Web Architecture

Updated for 2026

HTTP Common Headers Reference Cheatsheet 2026

Complete guide to standard and security HTTP headers including Authorization, CORS control, caching policies, and CSP directives.

Target Version Compatibility

Interactive Skill Mastery

Mark commands as learned to build your customized reference tracker. Retained locally in this browser.

Level:Novice

Command Mastery Progress0 of 23 Mastered (0%)

Request Headers

Content-Type: application/json

BeginnerBasics

Inform recipient about the media format of the request/response body.

When to Use

Include this standard HTTP header in web request/response packets to govern data parsing, authorization, caching, or security.

Common Mistakes

Forgetting HTTP headers are case-insensitive but have strict format parameters that break on punctuation typos.

Shortcut / Pro-Tip

Inspect headers easily via Chrome/Firefox DevTools under Network -> Headers.

Example

Content-Type: application/json

Output Example

Console / Terminal

HTTP/1.1 200 OK
Content-Type: application/json
Cache-Control: private
Content-Length: 412

Accept: application/json, text/plain

BeginnerBasics

Specify which MIME media formats are acceptable in response.

When to Use

Include this standard HTTP header in web request/response packets to govern data parsing, authorization, caching, or security.

Common Mistakes

Forgetting HTTP headers are case-insensitive but have strict format parameters that break on punctuation typos.

Shortcut / Pro-Tip

Inspect headers easily via Chrome/Firefox DevTools under Network -> Headers.

Example

Accept: application/json, text/plain

Output Example

Console / Terminal

HTTP/1.1 200 OK
Accept: application/json, text/plain
Cache-Control: private
Content-Length: 412

User-Agent: Mozilla/5.0 (Windows NT...)

BeginnerBasics

Identify the client application, web browser, operating system, and version.

When to Use

Include this standard HTTP header in web request/response packets to govern data parsing, authorization, caching, or security.

Common Mistakes

Forgetting HTTP headers are case-insensitive but have strict format parameters that break on punctuation typos.

Shortcut / Pro-Tip

Inspect headers easily via Chrome/Firefox DevTools under Network -> Headers.

Example

User-Agent: Mozilla/5.0 (Windows NT...)

Output Example

Console / Terminal

HTTP/1.1 200 OK
User-Agent: Mozilla/5.0 (Windows NT...)
Cache-Control: private
Content-Length: 412

Accept-Language: en-US, en;q=0.9

BeginnerBasics

Inform server of preferred languages for localized response assets.

When to Use

Include this standard HTTP header in web request/response packets to govern data parsing, authorization, caching, or security.

Common Mistakes

Forgetting HTTP headers are case-insensitive but have strict format parameters that break on punctuation typos.

Shortcut / Pro-Tip

Inspect headers easily via Chrome/Firefox DevTools under Network -> Headers.

Example

Accept-Language: en-US, en;q=0.9

Output Example

Console / Terminal

HTTP/1.1 200 OK
Accept-Language: en-US, en;q=0.9
Cache-Control: private
Content-Length: 412

Response Headers

Server: Apache/2.4.41 (Ubuntu)

BeginnerBasics

Disclose the software application powering the server handling the request.

When to Use

Include this standard HTTP header in web request/response packets to govern data parsing, authorization, caching, or security.

Common Mistakes

Forgetting HTTP headers are case-insensitive but have strict format parameters that break on punctuation typos.

Shortcut / Pro-Tip

Inspect headers easily via Chrome/Firefox DevTools under Network -> Headers.

Example

Server: Apache/2.4.41 (Ubuntu)

Output Example

Console / Terminal

HTTP/1.1 200 OK
Server: Apache/2.4.41 (Ubuntu)
Cache-Control: private
Content-Length: 412

Location: https://example.com/new-page

BeginnerBasics

Indicate the destination URL in redirectional status actions.

When to Use

Include this standard HTTP header in web request/response packets to govern data parsing, authorization, caching, or security.

