HTTP Headers Cheat Sheet
The headers that come up constantly when building or debugging an API: what a client sends, what a server sends back, and how caching and security headers shape both.
HTTP headers are key-value metadata sent alongside every request and response. Request headers tell the server about the client and the payload (Content-Type, Authorization); response headers tell the client about the resource (Content-Type again, Set-Cookie, caching rules).
Caching and security headers are their own category — Cache-Control decides if and how long a response can be reused, while headers like Content-Security-Policy and Strict-Transport-Security tell the browser how to treat the page defensively.
Request headers
| Header | Meaning | Example |
|---|---|---|
Authorization | Credentials for the request | Authorization: Bearer <token> |
Content-Type | Media type of the request body | Content-Type: application/json |
Accept | Media types the client can parse | Accept: application/json |
User-Agent | Client software identifier | User-Agent: Mozilla/5.0 ... |
Cookie | Cookies sent back to the server | Cookie: session=abc123 |
Origin | Origin of a cross-site request | Origin: https://example.com |
Response headers
| Header | Meaning | Example |
|---|---|---|
Content-Type | Media type of the response body | Content-Type: text/html; charset=utf-8 |
Set-Cookie | Server asks the client to store a cookie | Set-Cookie: session=abc; HttpOnly |
Location | Redirect target | Location: /new-path |
ETag | Opaque resource version identifier | ETag: "33a64df5" |
Retry-After | Seconds (or date) to wait before retrying | Retry-After: 120 |
Caching & security headers
| Header | Meaning | Example |
|---|---|---|
Cache-Control | Caching directives | Cache-Control: no-store |
Content-Security-Policy | Restrict where resources may load from | Content-Security-Policy: default-src 'self' |
Strict-Transport-Security | Force HTTPS on future visits | Strict-Transport-Security: max-age=63072000 |
X-Content-Type-Options | Disable MIME-type sniffing | X-Content-Type-Options: nosniff |
Access-Control-Allow-Origin | CORS: which origins may read the response | Access-Control-Allow-Origin: * |