APIs
HTTP Headers Reference
A searchable reference of the HTTP request and response headers developers deal with: caching, CORS, cookies, security, proxies, content negotiation and tracing.
Free · No sign-up · Your inputs stay in your browser
Reference
HTTP headers reference
| Header | Sent in | What it does |
|---|---|---|
| Accept | Request | Media types the client can handle, with q= weights. |
| Accept-Encoding | Request | Compression the client supports: gzip, br, zstd. |
| Accept-Language | Request | Preferred languages. |
| Authorization | Request | Credentials: Bearer <token>, Basic <base64>. Never log it. |
| Cache-Control | Both | Caching rules (RFC 9111). no-store, no-cache, max-age, s-maxage, private, immutable. |
| Connection | Both | Hop-by-hop options; forbidden in HTTP/2 and HTTP/3. |
| Content-Disposition | Response | inline or attachment; filename="...". Forces a download. |
| Content-Encoding | Response | Compression applied to the body: gzip, br, zstd. |
| Content-Length | Both | Body size in bytes. |
| Content-Security-Policy | Response | Where scripts, styles and other resources may load from. |
| Content-Type | Both | Media type of the body, with charset for text. |
| Cookie | Request | Cookies the browser sends back. |
| Set-Cookie | Response | Stores a cookie: Secure, HttpOnly, SameSite, Path, Domain, Max-Age. |
| CF-Connecting-IP | Request | The client IP as seen by Cloudflare. Trust it only from Cloudflare's ranges. |
| Date | Response | When the response was generated. |
| ETag | Response | Version identifier for conditional requests. |
| If-None-Match | Request | Sends a stored ETag; a match gets 304 Not Modified. |
| If-Modified-Since | Request | Conditional GET by date. |
| If-Match | Request | Only proceed if the ETag matches: optimistic locking over HTTP (412 if not). |
| Last-Modified | Response | When the resource last changed. |
| Expires | Response | Legacy absolute expiry; Cache-Control max-age wins when both are present. |
| Age | Response | Seconds the response has spent in a shared cache. |
| Vary | Response | Request headers that change the response (Accept-Encoding, Origin). Caches key on them. |
| Host | Request | Target host and port; required in HTTP/1.1. :authority in HTTP/2. |
| Location | Response | Redirect target (3xx) or the created resource (201). |
| Origin | Request | Scheme, host and port of the page making a cross-origin or POST request. |
| Referer | Request | The page that linked here (misspelled in the original spec). |
| Referrer-Policy | Response | How much of the URL goes in Referer. |
| User-Agent | Request | Client software. Easily faked. |
| Range | Request | Byte range for partial downloads and video seeking. |
| Content-Range | Response | Which bytes a 206 response holds. |
| Accept-Ranges | Response | bytes if the server supports Range. |
| Retry-After | Response | Seconds or a date to wait, with 429 and 503. |
| Strict-Transport-Security | Response | HTTPS only for this host, for max-age seconds. |
| X-Content-Type-Options | Response | nosniff: trust Content-Type, do not guess. |
| X-Frame-Options | Response | DENY or SAMEORIGIN; superseded by CSP frame-ancestors. |
| Permissions-Policy | Response | Which browser features (camera, geolocation) the page and its iframes may use. |
| Cross-Origin-Opener-Policy | Response | Isolates the browsing context from cross-origin popups. |
| Cross-Origin-Embedder-Policy | Response | With COOP, enables cross-origin isolation (SharedArrayBuffer). |
| Cross-Origin-Resource-Policy | Response | Who may embed this resource. |
| Access-Control-Allow-Origin | Response | CORS: which origin may read the response. |
| Access-Control-Allow-Methods | Response | CORS preflight: allowed methods. |
| Access-Control-Allow-Headers | Response | CORS preflight: allowed request headers. |
| Access-Control-Allow-Credentials | Response | CORS: allow cookies; cannot pair with origin *. |
| Access-Control-Max-Age | Response | Seconds a preflight result may be cached. |
| Access-Control-Request-Method | Request | Sent in a preflight: the method the real request will use. |
| X-Forwarded-For | Request | Client IP chain added by proxies. Spoofable unless set by your own proxy. |
| X-Forwarded-Proto | Request | Original scheme (https) at the proxy. Laravel reads it through TrustProxies. |
| X-Forwarded-Host | Request | Original Host at the proxy. |
| Forwarded | Request | Standard form of the X-Forwarded-* headers (RFC 7239). |
| X-Request-ID | Both | Correlation ID for tracing one request through logs. Convention, not a standard. |
| traceparent | Request | W3C Trace Context: trace and span IDs for distributed tracing. |
| X-CSRF-TOKEN | Request | CSRF token; Laravel also reads X-XSRF-TOKEN from its cookie. |
| X-Requested-With | Request | XMLHttpRequest marks an AJAX request; Laravel's $request->ajax() reads it. |
| Upgrade | Request | Protocol switch, e.g. websocket (HTTP/1.1). |
| Sec-WebSocket-Key | Request | WebSocket handshake nonce. |
| Sec-Fetch-Site | Request | same-origin, same-site, cross-site or none: a cheap CSRF signal. |
| Sec-Fetch-Mode | Request | navigate, cors, no-cors, same-origin, websocket. |
| Sec-CH-UA | Request | User-Agent client hint: brand and major version. |
| Link | Response | Preload hints and pagination links; sent early in a 103 response. |
| Server | Response | Server software. Hide the version (server_tokens off). |
| Server-Timing | Response | Backend timings shown in DevTools: db;dur=53. |
| WWW-Authenticate | Response | How to authenticate; required with 401. |
| Allow | Response | Methods a resource supports; required with 405. |
| Transfer-Encoding | Response | chunked in HTTP/1.1; not used in HTTP/2. |
| Alt-Svc | Response | Advertises HTTP/3: h3=":443". |
| Idempotency-Key | Request | Makes POST retries safe (Stripe and others). IETF draft. |
| Prefer | Request | Client preferences, e.g. return=minimal (RFC 7240). |
Header names are case-insensitive, and HTTP/2 and HTTP/3 send them in lowercase. Semantics follow RFC 9110 and RFC 9111 unless another source is named. A header behind a proxy (X-Forwarded-*) is only as trustworthy as the proxy that set it.
About this tool
Method, assumptions, practical next steps, and limits.
The standards
HTTP semantics, including most of the headers here, are defined in RFC 9110, caching in RFC 9111, and cookies in RFC 6265. Security headers such as CSP and the CORS headers come from W3C and WHATWG specifications. Header names are case-insensitive, and HTTP/2 and HTTP/3 send them in lowercase.
Proxy headers
X-Forwarded-For, X-Forwarded-Proto and the standard Forwarded header carry the client's address and scheme past a proxy. They are only as trustworthy as the proxy that set them: a framework must be told which proxies to trust, or any client can claim any IP. In Laravel that is the trustProxies middleware setting.
Share
Frequently asked questions
Are HTTP header names case-sensitive?
No. Content-Type and content-type are the same header, and HTTP/2 requires lowercase on the wire.
What is the difference between X-Forwarded-For and X-Real-IP?
X-Forwarded-For is a list that each proxy appends to; X-Real-IP is a single address set by a proxy such as Nginx. Neither is standard; Forwarded (RFC 7239) is.
Is what I paste sent anywhere?
No. The tool runs entirely in your browser with JavaScript. Nothing you type or paste is sent to our server or stored.
Share