What is the fastest way to debug an unfamiliar header?
Figure out three things first: who sent it, whether it changes browser behavior or server behavior, and which decision it affects: caching, auth, redirects, cookies, or security policy.
Reference
HTTP Headers
Use this when you can see a header name in logs, DevTools, or curl, but need to know whether it explains the behavior you are seeing.
Caching and validation
Freshness, validators, and conditional requests.
- Cache-ControlGeneralCache-Control directives explained: max-age, no-cache vs no-store, s-maxage, stale-while-revalidate, immutable, with nginx, Cloudflare and Next.js examples.
- ETagResponseETag identifies a resource version for cache validation and optimistic locking. Strong vs weak ETags, If-None-Match, If-Match, and why nginx gzip weakens them.
- ExpiresResponseLearn how the Expires header specifies when cached responses become stale. Understand date formats and when to use Expires vs Cache-Control for caching.
- Last-ModifiedResponseLearn how the Last-Modified header indicates when a resource was last changed. Enable efficient cache validation with If-Modified-Since conditional requests.
- AgeResponseLearn how the Age header indicates how long a response has been cached in seconds. Understand cache freshness calculations and CDN behavior.
- VaryResponseVary lists the request headers a response depends on, so caches keep separate copies. Vary: Accept-Encoding, Vary: Origin for CORS, Vary: *, and CDN cache keys.
- If-MatchRequestLearn how the If-Match header makes requests conditional based on ETag matching. Prevent conflicts and lost updates in concurrent editing scenarios.
- If-None-MatchRequestLearn how the If-None-Match header makes conditional requests using ETags. Avoid downloading unchanged resources and reduce bandwidth with cache validation.
- If-Modified-SinceRequestLearn how the If-Modified-Since header requests resources only if modified since a specific date. Reduce bandwidth with efficient conditional caching.
- If-Unmodified-SinceRequestLearn how the If-Unmodified-Since header makes requests conditional on resources not being modified. Prevent conflicts in concurrent update scenarios.
- If-RangeRequestLearn how the If-Range header requests partial content only if the resource is unchanged. Efficiently resume downloads without re-fetching entire files.
- X-CacheResponseLearn how the X-Cache header indicates cache hit or miss status from CDNs and proxies. Debug caching issues and verify CDN configuration with this header.
- WarningResponseLearn about the deprecated Warning header that provided additional status information about message transformations. Understand why it was removed from HTTP.
Content and negotiation
What the body is and what the client can accept.
- Content-TypeEntityContent-Type tells the receiver what the body is: application/json, text/html; charset=utf-8, multipart/form-data. Common values, examples and 415 fixes.
- Content-LengthResponseLearn how Content-Length specifies the body size in bytes. Essential for progress indicators, connection management, and chunked transfer decisions.
- Content-EncodingResponseLearn how Content-Encoding specifies compression algorithms (gzip, br, deflate) used to encode response bodies. Reduce bandwidth and improve load times.
- Content-LanguageResponseLearn how the Content-Language header specifies the natural language(s) of response content. Understand language tags and internationalization best practices.
- Content-DispositionResponseLearn how the Content-Disposition header controls whether content displays inline or downloads as an attachment. Set custom filenames for file downloads.
- Content-LocationResponseLearn how Content-Location indicates an alternate URL for returned content. Useful for content negotiation and identifying canonical resource locations.
- AcceptRequestLearn how the Accept header tells servers which content types (JSON, HTML, XML) your client can handle. Master content negotiation and quality values.
- Accept-EncodingRequestLearn how Accept-Encoding tells servers which compression formats (gzip, br, deflate) your client supports to reduce bandwidth and speed up page loads.
- Accept-LanguageRequestLearn how the Accept-Language header tells servers which languages your client prefers for localized content. Understand language tags and quality values.
- LinkResponseLearn how the Link header provides resource hints and enables preloading of CSS, fonts, and scripts to improve page load performance and user experience.
CORS
Cross-origin resource sharing and preflight.
- OriginRequestLearn how the Origin header identifies where cross-origin requests come from. Essential for CORS security policies and preventing cross-site request forgery.
