`X-Content-Type-Options`	Prevent MIME type sniffing.
`X-Frame-Options`	Prevent clickjacking via iframes.
`Referrer-Policy`	Control the Referer header.

http

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: default-src 'self'
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Referrer-Policy: strict-origin-when-cross-origin

❤ Like

🔖 Save

🔗 Share

Eric Hu

HTTP Headers

🌐 Metadata That Control How Your API Behaves

HTTP headers carry metadata about requests and responses. They tell the server how to handle the request and tell the client how to process the response.

📤 Request Headers

Sent from client to server. They tell the server what the client wants and what it can handle.

📥 Response Headers

Sent from server to client. They tell the client how to process the response and provide metadata.

🔄 Caching Headers

Control how and when responses are cached. Critical for performance.

• Cache-Control: The most important caching header

max-age: How long to cache (seconds)
no-cache: Revalidate with server before using cached version
no-store: Don't cache at all
public: Cacheable by browsers and proxies
private: Cacheable only by the browser
must-revalidate: Must check with server when expired

🔐 CORS Headers

Control cross-origin access. Essential for APIs that serve browsers.

🛡️ Security Headers

Protect against common web vulnerabilities.

#http #api #headers #cors #caching #webdev #backend #coding #tips

HTTP headers are key-value pairs sent with requests and responses. They control caching, authentication, content types, and security.

This cheatsheet provides a quick reference to the headers you will use most.

Request headers

Sent by the client to provide context about the request.

Header	Description
`Accept`	Content types the client can process.
`Authorization`	Credentials for authentication.
`Content-Type`	Media type of the request body.
`Cookie`	Stored cookies sent to the server.
`If-None-Match`	Conditional request using an ETag.
`User-Agent`	Identifies the client software.

Response headers

Sent by the server with the response.

Header	Description
`Content-Type`	Media type of the response body.
`Content-Length`	Size of the body in bytes.
`Location`	URL of a created resource or redirect target.
`Set-Cookie`	Store a cookie on the client.
`ETag`	Identifier for a specific version.
`Retry-After`	How long to wait before retrying.
`WWW-Authenticate`	Authentication scheme required (with 401).

http

HTTP/1.1 201 Created
Content-Type: application/json
Location: /api/users/42
Set-Cookie: session=abc123; HttpOnly; Secure; SameSite=Strict

Caching headers

Control how responses are cached by browsers and CDNs.

Header	Description
`Cache-Control`	Main caching directive.
`ETag`	Version identifier for conditional requests.
`Last-Modified`	When the resource last changed.
`Expires`	Absolute expiration date (legacy, use Cache-Control).
`Age`	How long the response has been in a cache.

Common Cache-Control directives.

Directive	Meaning
`no-cache`	Revalidate with the server before using cache.
`no-store`	Never cache. For sensitive data.
`max-age=N`	Fresh for N seconds.
`public`	Any cache may store it.
`private`	Only the browser may store it.

CORS headers

Control cross-origin access to your API.

Header	Description
`Access-Control-Allow-Origin`	Origins allowed to access the resource.
`Access-Control-Allow-Methods`	Methods allowed for cross-origin requests.
`Access-Control-Allow-Headers`	Headers allowed in the actual request.
`Access-Control-Allow-Credentials`	Whether cookies can be sent.
`Access-Control-Max-Age`	How long preflight results are cached.

http

Access-Control-Allow-Origin: https://app.example.com
Access-Control-Allow-Methods: GET, POST, PUT, DELETE
Access-Control-Allow-Headers: Content-Type, Authorization
Access-Control-Allow-Credentials: true
Access-Control-Max-Age: 86400

Security headers

Protect your app from common attacks.

Header	Description
`Strict-Transport-Security`	Force HTTPS connections.
`Content-Security-Policy`	Control which resources can load.
`X-Content-Type-Options`	Prevent MIME type sniffing.
`X-Frame-Options`	Prevent clickjacking via iframes.
`Referrer-Policy`	Control the Referer header.

http

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: default-src 'self'
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Referrer-Policy: strict-origin-when-cross-origin

HTTP Headers

Request headers

Response headers

Caching headers

CORS headers

Security headers

Full-Stack AI Developer Roadmap

HTTP Headers

Request headers

Response headers

Caching headers

CORS headers

Security headers

Full-Stack AI Developer Roadmap