TopolearnAlmost every HTTP feature, from caching to auth to CORS, is switched on by a header.
Headers are Name: value metadata lines on requests and responses. Names are case-insensitive (HTTP/2 and 3 send them lowercase), and unknown headers are ignored, which is how the protocol extends.
Common request headers:
Host: which site.User-Agent: what client is calling.Accept,Accept-Language,Accept-Encoding: what representations the client prefers, for content negotiation.Accept-Encoding: gzip, br, zstdlets the server compress.Authorization: credentials.Cookie: stored cookies.Content-TypeandContent-Length: describe a request body.If-None-Match,If-Modified-Since: conditional requests for caching.Referer(sic): the page that linked here;Origin: the origin making a cross-site request.
Common response headers:
Content-Type,Content-Length,Content-Encoding(e.g.br).Cache-Control,ETag,Last-Modified,Varyfor caching.Locationfor redirects and created resources;Set-Cookie.Retry-Afterwith 429 or 503.
Custom headers once used an X- prefix (X-Request-Id). That convention is deprecated for new headers, but plenty of X- names live on.
Header values have practical limits: servers and proxies typically cap total header size at around 8 to 16 KB, so huge cookies or tokens can trigger 431 Request Header Fields Too Large. Inspect headers with curl -I (HEAD) or curl -v, or in the devtools Network panel.
Example
$ curl -sI https://shop.example.com/ -H "Accept-Language: de" -H "Accept-Encoding: br, gzip"
# sample response (abridged)
HTTP/2 200
content-type: text/html; charset=utf-8
content-encoding: br
content-language: de
cache-control: no-cache
vary: Accept-Encoding, Accept-Language
etag: "5f2c-9a1"
# Send a custom request header and print only one response header
$ curl -s -o /dev/null -D - https://example.com -H "X-Request-Id: abc123" | grep -i content-type
content-type: text/htmlRemember
- Header names are case-insensitive; HTTP/2+ uses lowercase
- Accept-* headers drive content negotiation
- Caching, auth, cookies, CORS and redirects are all header-driven
- Oversized headers cause 431 errors
Watch out for
- Assuming a header's capitalisation matters when looking it up in code.