HTTP Headers Reference
HTTP 请求头与响应头完整参考
33 headers
Media types the client can process (e.g. application/json, text/html).
Accept: text/html,application/xhtml+xmlContent encodings the client supports (gzip, deflate, br).
Accept-Encoding: gzip, deflate, brPreferred natural languages for the response.
Accept-Language: en-US,en;q=0.9Credentials for HTTP authentication.
Authorization: Bearer eyJhbGc...Directives for caching mechanisms in both requests and responses.
Cache-Control: no-cache, no-storeControl options for the current connection.
Connection: keep-aliveSize of the request/response body in bytes.
Content-Length: 348Media type of the request/response body.
Content-Type: application/json; charset=utf-8HTTP cookies previously sent by the server.
Cookie: session=abc123; user=johnDomain name and port of the server. Required in HTTP/1.1.
Host: www.example.com:443Makes the request conditional; returns 304 if not modified.
If-Modified-Since: Mon, 18 Jul 2016 02:36:04 GMTMakes request conditional using ETags.
If-None-Match: "737060cd8c284d8af7ad3082f209582d"The origin that initiated the request (for CORS).
Origin: https://developer.example.comAddress of the previous web page that linked to the current page.
Referer: https://developer.example.com/pageApplication, OS, vendor, and version of the requesting client.
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Indicates whether the response can be shared with code from the given origin.
Access-Control-Allow-Origin: *HTTP methods allowed when accessing the resource for CORS.
Access-Control-Allow-Methods: GET, POST, PUTHeaders that can be used during the actual CORS request.
Access-Control-Allow-Headers: Content-Type, AuthorizationEncoding applied to the response body (gzip, br, etc.).
Content-Encoding: gzipControls resources the user agent is allowed to load.
Content-Security-Policy: default-src 'self'Identifier for a specific version of a resource (for caching).
ETag: "33a64df551425fcc55e4d42a148795d9f25f89d4"Date/time after which the response is considered stale.
Expires: Thu, 01 Dec 2025 16:00:00 GMTDate/time when the resource was last modified.
Last-Modified: Wed, 21 Oct 2015 07:28:00 GMTURL to redirect to for 3xx responses or the URL of the newly created resource.
Location: /new-pageHow long to wait before making another request (rate limiting/503).
Retry-After: 120Send a cookie from the server to the user agent.
Set-Cookie: id=a3fWa; Expires=Thu, 21 Oct 2025 07:28:00 GMT; Secure; HttpOnlyForce HTTPS for all future connections (HSTS).
Strict-Transport-Security: max-age=31536000; includeSubDomainsForm of encoding used to safely transfer the payload body.
Transfer-Encoding: chunkedDetermines which request headers to use for cache key.
Vary: Accept-Encoding, Accept-LanguageAuthentication method to access the resource (sent with 401).
WWW-Authenticate: Basic realm="Access to staging site"Prevent MIME type sniffing.
X-Content-Type-Options: nosniffIndicate whether the response can be framed (clickjacking protection).
X-Frame-Options: DENYEnable XSS filtering in older browsers (deprecated, use CSP instead).
X-XSS-Protection: 1; mode=block关于本工具
HTTP Headers Reference涵盖了最常用的请求头和响应头,提供通俗易懂的说明和示例值。安全相关的关键头部以红色高亮显示。
可按类别(Request、Response或Both)筛选,或通过头部名称和关键字搜索,快速找到所需内容。
使用方法
- 在搜索框中输入头部名称或关键字,即可即时筛选列表。
- 使用类别下拉菜单,只显示Request、Response或Both头部。
- 每个条目都会显示头部名称、类别标签、说明和示例值。
- 配置服务器或HTTP客户端时,可将示例值作为参考起点。
使用场景
后端工程师在部署前设置正确的安全头部(CSP、HSTS、X-Frame-Options)。前端开发者使用Access-Control相关头部调试CORS问题。学习HTTP的学生则通过此参考资料理解该协议的工作原理。
常见问题
- 请求头和响应头有什么区别? — 请求头由客户端发送,用于提供上下文信息(可接受的类型、身份验证等)。响应头由服务器发送,包含有关响应的元数据(内容类型、缓存、安全性)。
- 每个网站都应添加哪些安全相关的头部? — 至少应在所有响应中添加:Strict-Transport-Security、Content-Security-Policy、X-Content-Type-Options和X-Frame-Options。
- 这里列出了所有的HTTP头部吗? — 不是。本参考资料主要涵盖最常用的标准头部和安全头部。完整列表请参见MDN的HTTP headers文档。