HTTP Headers Reference
Complete reference for HTTP request and response headers.
| Header | Type | Description | Example |
|---|
Frequently Asked Questions
When I click a header row, what gets copied?
Only the header name is copied. Clicking the Content-Type row copies Content-Type, not the full example value from the table.
Can I filter request headers separately from response or CORS headers?
Yes. The tabs filter by categories such as Request, Response, Security, CORS, Caching, Content, and General, and the table also shows a Type column for request/response/both context.
Does this page validate whether a header is allowed in my browser or framework?
No. It is a static reference with descriptions and examples only, so it does not inspect your request, response, or platform restrictions.
What's the difference between Access-Control-Request-* and Access-Control-Allow-* in this reference?
The table treats Access-Control-Request-Method and Access-Control-Request-Headers as browser preflight request headers, while the Access-Control-Allow-* entries are shown as server response headers that grant permission.
Does this include legacy headers or only modern ones?
It includes both. You will see older headers such as DNT and X-XSS-Protection alongside current ones like Permissions-Policy, Cross-Origin-Embedder-Policy, and Reporting-Endpoints.