HTTP Headers

Challenge clients for credentials with WWW-Authenticate. Configure Basic, Bearer, Digest, and other authentication schemes on 401 responses.

Send credentials with the Authorization header. Basic, Bearer, and Digest schemes, syntax, and security guidance.

Understand how Proxy-Authenticate challenges clients to provide proxy credentials with a 407 response. Authentication schemes, syntax, and proxy chain examples.

Use the Proxy-Authorization header to send credentials to a proxy server after a 407 challenge. Authentication schemes, syntax, and chain behavior.

Measure cache freshness with the Age header. How CDNs and proxies report elapsed time since the origin response.

Control browser and CDN caching with Cache-Control directives. Syntax, real-world examples, and best practices.

Understand the Expires header and timestamp-based cache freshness. Learn how Expires interacts with Cache-Control and when to use each approach.

Wipe browser caches, cookies, and storage with Clear-Site-Data. Logout flows, directives, and deployment patterns.

Understand the Last-Modified header and date-based cache validation. Learn how servers report modification timestamps for conditional request workflows.

Learn how ETag identifiers enable cache revalidation and concurrency control. Strong vs. weak ETags, syntax, and conditional request patterns.

Understand the If-Match header and ETag- based conditional requests. Prevent lost updates with optimistic concurrency control in PUT and DELETE operations.

Learn how If-None-Match validates cached resources using ETags. Implement cache revalidation and prevent overwrites with conditional requests.

Learn how If-Modified-Since enables date- based cache revalidation for GET and HEAD requests. Reduce bandwidth with conditional responses and 304 status.

Understand If-Unmodified-Since and how date-based preconditions prevent lost updates. Guard PUT and DELETE operations against concurrent modifications.

Control cache variants with the Vary header. Tell caches which request headers affect the response to store and serve correct representations.

Negotiate response media types with the Accept header. Quality values, wildcards, content negotiation flow, and examples.

Negotiate compression with Accept-Encoding. Supported algorithms, quality values, syntax, and server-side implementation.

Negotiate content language with Accept-Language. BCP 47 tags, quality values, server handling, and examples.

Understand why Accept-Charset is deprecated and why UTF-8 replaced charset negotiation. History, syntax, and migration guidance.

Declare media types with Content-Type. MIME types, charset parameter, content negotiation, and MIME sniffing risks.

Declare message body size with Content-Length. Byte counting, connection reuse, progress indicators, and gotchas.

Identify response compression with Content-Encoding. gzip, br, zstd algorithms, server setup, and decoding.

Declare content audience language with Content-Language. Language tags, content negotiation, and multilingual setup.

Point to the negotiated representation with Content-Location. Difference from Location, caching impact, and examples.

Trigger file downloads or inline display with Content-Disposition. Attachment, filename encoding, and form data usage.

Serve partial content with Content-Range. Byte range syntax, resumable downloads, media streaming, and 206 response flow.

Send stored cookies to the server with the Cookie header. Name-value pairs, session management, and security rules.

Manage HTTP cookies with Set-Cookie. Configure attributes for security, scope, expiration, SameSite policy, and cross-site behavior.

Control cross-origin access with Access-Control-Allow-Origin. Wildcards, dynamic origins, CORS errors, and fixes.

Allow HTTP methods in CORS preflight with Access-Control-Allow-Methods. Syntax, wildcard rules, and server configuration.

Permit custom headers in CORS requests with Access-Control-Allow-Headers. Preflight setup, wildcards, and examples.

Send cookies and credentials in CORS requests with Access-Control-Allow- Credentials. Setup, pitfalls, and fixes.

Understand how the Origin request header identifies where a request came from for CORS. Syntax, browser behavior, and server-side validation.

Enable resumable downloads with Accept-Ranges. Partial requests, byte serving, streaming, and server setup.

Use the Range header to request partial content from a server. Byte-range syntax, multipart responses, resume downloads, and streaming examples.

Learn how If-Range makes range requests conditional for safe download resumption. Get partial content or the full resource without 412 errors.

Understand how the Location header drives HTTP redirects and signals newly created resources. Syntax, redirect types, and examples.

Use the Retry-After header to tell clients when to retry after 429 or 503 responses. Delta-seconds, HTTP- date formats, and bot handling tips.

Understand the required Host header in HTTP/1.1 requests. Learn how virtual hosting works, syntax rules, and how servers resolve target domains.

Identify client software with User-Agent. Parse product tokens, understand UA reduction, and implement bot detection strategies.

Understand how the Referer header identifies the linking page in HTTP requests. Analytics, access control, privacy risks, and Referrer-Policy interaction.

Implement Referrer-Policy to control what referrer information browsers send. Directive options, privacy implications, and deployment examples.

Advertise supported HTTP methods with the Allow header. Required in 405 responses, OPTIONS handling, and syntax.

Understand the HTTP Date header and how origin servers timestamp responses. Role in cache freshness calculations and proxy behavior.

Identify server software with the Server header. Understand product token syntax, security risks of version exposure, and best practices.

Force HTTPS connections with Strict-Transport-Security. Configure HSTS max-age, includeSubDomains, preload, and prevent downgrade attacks.

Prevent XSS and injection attacks with Content-Security-Policy. Directives, source lists, nonces, and deployment.

Prevent MIME sniffing attacks with X-Content-Type-Options: nosniff. Force browsers to respect the declared Content-Type on every response.

Prevent clickjacking with X-Frame-Options. Control frame embedding with DENY, SAMEORIGIN, and the CSP frame-ancestors alternative.

Implement Permissions-Policy to control which browser features a site and embedded iframes access. Directives, allowlists, and examples.

Encode message bodies for safe transfer with Transfer-Encoding. Understand chunked encoding, hop-by- hop semantics, and streaming responses.

Declare transfer encoding preferences with the TE header. Negotiate chunked trailers and compression between client and server.

Manage TCP connection lifecycle with the Connection header. Keep-alive, close, hop-by-hop behavior, and HTTP/2 changes.

Switch protocols on an existing connection with the Upgrade header. Negotiate WebSocket, HTTP/2, and TLS upgrades over HTTP/1.1.