HTTP headers

Cache-Control   (both)
     How long this may be reused and by whom. max-age=31536000, immutable for a fingerprinted asset; no-store for anything private. "no-cache" does not mean do not cache — it means revalidate before reuse, which is the single most misread value in HTTP.

ETag   (response)
     A version tag for the body. The browser sends it back in If-None-Match and a match answers 304 with no body. Cheaper than Last-Modified because it does not depend on clocks.

Last-Modified   (response)
     When the body last changed, to the second. Paired with If-Modified-Since. One-second resolution means a file changed twice in a second can be served stale.

Vary   (response)
     Which request headers change this response, so a cache does not serve the wrong one. Vary: Accept-Encoding is nearly always right; Vary: User-Agent nearly always destroys your hit rate.

Content-Type   (both)
     What the bytes are. Wrong here and a browser refuses to act: an SVG as text/plain does not render, a .vtt as text/plain is ignored and the video plays with no captions and no error.

Content-Disposition   (response)
     inline to display, attachment to download. filename*=UTF-8''... is how a non-ASCII filename survives; the plain filename= parameter is ASCII only.

Content-Encoding   (response)
     The compression applied to the body — gzip, br, zstd. Not the character set, which goes in Content-Type.

Content-Length   (both)
     The body size in bytes. Omitted when chunked; getting it wrong truncates or hangs the response.

Authorization   (request)
     Credentials. Bearer <token> for OAuth, Basic <base64 user:pass> for the old scheme. Never logged, and never in a URL where it would be.

WWW-Authenticate   (response)
     Sent with 401 to say which scheme to authenticate with. A 401 without it is incomplete, and some clients will not retry.

Set-Cookie   (response)
     Sets a cookie. Secure, HttpOnly and SameSite are the three that matter; without HttpOnly a script can read it, and without Secure it travels in the clear.

Cookie   (request)
     Cookies going back. Sent on every request to the origin, which is why a large cookie is a tax on every page load.

Strict-Transport-Security   (response)
     Forces HTTPS for this host for max-age seconds. includeSubDomains covers everything under it. Hard to undo — a long max-age set by mistake locks out a subdomain until it expires.

Content-Security-Policy   (response)
     What the page may load and run. The one header that actually stops cross-site scripting rather than reporting it. unsafe-inline in script-src gives most of the protection back.

X-Content-Type-Options   (response)
     nosniff: take Content-Type literally instead of guessing from the bytes. One value, no downside, and it closes a whole class of upload attacks.

X-Frame-Options   (response)
     DENY or SAMEORIGIN to stop the page being framed. Superseded by frame-ancestors in CSP, which is more expressive; send both while old browsers remain.

Referrer-Policy   (response)
     How much of the current URL is sent on to the next site. strict-origin-when-cross-origin is the modern default and keeps paths and query strings inside your own origin.

Permissions-Policy   (response)
     Which browser features this document and its frames may use — camera, geolocation, microphone. Replaces Feature-Policy.

Access-Control-Allow-Origin   (response)
     Which origin may read the response. A single origin or *, never a list. With credentials it may not be * — that pairing is the commonest CORS failure.

Access-Control-Allow-Credentials   (response)
     true lets the browser send cookies cross-origin. Requires an exact origin in Allow-Origin, not a wildcard.

Access-Control-Allow-Methods   (response)
     Which methods the preflight permits. Only consulted on the OPTIONS preflight, not on the real request.

Access-Control-Allow-Headers   (response)
     Which request headers the preflight permits. A custom header the client sends must be listed here or the request never leaves the browser.

Access-Control-Max-Age   (response)
     How long a preflight result may be cached. Browsers cap it well below what you set — Chrome at 2 hours.

Origin   (request)
     Where the request came from, sent on cross-origin requests and all POSTs. What a CORS check and a CSRF check both look at.

Accept   (request)
     What the client can take back, as media types with quality values. Content negotiation happens here, and Vary has to name it if you use it.

Accept-Encoding   (request)
     Which compressions the client understands. Respond compressed only with one of these, and add Vary: Accept-Encoding.

Accept-Language   (request)
     Preferred languages with weights. A hint, not an instruction — and a poor way to pick a locale on its own, because it reflects the browser install and not the reader.

User-Agent   (request)
     The client naming itself, in a string that has been a fiction since roughly 1996. Feature-detect instead; it is frozen or reduced in modern browsers anyway.

Range   (request)
     Ask for part of the body — bytes=0-1023. What makes seeking in a video and resuming a download possible; the server answers 206 with Content-Range.

Retry-After   (response)
     Sent with 429 or 503 to say when to come back, in seconds or as a date. Answering 429 without it leaves the client guessing, and it will guess badly.

Location   (response)
     Where to go, with a 3xx, or where the thing just created lives, with a 201.

Link   (response)
     Relationships as a header rather than in the markup — rel=preload, rel=canonical, pagination. Read before the body arrives, which is the point.

X-Forwarded-For   (request)
     The client address as a proxy saw it. Trivially forged unless every hop is yours, so never use it for anything that matters without knowing your proxy chain.

Forwarded   (request)
     The standard version of the X-Forwarded-* family, carrying for, proto and host in one. Less widely implemented, better specified.

Server-Timing   (response)
     Timings from the server, shown in the browser devtools next to the network timings. Costs nothing and answers "is it us or the network".

Idempotency-Key   (request)
     A client-chosen key so that retrying a POST does not charge the card twice. Not a standard header, and universal anyway in payment APIs.