Common Mistakes

Forgetting HTTP headers are case-insensitive but have strict format parameters that break on punctuation typos.

Shortcut / Pro-Tip

Inspect headers easily via Chrome/Firefox DevTools under Network -> Headers.

Example

Location: https://example.com/new-page

Output Example

Console / Terminal

HTTP/1.1 200 OK
Location: https://example.com/new-page
Cache-Control: private
Content-Length: 412

CORS

Access-Control-Allow-Origin: *

BeginnerBasics

CORS control: list which web origins are authorized to access the response resource.

When to Use

When configuring Cross-Origin Resource Sharing (CORS) rules to secure or grant cross-domain client requests.

Common Mistakes

Using '*' wildcard in Access-Control-Allow-Origin in production alongside credentials, which is disallowed and breaks requests.

Shortcut / Pro-Tip

Set specific origin domains (e.g. https://www.learnhubly.com) to maintain absolute security.

Example

Access-Control-Allow-Origin: *

Output Example

Console / Terminal

HTTP/1.1 200 OK
Access-Control-Allow-Origin: *
Cache-Control: private
Content-Length: 412

Access-Control-Allow-Methods: GET, POST, OPTIONS

BeginnerBasics

Specify permitted HTTP request verbs in preflight requests.

When to Use

When configuring Cross-Origin Resource Sharing (CORS) rules to secure or grant cross-domain client requests.

Common Mistakes

Using '*' wildcard in Access-Control-Allow-Origin in production alongside credentials, which is disallowed and breaks requests.

Shortcut / Pro-Tip

Set specific origin domains (e.g. https://www.learnhubly.com) to maintain absolute security.

Example

Access-Control-Allow-Methods: GET, POST, OPTIONS

Output Example

Console / Terminal

HTTP/1.1 200 OK
Access-Control-Allow-Methods: GET, POST, OPTIONS
Cache-Control: private
Content-Length: 412

Access-Control-Allow-Headers: Content-Type, Authorization

AdvancedSecurity

List which custom headers can be sent during cross-origin requests.

When to Use

When configuring Cross-Origin Resource Sharing (CORS) rules to secure or grant cross-domain client requests.

Common Mistakes

Using '*' wildcard in Access-Control-Allow-Origin in production alongside credentials, which is disallowed and breaks requests.

Shortcut / Pro-Tip

Set specific origin domains (e.g. https://www.learnhubly.com) to maintain absolute security.

Example

Access-Control-Allow-Headers: Content-Type, Authorization

Output Example

Console / Terminal

HTTP/1.1 200 OK
Access-Control-Allow-Headers: Content-Type, Authorization
Cache-Control: private
Content-Length: 412

Access-Control-Max-Age: 86400

BeginnerBasics

Set the duration in seconds that a preflight pre-check can be cached.

When to Use

When configuring Cross-Origin Resource Sharing (CORS) rules to secure or grant cross-domain client requests.

Common Mistakes

Using '*' wildcard in Access-Control-Allow-Origin in production alongside credentials, which is disallowed and breaks requests.

Shortcut / Pro-Tip

Set specific origin domains (e.g. https://www.learnhubly.com) to maintain absolute security.

Example

Access-Control-Max-Age: 86400

Output Example

Console / Terminal

HTTP/1.1 200 OK
Access-Control-Max-Age: 86400
Cache-Control: private
Content-Length: 412

Security

Strict-Transport-Security: max-age=31536000; includeSubDomains

AdvancedSecurity

Enforce HTTPS communication across the entire domain and subdomains.

When to Use

When strengthening the browser security shield of your application, preventing scripts sniffs, clickjack, or XSS.

Common Mistakes

Applying an overly strict Content-Security-Policy (CSP) that inadvertently blocks essential third-party scripts or Google analytics.

Shortcut / Pro-Tip

Use 'Content-Security-Policy-Report-Only' first to audit policies in production before enforcing them.

