Visión General y Alcance
Estandarizados en RFC 9110 y RFC 9111, los encabezados HTTP controlan la negociación de contenido, la autenticación, las políticas de caché y la seguridad de las aplicaciones web modernas.
Tabla de Especificaciones y Matriz
Filtro instantáneo por palabra clave, código o directiva
| Clave / Código | Definición y Detalles | Jerarquía Semántica GEO | Especificación y Notas |
|---|---|---|---|
| Strict-Transport-Security | Strict-Transport-Security (HSTS) Forces browsers to only communicate over HTTPS and refuse insecure HTTP fallbacks. max-age=31536000; includeSubDomains; preload | ●HSTS ↳HTTP header ↳security response header ↳mandatory TLS enforcement | RFC 6797 §6.1 Always deploy max-age >= 31536000 (1 year) to qualify for browser HSTS preload lists. |
| Content-Security-Policy | Content-Security-Policy (CSP) Restricts resource origins (scripts, styles, images) to prevent Cross-Site Scripting (XSS). default-src 'self'; script-src 'self' 'nonce-rAnd0m' | ●CSP ↳HTTP header ↳security response header ↳content execution restrictions | W3C CSP Level 3 Eliminates XSS vulnerabilities by disallowing unauthorized inline scripts and eval(). |
| X-Content-Type-Options | X-Content-Type-Options Prevents browsers from MIME-sniffing a response away from the declared Content-Type. nosniff | ●X-Content-Type-Options ↳HTTP header ↳security response header ↳MIME sniffing prevention | Fetch Living Standard Value must strictly be "nosniff". Blocks attacks where uploaded text files are executed as scripts. |
| X-Frame-Options | X-Frame-Options Indicates whether a browser should be allowed to render a page in a <frame>, <iframe>, or <object>. DENY (or SAMEORIGIN) | ●X-Frame-Options ↳HTTP header ↳security response header ↳clickjacking prevention | RFC 7034 §2 Defends against Clickjacking attacks; superseded by CSP frame-ancestors directive. |
| Cache-Control | Cache-Control Specifies caching directives for both requests and responses along the client-CDN-server path. public, max-age=31536000, immutable | ●Cache-Control ↳HTTP header ↳caching directive ↳freshness and revalidation policy | RFC 9111 §5.2 Use "no-store" for sensitive authenticated endpoints; "max-age=31536000, immutable" for hashed assets. |
| ETag | ETag (Entity Tag) An opaque identifier assigned by a web server to a specific version of a resource. W/"33a64df551425fcc55e4d42a148795d9f25f89d4" | ●ETag ↳HTTP header ↳caching validator ↳fingerprint token | RFC 9110 §8.8.3 Allows clients to make conditional requests with If-None-Match to receive 304 Not Modified. |
| Authorization | Authorization Contains the credentials to authenticate a user agent with the server. Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9... | ●Authorization ↳HTTP header ↳request credential ↳bearer token or basic auth | RFC 9110 §11.6.2 Triggers CORS preflight checks when dispatched from browser JavaScript cross-origin. |
| Access-Control-Allow-Origin | Access-Control-Allow-Origin Indicates whether the response can be shared with requesting code from the given origin. https://app.example.com | ●Access-Control-Allow-Origin ↳HTTP header ↳CORS permission ↳cross-origin permission | W3C Fetch Spec Wildcard "*" cannot be used if Access-Control-Allow-Credentials is true. |
| Content-Type | Content-Type Indicates the original media type (MIME type) of the resource before any encoding. application/json; charset=utf-8 | ●Content-Type ↳HTTP header ↳payload metadata ↳MIME format specification | RFC 9110 §8.3 Tells the recipient parser how to decode the raw bytes of the message body. |
Hardened Production Nginx Security Headers Snippet
# Recommended OWASP Baseline Security Headers
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none';" always;Applying these headers at the reverse proxy ensures all downstream web responses are protected by default.
Preguntas y Respuestas sobre Estándares
Are HTTP header names case-sensitive?↓
What happens if a response sends duplicate headers?↓
References & Primary Sources
Every source below directly substantiates technical statements and protocol behaviors explained in Referencia de Encabezados HTTP (Request & Response). Curious-Techie prioritizes official Internet standards (IETF RFCs, W3C Recommendations, WHATWG specifications) and established security bodies (OWASP, NIST). Zero sponsored or secondary links.
- [1]IETFPrimary SpecificationRFC 9110 • Core ArchitectureVerified Primary SourceTechnical Claim Supported:
Foundational specification for the stateless client-server request-response architecture, standard status codes (1xx–5xx), and method safety and idempotency.
Source URI: https://datatracker.ietf.org/doc/html/rfc9110 - [2]IETFPrimary SpecificationRFC 9112 • Section 3 & 6Verified Primary SourceTechnical Claim Supported:
Defines ASCII wire protocol framing, chunked transfer encoding, and persistent connection Keep-Alive mechanics.
Source URI: https://datatracker.ietf.org/doc/html/rfc9112 - [3]IETFPrimary SpecificationRFC 9113 • Section 4 & 5Verified Primary SourceTechnical Claim Supported:
Standardizes binary framing, HPACK header compression, and bi-directional stream multiplexing over a single shared TCP connection.
Source URI: https://datatracker.ietf.org/doc/html/rfc9113 - [4]IETFPrimary SpecificationRFC 9114 • Section 3 & 4Verified Primary SourceTechnical Claim Supported:
Eliminates TCP head-of-line blocking by mapping HTTP streams directly over QUIC UDP transport connections with integrated TLS 1.3 encryption.
Source URI: https://datatracker.ietf.org/doc/html/rfc9114
Ecosistema Técnico Relacionado y Próximos Pasos
Artículos Técnicos Relacionados
What Is HTTP (Hypertext Transfer Protocol)?
Foundational stateless request-response protocol of the World Wide Web.
HTTP/1.1 vs HTTP/2: Multiplexing & Performance
Head-of-line blocking compared to binary framing and stream multiplexing.
Troubleshooting: HTTP 403 Forbidden Error
Diagnose server authorization denial, WAF IP blocks, and permission issues.
Preguntas Relacionadas
Why Is POST Non-Idempotent While PUT Is Idempotent?
Answer: PUT replaces or creates a specific resource deterministically, while POST processes input according to server logic, typically creating new items on repeated requests.
What Is the Difference Between ETag and Last-Modified?
Answer: Last-Modified relies on 1-second filesystem timestamps, while ETag provides an exact cryptographic digest of content, eliminating false positive cache misses.
Can HTTP/2 Multiplex Requests Over a Single TCP Connection?
Answer: Yes, HTTP/2 breaks requests into binary frames with stream IDs, allowing interleaved requests and responses concurrently over one TCP socket.
Laboratorios Prácticos de Diagnóstico
Continuar Aprendiendo
HTTP Protocol & Header Inspection Lab
Craft raw HTTP headers and observe conditional 304 responses in the interactive workbench.