api: YAML JSON TOON Database
version: 1.0.0
format: json
dataset:
  slug: http-response-headers
  title: HTTP Response Headers
  description: Common HTTP response headers and their purposes.
  summary: "Common HTTP response headers with a description and an example value: Content-Type, Content-Length, Cache-Control, Set-Cookie, ETag, Location and CORS headers, plus the security headers HSTS, CSP, X-Content-Type-Options, Referrer-Policy and Permissions-Policy."
  use_when:
    - You need the meaning and format of a response header.
    - You are hardening a site with security headers.
  caveats:
    - Security headers need testing; for example a Content-Security-Policy can break inline scripts and third-party widgets.
    - Headers can be modified or added by proxies and CDNs between the server and the client.
  related:
    - http-request-headers
    - http-caching-guide
    - http-cors-guide
    - common-vulnerabilities-owasp
  category: Web Technologies
  category_slug: web-technologies
  tags: web,http,headers,response,api
  view_count: 0
  entry_count: 22
  fields:
    - section: data
      field: header
      type: string
      example: Content-Type
    - section: data
      field: description
      type: string
      example: Media type of the response body.
    - section: data
      field: example
      type: string
      example: application/json; charset=utf-8
data:
  - header: Content-Type
    description: Media type of the response body.
    example: application/json; charset=utf-8
  - header: Content-Length
    description: Size of the response body in bytes.
    example: "2048"
  - header: Content-Encoding
    description: Encoding applied to the body.
    example: gzip, br
  - header: Cache-Control
    description: Caching directives for the response.
    example: public, max-age=86400
  - header: Set-Cookie
    description: Sends a cookie to the client.
    example: session=abc123; HttpOnly; Secure
  - header: ETag
    description: Identifier for a specific version of the resource.
    example: "\"33a64df5\""
  - header: Last-Modified
    description: Date and time the resource was last modified.
    example: "Wed, 21 Oct 2026 07:28:00 GMT"
  - header: Location
    description: URL to redirect to.
    example: "https://api.example.com/users/42"
  - header: WWW-Authenticate
    description: Authentication method required.
    example: "Bearer realm=\"api\""
  - header: Access-Control-Allow-Origin
    description: Allowed origins for CORS.
    example: "https://example.com"
  - header: X-RateLimit-Remaining
    description: Remaining requests in the current window.
    example: "47"
  - header: Retry-After
    description: Seconds to wait before retrying after 429.
    example: "300"
  - header: Strict-Transport-Security
    description: Tells browsers to use HTTPS only for the site for a period, preventing protocol downgrade.
    example: max-age=31536000; includeSubDomains
  - header: Content-Security-Policy
    description: Restricts which sources scripts, styles and other resources may load from, limiting injection attacks.
    example: "default-src 'self'; img-src https:"
  - header: X-Content-Type-Options
    description: Stops browsers from guessing content types, reducing MIME-sniffing attacks.
    example: nosniff
  - header: Referrer-Policy
    description: Controls how much referrer information is sent with requests.
    example: strict-origin-when-cross-origin
  - header: Permissions-Policy
    description: Enables or disables browser features such as camera or geolocation for the page and embedded frames.
    example: geolocation=(), camera=()
  - header: Vary
    description: Lists request headers that change the response, so caches store separate variants.
    example: Accept-Encoding, Accept-Language
  - header: Content-Disposition
    description: Suggests whether to display content inline or download it, and the filename.
    example: "attachment; filename=\"report.csv\""
  - header: Alt-Svc
    description: Advertises alternative endpoints or protocols, such as HTTP/3, for the same origin.
    example: "h3=\":443\"; ma=86400"
  - header: Age
    description: The time in seconds the response has been in a shared cache.
    example: "120"
  - header: Link
    description: Provides related resources, such as preload hints, relations and pagination links.
    example: </style.css>; rel=preload; as=style