Example

Strict-Transport-Security: max-age=31536000; includeSubDomains

Output Example

Console / Terminal

HTTP/1.1 200 OK
Strict-Transport-Security: max-age=31536000; includeSubDomains
Cache-Control: private
Content-Length: 412

Content-Security-Policy: default-src 'self' https://api.example.com

AdvancedSecurity

Limit the origin from which scripts, images, and other resources can load.

When to Use

When strengthening the browser security shield of your application, preventing scripts sniffs, clickjack, or XSS.

Common Mistakes

Applying an overly strict Content-Security-Policy (CSP) that inadvertently blocks essential third-party scripts or Google analytics.

Shortcut / Pro-Tip

Use 'Content-Security-Policy-Report-Only' first to audit policies in production before enforcing them.

Example

Content-Security-Policy: default-src 'self' https://api.example.com

Output Example

Console / Terminal

HTTP/1.1 200 OK
Content-Security-Policy: default-src 'self' https://api.example.com
Cache-Control: private
Content-Length: 412

X-Frame-Options: DENY

AdvancedSecurity

Block clickjacking by preventing the web page from loading inside frames or iframes.

When to Use

Include this standard HTTP header in web request/response packets to govern data parsing, authorization, caching, or security.

Common Mistakes

Forgetting HTTP headers are case-insensitive but have strict format parameters that break on punctuation typos.

Shortcut / Pro-Tip

Inspect headers easily via Chrome/Firefox DevTools under Network -> Headers.

Example

X-Frame-Options: DENY

Output Example

Console / Terminal

HTTP/1.1 200 OK
X-Frame-Options: DENY
Cache-Control: private
Content-Length: 412

X-Content-Type-Options: nosniff

AdvancedSecurity

Inhibit browser MIME-sniffing, enforcing the declared Content-Type header.

When to Use

Include this standard HTTP header in web request/response packets to govern data parsing, authorization, caching, or security.

Common Mistakes

Forgetting HTTP headers are case-insensitive but have strict format parameters that break on punctuation typos.

Shortcut / Pro-Tip

Inspect headers easily via Chrome/Firefox DevTools under Network -> Headers.

Example

X-Content-Type-Options: nosniff

Output Example

Console / Terminal

HTTP/1.1 200 OK
X-Content-Type-Options: nosniff
Cache-Control: private
Content-Length: 412

Referrer-Policy: strict-origin-when-cross-origin

AdvancedSecurity

Govern how much referrer metadata is sent on outbound requests.

When to Use

Include this standard HTTP header in web request/response packets to govern data parsing, authorization, caching, or security.

Common Mistakes

Forgetting HTTP headers are case-insensitive but have strict format parameters that break on punctuation typos.

Shortcut / Pro-Tip

Inspect headers easily via Chrome/Firefox DevTools under Network -> Headers.

Example

Referrer-Policy: strict-origin-when-cross-origin

Output Example

Console / Terminal

HTTP/1.1 200 OK
Referrer-Policy: strict-origin-when-cross-origin
Cache-Control: private
Content-Length: 412

Caching

Cache-Control: public, max-age=31536000, immutable

BeginnerBasics

Instruct caches (browser & proxy) to store response unchanged for one year.

When to Use

When defining server and browser caching strategies to optimize web asset deliveries.

Common Mistakes

Caching sensitive private API user data inside shared CDN proxies.

Shortcut / Pro-Tip

Use 'immutable' for versioned bundles (like main.12a5f.js) to tell browsers to cache them forever.

Example

Cache-Control: public, max-age=31536000, immutable

Output Example

Console / Terminal

HTTP/1.1 200 OK
Cache-Control: public, max-age=31536000, immutable
Cache-Control: private
Content-Length: 412

Cache-Control: no-store, no-cache, must-revalidate

IntermediateDebugging

Prevent any caching of the response, requiring direct origin fetch every turn.

When to Use

When defining server and browser caching strategies to optimize web asset deliveries.

Common Mistakes

Caching sensitive private API user data inside shared CDN proxies.

