Overview & Scope
HTTP headers enable the client and server to pass additional metadata with an HTTP message. They govern everything from negotiation of content formats and cryptographic boundaries to CDN cache TTLs and browser security.
Specification Table & Matrix
Instant client-side filter by keyword, status code, or directive name
| Key / Code | Definition & Details | GEO Semantic Hierarchy | Spec & Notes |
|---|---|---|---|
| Strict-Transport-Security | Strict-Transport-Security (HSTS) Forces browsers to only communicate over HTTPS and refuse insecure HTTP fallbacks. max-age=31536000; includeSubDomains; preload | ●HSTS ↳HTTP header ↳security response header ↳mandatory TLS enforcement | RFC 6797 §6.1 Always deploy max-age >= 31536000 (1 year) to qualify for browser HSTS preload lists. |
| Content-Security-Policy | Content-Security-Policy (CSP) Restricts resource origins (scripts, styles, images) to prevent Cross-Site Scripting (XSS). default-src 'self'; script-src 'self' 'nonce-rAnd0m' | ●CSP ↳HTTP header ↳security response header ↳content execution restrictions | W3C CSP Level 3 Eliminates XSS vulnerabilities by disallowing unauthorized inline scripts and eval(). |
| X-Content-Type-Options | X-Content-Type-Options Prevents browsers from MIME-sniffing a response away from the declared Content-Type. nosniff | ●X-Content-Type-Options ↳HTTP header ↳security response header ↳MIME sniffing prevention | Fetch Living Standard Value must strictly be "nosniff". Blocks attacks where uploaded text files are executed as scripts. |
| X-Frame-Options | X-Frame-Options Indicates whether a browser should be allowed to render a page in a <frame>, <iframe>, or <object>. DENY (or SAMEORIGIN) | ●X-Frame-Options ↳HTTP header ↳security response header ↳clickjacking prevention | RFC 7034 §2 Defends against Clickjacking attacks; superseded by CSP frame-ancestors directive. |
| Cache-Control | Cache-Control Specifies caching directives for both requests and responses along the client-CDN-server path. public, max-age=31536000, immutable | ●Cache-Control ↳HTTP header ↳caching directive ↳freshness and revalidation policy | RFC 9111 §5.2 Use "no-store" for sensitive authenticated endpoints; "max-age=31536000, immutable" for hashed assets. |
| ETag | ETag (Entity Tag) An opaque identifier assigned by a web server to a specific version of a resource. W/"33a64df551425fcc55e4d42a148795d9f25f89d4" | ●ETag ↳HTTP header ↳caching validator ↳fingerprint token | RFC 9110 §8.8.3 Allows clients to make conditional requests with If-None-Match to receive 304 Not Modified. |
| Authorization | Authorization Contains the credentials to authenticate a user agent with the server. Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9... | ●Authorization ↳HTTP header ↳request credential ↳bearer token or basic auth | RFC 9110 §11.6.2 Triggers CORS preflight checks when dispatched from browser JavaScript cross-origin. |
| Access-Control-Allow-Origin | Access-Control-Allow-Origin Indicates whether the response can be shared with requesting code from the given origin. https://app.example.com | ●Access-Control-Allow-Origin ↳HTTP header ↳CORS permission ↳cross-origin permission | W3C Fetch Spec Wildcard "*" cannot be used if Access-Control-Allow-Credentials is true. |
| Content-Type | Content-Type Indicates the original media type (MIME type) of the resource before any encoding. application/json; charset=utf-8 | ●Content-Type ↳HTTP header ↳payload metadata ↳MIME format specification | RFC 9110 §8.3 Tells the recipient parser how to decode the raw bytes of the message body. |
Hardened Production Nginx Security Headers Snippet
# Recommended OWASP Baseline Security Headers
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none';" always;Applying these headers at the reverse proxy ensures all downstream web responses are protected by default.
Reference Standards Q&A
Are HTTP header names case-sensitive?↓
What happens if a response sends duplicate headers?↓
References & Primary Sources
Every source below directly substantiates technical statements and protocol behaviors explained in HTTP Headers Reference. Curious-Techie prioritizes official Internet standards (IETF RFCs, W3C Recommendations, WHATWG specifications) and established security bodies (OWASP, NIST). Zero sponsored or secondary links.
- [1]IETFPrimary SpecificationRFC 9110 • Core ArchitectureVerified Primary SourceTechnical Claim Supported:
Foundational specification for the stateless client-server request-response architecture, standard status codes (1xx–5xx), and method safety and idempotency.
Source URI: https://datatracker.ietf.org/doc/html/rfc9110 - [2]IETFPrimary SpecificationRFC 9112 • Section 3 & 6Verified Primary SourceTechnical Claim Supported:
Defines ASCII wire protocol framing, chunked transfer encoding, and persistent connection Keep-Alive mechanics.
Source URI: https://datatracker.ietf.org/doc/html/rfc9112 - [3]IETFPrimary SpecificationRFC 9113 • Section 4 & 5Verified Primary SourceTechnical Claim Supported:
Standardizes binary framing, HPACK header compression, and bi-directional stream multiplexing over a single shared TCP connection.
Source URI: https://datatracker.ietf.org/doc/html/rfc9113 - [4]IETFPrimary SpecificationRFC 9114 • Section 3 & 4Verified Primary SourceTechnical Claim Supported:
Eliminates TCP head-of-line blocking by mapping HTTP streams directly over QUIC UDP transport connections with integrated TLS 1.3 encryption.
Source URI: https://datatracker.ietf.org/doc/html/rfc9114
Related Technical Ecosystem & Next Steps
Related Technical Articles
What Is HTTP (Hypertext Transfer Protocol)?
Foundational stateless request-response protocol of the World Wide Web.
HTTP/1.1 vs HTTP/2: Multiplexing & Performance
Head-of-line blocking compared to binary framing and stream multiplexing.
Troubleshooting: HTTP 403 Forbidden Error
Diagnose server authorization denial, WAF IP blocks, and permission issues.
Related Questions
Why Is POST Non-Idempotent While PUT Is Idempotent?
Answer: PUT replaces or creates a specific resource deterministically, while POST processes input according to server logic, typically creating new items on repeated requests.
What Is the Difference Between ETag and Last-Modified?
Answer: Last-Modified relies on 1-second filesystem timestamps, while ETag provides an exact cryptographic digest of content, eliminating false positive cache misses.
Can HTTP/2 Multiplex Requests Over a Single TCP Connection?
Answer: Yes, HTTP/2 breaks requests into binary frames with stream IDs, allowing interleaved requests and responses concurrently over one TCP socket.
Hands-On Diagnostic Labs
Continue Learning
HTTP Protocol & Header Inspection Lab
Craft raw HTTP headers and observe conditional 304 responses in the interactive workbench.