api: YAML JSON TOON Database
version: 1.0.0
format: toon
dataset:
  id: 2819
  slug: http-response-headers
  title: HTTP Response Headers
  description: Common HTTP response headers and their purposes.
  summary: "Common HTTP response headers with a description and an example value: Content-Type, Content-Length, Cache-Control, Set-Cookie, ETag, Location and CORS headers, plus the security headers HSTS, CSP, X-Content-Type-Options, Referrer-Policy and Permissions-Policy."
  use_when[2]: You need the meaning and format of a response header.,You are hardening a site with security headers.
  caveats[2]: Security headers need testing; for example a Content-Security-Policy can break inline scripts and third-party widgets.,Headers can be modified or added by proxies and CDNs between the server and the client.
  related[4]: http-request-headers,http-caching-guide,http-cors-guide,common-vulnerabilities-owasp
  entry_count: 22
  fields[3]{section,field,type,example}:
    data,header,string,Content-Type
    data,description,string,Media type of the response body.
    data,example,string,application/json; charset=utf-8
  category: Web Technologies
  category_slug: web-technologies
  tags: "web,http,headers,response,api"
  view_count: 39
  created_at: 1793403093
  updated_at: 1793403093
data[22]{header,description,example}:
  Content-Type,Media type of the response body.,application/json; charset=utf-8
  Content-Length,Size of the response body in bytes.,"2048"
  Content-Encoding,Encoding applied to the body.,"gzip, br"
  Cache-Control,Caching directives for the response.,"public, max-age=86400"
  Set-Cookie,Sends a cookie to the client.,session=abc123; HttpOnly; Secure
  ETag,Identifier for a specific version of the resource.,"\"33a64df5\""
  Last-Modified,Date and time the resource was last modified.,"Wed, 21 Oct 2026 07:28:00 GMT"
  Location,URL to redirect to.,"https://api.example.com/users/42"
  WWW-Authenticate,Authentication method required.,"Bearer realm=\"api\""
  Access-Control-Allow-Origin,Allowed origins for CORS.,"https://example.com"
  X-RateLimit-Remaining,Remaining requests in the current window.,"47"
  Retry-After,Seconds to wait before retrying after 429.,"300"
  Strict-Transport-Security,"Tells browsers to use HTTPS only for the site for a period, preventing protocol downgrade.",max-age=31536000; includeSubDomains
  Content-Security-Policy,"Restricts which sources scripts, styles and other resources may load from, limiting injection attacks.","default-src 'self'; img-src https:"
  X-Content-Type-Options,"Stops browsers from guessing content types, reducing MIME-sniffing attacks.",nosniff
  Referrer-Policy,Controls how much referrer information is sent with requests.,strict-origin-when-cross-origin
  Permissions-Policy,Enables or disables browser features such as camera or geolocation for the page and embedded frames.,"geolocation=(), camera=()"
  Vary,"Lists request headers that change the response, so caches store separate variants.","Accept-Encoding, Accept-Language"
  Content-Disposition,"Suggests whether to display content inline or download it, and the filename.","attachment; filename=\"report.csv\""
  Alt-Svc,"Advertises alternative endpoints or protocols, such as HTTP/3, for the same origin.","h3=\":443\"; ma=86400"
  Age,The time in seconds the response has been in a shared cache.,"120"
  Link,"Provides related resources, such as preload hints, relations and pagination links.",</style.css>; rel=preload; as=style