Shortcut / Pro-Tip

Use 'immutable' for versioned bundles (like main.12a5f.js) to tell browsers to cache them forever.

Example

Cache-Control: no-store, no-cache, must-revalidate

Output Example

Console / Terminal

HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: private
Content-Length: 412

ETag: "33a64df551425fcc55e4d42a148795d9f25f89d4"

BeginnerBasics

Provide a unique cryptographic hash for tracking resource revisions.

When to Use

When defining server and browser caching strategies to optimize web asset deliveries.

Common Mistakes

Caching sensitive private API user data inside shared CDN proxies.

Shortcut / Pro-Tip

Use 'immutable' for versioned bundles (like main.12a5f.js) to tell browsers to cache them forever.

Example

ETag: "33a64df551425fcc55e4d42a148795d9f25f89d4"

Output Example

Console / Terminal

HTTP/1.1 200 OK
ETag: "33a64df551425fcc55e4d42a148795d9f25f89d4"
Cache-Control: private
Content-Length: 412

If-None-Match: "33a64df551425fcc..."

BeginnerBasics

Conditional request header to retrieve files only if the remote hash changed.

When to Use

Include this standard HTTP header in web request/response packets to govern data parsing, authorization, caching, or security.

Common Mistakes

Forgetting HTTP headers are case-insensitive but have strict format parameters that break on punctuation typos.

Shortcut / Pro-Tip

Inspect headers easily via Chrome/Firefox DevTools under Network -> Headers.

Example

If-None-Match: "33a64df551425fcc..."

Output Example

Console / Terminal

HTTP/1.1 200 OK
If-None-Match: "33a64df551425fcc..."
Cache-Control: private
Content-Length: 412

Auth

Authorization: Bearer <json_web_token>

AdvancedSecurity

Pass secret bearer credentials to authorize API requests.

When to Use

When making secure API requests to a protected backend service that requires an authenticated JSON Web Token (JWT) or OAuth token.

Common Mistakes

Exposing this header in client-side client browser logs or failing to use HTTPS, which allows token sniffing and account takeover.

Shortcut / Pro-Tip

Commonly stored in memory or secure HttpOnly cookies rather than localStorage for enhanced security.

Example

fetch('/api/user', {
  headers: {
    'Authorization': 'Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...'
  }
});

Output Example

Console / Terminal

HTTP/1.1 200 OK
Content-Type: application/json

{ "id": 42, "name": "Dharmveer" }

Authorization: Basic dXNlcm5hbWU6cGFzc3dvcmQ=

AdvancedSecurity

Pass base64-encoded username and password credentials.

When to Use

Include this standard HTTP header in web request/response packets to govern data parsing, authorization, caching, or security.

Common Mistakes

Forgetting HTTP headers are case-insensitive but have strict format parameters that break on punctuation typos.

Shortcut / Pro-Tip

Inspect headers easily via Chrome/Firefox DevTools under Network -> Headers.

Example

Authorization: Basic dXNlcm5hbWU6cGFzc3dvcmQ=

Output Example

Console / Terminal

HTTP/1.1 200 OK
Authorization: Basic dXNlcm5hbWU6cGFzc3dvcmQ=
Cache-Control: private
Content-Length: 412

Cookie: session_id=abc123xyz

BeginnerBasics

Send previously saved state cookies back to server in request headers.

When to Use

Include this standard HTTP header in web request/response packets to govern data parsing, authorization, caching, or security.

Common Mistakes

Forgetting HTTP headers are case-insensitive but have strict format parameters that break on punctuation typos.

Shortcut / Pro-Tip

Inspect headers easily via Chrome/Firefox DevTools under Network -> Headers.

Example

Cookie: session_id=abc123xyz

Output Example

Console / Terminal

HTTP/1.1 200 OK
Cookie: session_id=abc123xyz
Cache-Control: private
Content-Length: 412

Set-Cookie: session_id=abc123xyz; Secure; HttpOnly; SameSite=Strict

AdvancedSecurity

Command the client browser to store a session cookie securely.

