How to read HTTP headers
Every HTTP message — both the request a client sends and the response a server returns — is made up of a start line, a set of headers and an optional body. The headers are name: value pairs of metadata that describe the message: what format the body is in, how long it is, how it may be cached, who is making the request, and much more. They are how a browser, API client and server negotiate the details of a transfer without putting that information in the body.
Headers fall into two main roles. Request headers are sent by the client to describe the request or the client itself — for example Accept (which media types it can handle), Authorization (credentials), Cookie and User-Agent. Response headers are sent by the server to describe the response or the server — for example Content-Type, Content-Length, Set-Cookie, ETag and security headers like Strict-Transport-Security. A few headers, most notably Cache-Control, are valid on both sides. The reference below lists common headers in each group with a one-line meaning and an example value.
Content-Type: application/json; charset=utf-8 and Cache-Control: max-age=3600. The first tells the browser to parse the body as UTF-8 JSON; the second says the response may be reused from cache for one hour before it must be revalidated.Frequently asked questions
- What are HTTP headers?
- HTTP headers are key-value pairs of metadata sent with every HTTP request and response. They carry information about the message — such as content type, length, caching rules, cookies and authentication — without being part of the body. The client sends request headers and the server sends response headers.
- What is the Content-Type header?
- Content-Type tells the recipient the media type of the body, for example text/html, application/json or image/png, and can include a charset such as text/html; charset=utf-8. Browsers use it to decide how to parse and display the response.
- What is the Cache-Control header?
- Cache-Control sets caching rules for both requests and responses using directives such as max-age, no-cache, no-store and public or private. For example Cache-Control: max-age=3600 lets a response be cached for one hour, while no-store forbids storing it at all.
- What is CORS and the Access-Control-Allow-Origin header?
- CORS (Cross-Origin Resource Sharing) lets a server allow browsers to read its responses from a different origin. The Access-Control-Allow-Origin response header names the permitted origin — a specific origin or * for any. Without it the browser blocks the cross-origin read.
- What is the difference between request and response headers?
- Request headers are sent by the client to describe the request or the client — such as Accept, User-Agent, Authorization and Cookie. Response headers are sent by the server — such as Content-Type, Set-Cookie, ETag and Server. Some headers, like Cache-Control, appear in both.
- What is the User-Agent header?
- User-Agent is a request header that identifies the client software — typically the browser or app name, version and operating system. Servers use it for analytics, compatibility decisions and bot detection, though the string can be spoofed.