EMZETT.
Login

Emzett Wiki

HTTP headers: Important fields in request and response

Properties1
tagsglossar, http, web

2 min read

HTTP headers: Important fields in request and response

In short: HTTP headers are additional information before the actual content of a request or response, such as content type, caching rules, cookies and security policies.

In more detail: Every HTTP message consists of a start line, headers and an optional body. The headers control how browsers, servers and intermediaries handle the content. In the browser you see them under F12 → Network, in the terminal with curl -I https://example.com.

In Depth

Request headers

  • Host: desired server name (mandatory in HTTP/1.1).
  • User-Agent: browser/program.
  • Accept, Accept-Language, Accept-Encoding: desired formats, languages, compression (gzip, br).
  • Authorization: credentials (Bearer <token>).
  • Cookie: stored cookies.
  • Content-Type/Content-Length: type and size of the sent content.
  • Origin, Referer: origin of the request.
  • If-None-Match, If-Modified-Since: conditional requests for caching.

Response headers

  • Content-Type: text/html; charset=utf-8, application/json …
  • Cache-Control: max-age=3600, no-store, public, private.
  • ETag, Last-Modified: version of the resource.
  • Set-Cookie: set a cookie (with HttpOnly, Secure, SameSite).
  • Location: target on redirect (301/302/307/308).
  • Content-Encoding: gzip or br.
  • Retry-After, WWW-Authenticate, Allow.

Security headers

  • Strict-Transport-Security (HSTS): always HTTPS.
  • Content-Security-Policy (CSP): allowed sources for scripts and images, works against XSS.
  • X-Content-Type-Options: nosniff.
  • X-Frame-Options / CSP frame-ancestors: against clickjacking.
  • Referrer-Policy, Permissions-Policy.
  • Access-Control-Allow-Origin (CORS): which origin may make requests.

Practice

Headers are not trustworthy when they come from the client (for example X-Forwarded-For can be forged unless a proxy overwrites it). Set security headers centrally (reverse proxy or framework), avoid unnecessary information (Server, X-Powered-By) and test with tools such as securityheaders.com or Mozilla Observatory.

See also: Security headers, HTTP status codes, CORS, Cookies, Caching strategies

Backlinks