When to Use

Include this standard HTTP header in web request/response packets to govern data parsing, authorization, caching, or security.

Common Mistakes

Forgetting HTTP headers are case-insensitive but have strict format parameters that break on punctuation typos.

Shortcut / Pro-Tip

Inspect headers easily via Chrome/Firefox DevTools under Network -> Headers.

Example

Set-Cookie: session_id=abc123xyz; Secure; HttpOnly; SameSite=Strict

Output Example

Console / Terminal

HTTP/1.1 200 OK
Set-Cookie: session_id=abc123xyz; Secure; HttpOnly; SameSite=Strict
Cache-Control: private
Content-Length: 412

HTTP Headers Best Practices

1Implement Strict Caching Rules

Use Cache-Control headers with long max-age and 'immutable' for static assets, and 'no-store' for private or dynamic JSON API responses.

2Enforce Secure HTTPS Redirection

Set the Strict-Transport-Security (HSTS) header to force browsers to interact with your site exclusively over secure HTTPS.

3Block Clickjacking with X-Frame-Options

Set X-Frame-Options to DENY or SAMEORIGIN to prevent malicious frames from rendering your web layouts.

4Configure Content Security Policy (CSP)

Define explicit source origins for scripts, styles, and image connections to mitigate cross-site scripting (XSS) threats.

5Restrict CORS Origin Policies

In production APIs, always set Access-Control-Allow-Origin to specific trusted domains instead of a general '*' wildcard.

Common HTTP Headers Errors & Solutions

Error

CORS Error: No 'Access-Control-Allow-Origin' header is present

Solution

The backend server is missing CORS headers. Configure CORS middleware on the server to allow request origins.

Error

Insecure Content Blocked

Solution

You are trying to request HTTP APIs from an HTTPS site. Ensure all fetch targets are updated to use secure HTTPS URLs.

Error

The Content-Security-Policy directive blocks script execution

Solution

An inline script or external resource violates your CSP rules. Update your CSP header to include the specific domain or script nonce.

Error

Authorization headers stripped

Solution

Apache/Nginx proxies sometimes drop Authorization headers. Enable 'PassHeader Authorization' in server proxy configurations.

Error

Browser MIME-type sniffing issues

Solution

Supply the header 'X-Content-Type-Options: nosniff' to force browsers to follow your declared Content-Type (e.g. application/javascript).

Common HTTP Headers Interview Questions

Q1What is the purpose of the CORS Access-Control-Allow-Origin header?

It tells the web browser which third-party origins are authorized to read response payloads requested from cross-site scripts.

Q2What is the difference between Cache-Control: no-cache and no-store?

no-store commands the browser and CDN proxies never to cache or save any copy of the response. no-cache allows caching but forces the browser to revalidate with the origin server before serving it.

Q3What does the HTTP Status 401 Unauthorized vs 403 Forbidden represent?

401 Unauthorized means the request lacks valid authentication credentials. 403 Forbidden means the client's identity is authenticated, but they do not possess permissions to access the requested resource.

Q4What does the Content-Security-Policy (CSP) header protect against?

CSP protects websites from cross-site scripting (XSS), clickjacking, and injection attacks by restricting which sources can load and execute scripts or media.

Q5How do HTTP Cookies manage session states securely using headers?

The server returns a 'Set-Cookie' header containing security directives: 'Secure' (force HTTPS), 'HttpOnly' (block JavaScript accessibility), and 'SameSite=Strict' (block CSRF attacks).

Related Resources

Article

HTTP Status Codes Decision Tree

An expert decision flow chart to choosing the correct HTTP status codes in APIs.

Article

REST API Complete Guide 2026

Master resource design, caching headers, error patterns, and API architecture.

Tool

REST API Tester

Send custom HTTP queries and inspect both response body and raw headers in real-time.

Article

RFC 9457 Problem Details Guide

Standardize error reporting formats using the modern RFC 9457 specifications.