Common HTTP headers for developers
Content-Type, Cache-Control, Authorization... the HTTP headers you run into most often in web development.
Request vs response
Headers flow both ways: some are sent by the client (request), others by the server (response), some in both directions.
Common request headers
| Header | Role |
|---|---|
Content-Type |
Format of the body being sent (e.g. application/json) |
Authorization |
Authentication token or credentials (e.g. Bearer <token>) |
Accept |
Response formats the client will accept |
User-Agent |
Identifies the client (browser, app, script) |
Origin |
The request's origin domain (used for CORS) |
Common response headers
| Header | Role |
|---|---|
Content-Type |
Format of the body being returned |
Cache-Control |
Caching rules (no-cache, max-age=3600…) |
Set-Cookie |
Sets a cookie on the client |
Access-Control-Allow-Origin |
Allows (or not) a cross-origin request (CORS) |
ETag |
A resource's version identifier, for cache validation |
Location |
Redirect URL (with a 3xx status code) |
See also the "Essential HTTP security headers" sheet for headers specifically about security (CSP, HSTS, X-Frame-Options…), which aren't covered here.
Example with curl
curl -I https://example.com # show only the response headers curl -H "Accept: application/json" https://api.example.com # send a header
Cache-Control: common values
| Value | Effect |
|---|---|
no-store |
Never cache |
no-cache |
Can be cached, but revalidated on every use |
max-age=3600 |
Valid in cache for 3600 seconds |
public / private |
Shared cache (CDN) allowed, or client-only |
Thanks for the feedback!