- Access-Control-Allow-OriginResponseAccess-Control-Allow-Origin explained: exact browser errors, why * fails with credentials, why you need Vary: Origin, and fixes for nginx, Express and Django.
- Access-Control-Allow-CredentialsResponseLearn how Access-Control-Allow-Credentials controls whether browsers expose responses when credentials (cookies, auth headers) are included in CORS requests.
- Access-Control-Allow-HeadersResponseLearn how Access-Control-Allow-Headers specifies which custom HTTP headers can be used during cross-origin requests in CORS preflight responses.
- Access-Control-Allow-MethodsResponseLearn how Access-Control-Allow-Methods specifies which HTTP methods are permitted for cross-origin requests in CORS preflight responses.
- Access-Control-Max-AgeResponseLearn how Access-Control-Max-Age specifies how long browsers can cache CORS preflight results. Reduce preflight requests and improve cross-origin performance.
- Access-Control-Request-HeadersRequestLearn how Access-Control-Request-Headers tells servers which custom headers will be used in CORS requests. Essential for preflight request handling.
- Access-Control-Request-MethodRequestLearn how Access-Control-Request-Method tells servers which HTTP method will be used in the actual CORS request. Essential for preflight request handling.
- Timing-Allow-OriginResponseLearn how the Timing-Allow-Origin header specifies which origins can access Resource Timing API data. Enable cross-origin performance monitoring securely.
- Access-Control-Expose-HeadersResponseFix response.headers.get() returning null on cross-origin fetch. Access-Control-Expose-Headers, safelisted headers, and why * fails with credentials.
Security and policy
Browser-enforced protections and isolation.
- Content-Security-PolicyResponseContent-Security-Policy (CSP) limits what a page may load or run. Directives, nonces, strict-dynamic, Report-Only rollout, console errors, helmet and Next.js.
- Strict-Transport-SecurityResponseStrict-Transport-Security (HSTS) forces HTTPS for a set time. max-age, includeSubDomains, preload rules, nginx and Apache config, and how to roll it back.
- X-Content-Type-OptionsResponseLearn how X-Content-Type-Options with nosniff prevents browsers from MIME-sniffing responses. Protect against XSS attacks from content type confusion.
- X-Frame-OptionsResponseLearn how X-Frame-Options prevents clickjacking attacks by controlling whether your site can be embedded in frames, iframes, or objects on other domains.
- X-XSS-ProtectionResponseDeprecated header that enabled browser XSS filters to detect and block reflected cross-site scripting attacks.
- Referrer-PolicyResponseLearn how Referrer-Policy controls how much referrer information is sent with requests. Protect user privacy while maintaining analytics functionality.
- Permissions-PolicyResponseLearn how the Permissions-Policy header controls which browser features and APIs can be used in your site and embedded iframes. Enhance security and privacy.
- Cross-Origin-Embedder-PolicyResponseLearn how Cross-Origin-Embedder-Policy (COEP) controls cross-origin resource loading. Required for SharedArrayBuffer and high-resolution timer access.
- Cross-Origin-Opener-PolicyResponseLearn how Cross-Origin-Opener-Policy (COOP) isolates your browsing context from cross-origin documents. Required for SharedArrayBuffer and enhanced security.
- Cross-Origin-Resource-PolicyResponseLearn how Cross-Origin-Resource-Policy (CORP) blocks no-cors cross-origin requests to protect resources from Spectre attacks and data leaks.
- RefererRequestReferer tells a server which page a request came from. What browsers send under the default strict-origin-when-cross-origin policy, and how to trim it.
- Sec-Fetch-SiteRequestSec-Fetch-Site says whether a request is same-origin, same-site, cross-site or user-initiated. Resource isolation policy for Express and nginx, plus CSRF use.
- Sec-Fetch-ModeRequestSec-Fetch-Mode reports the request mode: navigate, cors, no-cors, same-origin or websocket. What sets each value and how servers use it.
- Sec-Fetch-DestRequestSec-Fetch-Dest tells the server where a response will be used: document, iframe, image, script, empty. Full value list and server-side uses.
- Sec-Fetch-UserRequestSec-Fetch-User is always ?1 and appears only on user-activated navigations, like a link click. When it is absent and why Safari does not send it.
