HTTP Headers: Reference and Troubleshooting
Reference guides for HTTP request and response headers, including syntax, semantics, interoperability, caching, and browser behavior.
Articles & Guides
Accept Header: Content Negotiation and MIME Quality Values
Understand the HTTP Accept header, how clients negotiate response formats with servers, quality values (q-values), and how Accept differs from Content-Type.
Access-Control-Allow-Headers: Preflight Permission for Request Headers
Learn how the Access-Control-Allow-Headers response header authorizes non-simple custom HTTP headers in CORS preflight OPTIONS responses.
Access-Control-Allow-Methods: Permitted Methods in CORS Preflight
Understand the Access-Control-Allow-Methods response header, authorizing HTTP methods for cross-origin requests, and preflight caching strategies.
Access-Control-Allow-Origin: Wildcards, Credentials, and Validation
Understand the Access-Control-Allow-Origin response header, single origin vs wildcard (*), credentials constraints, and dynamic origin reflection.
Access-Control-Expose-Headers: Exposing Response Headers to JavaScript
Learn how Access-Control-Expose-Headers allows browser JavaScript code to read custom backend response headers in fetch and XMLHttpRequest.
Age Header: Cache Freshness and Proxy Calculation
Learn how the HTTP Age response header conveys the time in seconds a cached representation has resided in proxy and CDN caches.
Authorization Header: Syntax, Schemes, and Common Errors
Understand the HTTP Authorization request header, authentication schemes like Bearer and Basic, security best practices, and common integration errors.
Cache-Control Header: Directives, Caching Strategy, and Pitfalls
Master the HTTP Cache-Control header, caching directives like max-age, no-cache, no-store, stale-while-revalidate, and CDN caching architectures.
ETag Header: Strong vs. Weak Validators and Cache Revalidation
Understand the HTTP ETag response header, strong vs weak entity tags (W/...), conditional revalidation workflows, and bandwidth optimization.
If-None-Match Header: Conditional GET and 304 Not Modified
Learn how the HTTP If-None-Match request header enables conditional GET requests, avoids redundant data transfers, and triggers 304 Not Modified responses.
Origin Header: Browser Security, Syntax, and Null Origins
Understand the HTTP Origin request header, why browsers attach origin metadata on cross-origin requests, and how to handle null origin scenarios.
Retry-After Header: Syntax, Seconds vs. HTTP-Date, and Rate Limiting
Learn how the HTTP Retry-After response header coordinates client retry delays on 429 Too Many Requests and 503 Service Unavailable responses.
User-Agent Header: Syntax, Client Identification, and API Rules
Understand the HTTP User-Agent request header, string format conventions, API client identification rules, and how WAFs filter suspicious agents.
Vary Header: Cache Segmentation and Content Negotiation
Understand the HTTP Vary response header, cache key segmentation across CDNs and browsers, common directives (Vary: Accept-Encoding, Origin), and caching pitfalls.
What Is the Content-Type Header and Why Does It Matter?
Learn what the HTTP Content-Type header does in requests and responses, how it differs from Accept, and how it relates to CORS preflight checks.
WWW-Authenticate Header: Challenges, Schemes, and Syntax
Learn how the HTTP WWW-Authenticate response header defines authentication challenges on 401 Unauthorized responses, realm parameters, and Bearer token errors.
Understanding HTTP Headers
Headers define critical protocol behaviors such as content types, caching rules, authentication schemes, and cross-origin permissions. Inspect request and response headers carefully in DevTools or server logs when debugging API interactions.