- Clear-Site-DataResponseClear-Site-Data tells the browser to delete cookies, storage and cache on logout. Directives, quoting rules, HTTPS-only limits, browser gaps, Express and nginx.
- Content-Security-Policy-Report-OnlyResponseContent-Security-Policy-Report-Only tests a policy without blocking. Rollout steps, report-uri vs report-to, sample violation JSON, and cutting noise.
- Reporting-EndpointsResponseReporting-Endpoints names the URLs where browsers send CSP, COOP, deprecation and crash reports. Syntax, the default endpoint, and replacing Report-To.
Authentication
Credentials and challenges.
- AuthorizationAuthorization header carries credentials as scheme plus token. Bearer and Basic formats, WWW-Authenticate, why proxies strip it, redirects, CORS and storage.
- WWW-AuthenticateResponseLearn how the WWW-Authenticate header specifies authentication methods required to access protected resources. Understand Basic, Bearer, and Digest schemes.
- Proxy-AuthorizationRequestLearn how Proxy-Authorization provides credentials to access resources through a proxy server. Understand proxy authentication schemes and security.
- Proxy-AuthenticateResponseLearn how the Proxy-Authenticate header challenges clients for credentials when accessing resources through a proxy. Understand proxy authentication schemes.
- Authentication-InfoResponseLearn how Authentication-Info provides additional authentication data in responses to successful requests. Covers digest authentication and session info.
Connection and proxies
Hop-by-hop behavior, forwarding, and upgrades.
- HostRequestLearn how the Host header specifies the target server domain name and port for HTTP requests. Essential for virtual hosting and routing on shared servers.
- ConnectionReq + ResLearn how the Connection header controls whether HTTP connections stay open (keep-alive) or close after each request. Optimize with persistent connections.
- Keep-AliveGeneralLearn how the Keep-Alive header controls HTTP connection persistence and reuse. Reduce latency and improve performance by avoiding repeated TCP handshakes.
- UpgradeGeneralLearn how the Upgrade header requests protocol upgrades to WebSocket, HTTP/2, or other protocols on the same TCP connection. Understand upgrade negotiation.
- Transfer-EncodingResponseLearn how the Transfer-Encoding header specifies encoding formats like chunked transfer for streaming responses when content length is unknown beforehand.
- ViaGeneralLearn how the Via header tracks the path of HTTP requests through proxies and gateways. Debug routing issues and understand your network infrastructure.
- ForwardedRequestLearn how the Forwarded header preserves original client information (IP, protocol, host) that would otherwise be lost when requests pass through proxies.
- X-Forwarded-ForRequestX-Forwarded-For carries the client IP through proxies and load balancers, but clients can forge it. Trust it safely in nginx, Express, Cloudflare and AWS.
- X-Forwarded-ProtoRequestLearn how the X-Forwarded-Proto header identifies the original protocol (HTTP/HTTPS) used by clients connecting through proxies or load balancers.
- Sec-WebSocket-KeyRequestLearn how the Sec-WebSocket-Key header provides a random key for WebSocket handshake validation. Understand the upgrade process and security implications.
- Sec-WebSocket-AcceptResponseLearn how the Sec-WebSocket-Accept header indicates server acceptance of a WebSocket connection upgrade. Understand the handshake process and key validation.
- Alt-SvcResponseAlt-Svc advertises an alternative protocol for an origin. How h3=":443"; ma=86400 moves browsers to HTTP/3, what clear does, and how HTTPS DNS records differ.
- ExpectRequestExpect: 100-continue asks the server to approve a request before the body is sent. Why curl adds it past 1 MB, the 1s delay, -H "Expect:", and 417.
Ranges and redirects
Partial content and navigation.
- RangeRequestLearn how the Range header requests partial content from servers to enable resumable downloads, video streaming, and efficient large file transfers.
- Accept-RangesResponseLearn how the Accept-Ranges header tells clients whether your server supports partial content requests (byte ranges) for efficient downloads and streaming.
- Content-RangeResponseLearn how the Content-Range header indicates which portion of a resource is being sent in partial content (206) responses for range requests and streaming.
- LocationResponseLearn how the Location header specifies redirect URLs or the location of newly created resources. Essential for 201, 301, 302, and other redirect responses.
- RefreshResponseLearn how the Refresh header instructs browsers to reload or redirect after a delay. Understand its use cases, limitations, and better alternatives.
- Retry-AfterResponseLearn how the Retry-After header tells clients how long to wait before retrying a request. Understand its use with 503, 429, and 301 status codes.
- Early-HintsResponseLearn how 103 Early Hints allows servers to send preload hints while preparing the main response. Improve page load performance with early resource loading.
Diagnostics and rate limits
Identification, timing, and throttling.
- User-AgentRequestLearn how the User-Agent header identifies the client software, browser, or application making HTTP requests. Understand user agent strings and best practices.
- DateResponseLearn how the Date header specifies when the HTTP message was originated by the server. Understand date formats and its role in caching and logging.
- Server-TimingResponseLearn how the Server-Timing header communicates server-side performance metrics to browsers. Analyze backend timing, database queries, and optimize performance.
- Performance-TimingResponseThere is no Performance-Timing HTTP header. Use Server-Timing, Timing-Allow-Origin, the Navigation and Resource Timing APIs, TTFB and INP instead.
- X-Response-TimeResponseLearn how the X-Response-Time header indicates server processing time in milliseconds. Useful for performance monitoring and debugging slow requests.
- X-RateLimitResponseLearn how X-RateLimit headers inform API clients about rate limits, remaining requests, and reset times. Implement proper rate limiting in your applications.
- ServerResponseThe Server header names the software that answered. Use it to find which layer replied, and hide version numbers in nginx, Apache and Cloudflare, with limits.
- X-Powered-ByResponseX-Powered-By advertises your framework, such as Express or PHP. Remove it in Express, PHP, Next.js, ASP.NET and nginx, and why it is hygiene, not security.
- X-Request-IDRequestX-Request-ID tags one request so you can find it in every log. nginx $request_id, Heroku behavior, propagation between services, and traceparent.
- traceparentRequestThe traceparent header carries trace id, parent span id and flags across services. Exact format, tracestate limits, OpenTelemetry, and privacy rules.
Other
Headers that do not fit the groups above.
- Idempotency-KeyRequestIdempotency-Key lets clients retry POST and PATCH without duplicating work. The IETF draft, Stripe behavior, and how to design the server side.
- X-Robots-TagResponseX-Robots-Tag sends noindex and snippet rules as an HTTP header for PDFs, images and staging sites. nginx, Apache and Cloudflare config, and the robots.txt trap.
No headers match this filter.
What HTTP Headers Tell You
If you are staring at a response in DevTools or `curl`, headers are often the fastest explanation for what happened. They tell you what the client asked for, what the server decided, and which intermediaries changed the rules along the way.
- Request headers
- These explain what the client wants or already knows, like accepted formats, cached versions, auth credentials, or origin context.
- Response headers
- These explain the server decision: content type, cache policy, redirect target, cookie instructions, or a challenge the client must answer.
- General and hop-by-hop headers
- Some fields are really about the trip, not the resource. They show up most often when proxies, gateways, and connection behavior are involved.
- Policy headers
- Headers like CSP, HSTS, and Permissions-Policy are not passive metadata. Browsers enforce them, and small mistakes have visible consequences.
Fast Ways To Narrow The Problem
When you do not know the header name yet, start from the behavior you are trying to explain.
- For caching bugs, start with Cache-Control, ETag, Expires, Vary, and Last-Modified.
- For auth or CORS bugs, look at Authorization, WWW-Authenticate, Origin, and the Access-Control-* fields together.
- For browser security behavior, check CSP, HSTS, Referrer-Policy, Permissions-Policy, and cookie-related headers in one pass.
Questions From Debugging Sessions
Which headers should I check first for a caching problem?
Usually Cache-Control, ETag, Expires, Last-Modified, Age, and Vary. Those six explain most “why did I get stale or uncached content?” investigations.
Do proxies and CDNs change how headers behave?
Yes. Proxies and CDNs can add, strip, normalize, or reinterpret headers, especially around forwarding, compression, caching, and security controls.