HTTP header domain list and explanation: Response

Access-control-allow-OriginCross-origin Resource Sharing (CORS) (see "same-origin policy" and "cross-origin source sharing"). For example: access-control-allow-origin: http://example.com: 8080 http://foo.example.com, or access-control-allow-origin :*

Accept-ranges: Indicates that the server does not support resource range requests ("resource range requests" refer to requests for a certain segment of data of a resource in bytes, for example, requests for 200byte-400byte data of a file ). Accept-ranges: bytes indicates that the resource supports byte type resource range requests, and accept-ranges: None indicates not.

Age: The time when a resource is cached in the proxy. The Unit is seconds.

Allow: HTTP methods allowed by a resource, for example, allow: Get, head

Cache-control(Cache-control is a header domain with many contents. I will introduce it in the next blog)

Connection: Connection mode. Values include keep-alive and close.

Content-Encoding: The server's encoding method for response data, but the encoding method here is different from the encoding character set (gb2312, UTF-8, etc.), but (usually) refers to the compression method, such as content-encoding: Gzip

Content-language: The natural language of the response data, for example: Content-language: ZH-CN

Content-Length: The Data Length of the response data. The unit is byte, for example, Content-Length: 1024.

Content-location:( I don't know what it means)

Content-MD5: Base64 encoded response data MD5 checksum, for example: Content-MD5: q2hly2sgsw50zwdyaxr5iq =

Content-Disposition: When the requested resource from the client is a downloadable resource (here, "downloadable" refers to the download box or download interface popped up in the browser, the description of the downloadable resource (for example, the file name in the download box) is from this header field. For example, content-Disposition: attachment; filename = "some_app.exe"

Content-Range: Indicates the specific part (from the first byte to the first byte) when the current response data is part of the entire resource ). In the request, the client can set the "range" header to notify the server that it only wants to request a certain part of data in the entire resource. In contrast, when the server responds to this request, when sending a piece of data to the client, you must use the content-range header to tell the client that the current response data is the nth byte to the nth byte of the entire resource. This is useful for multipart download and resumable download of resources. Example: Content-range: 500-900

Content-Type: MIME type of the response data, for example, Content-Type: text/html; charset = UTF-8

Date: The date in GMT format sent in response to the message, for example, Date: Tue, 15 Nov 1994 08:12:31 GMT

Etag(Abbreviation of entity-tag) an identifier of a resource, similar to the key in key-value pair. Etag is usually used to verify whether a resource entity has been modified. It is useful when data caching and put methods are used to update resources. Example: etag: "737060cd8c284d8af7ad3082f209582d"

Expires: Tells the client that the response data will expire at the specified time, which is usually used as a reference for the client cache. Example: expires: Thu, 01 Dec 1994 16:00:00 GMT

Last-modified: The last modification time of the resource requested by the client.

Link: Describes the relationship between the requested resource and another resource. This relationship is defined in rfc5988. Example: Link: </feed>; rel = "alternate"

Location: The user notifies the client to jump (redirect) to another URL (that is, the effect of the response. Redirect () method in Asp.net ). Example: Location: http://www.w3.org/pub/WWW/People.html

P3p: The abbreviation of platform for privacy preferences project, indicating that the site complies with the p3p Protocol (the site is not illegally used by the site) and wants to collect user information. However, p3p is currently not widely used, and p3p is not widely used in China. The value format of p3p is: p3p: Cp = "your_compact_policy ".

Pragma: Some parameters near the request/response chain. This header field contains a lot of content. I will introduce it in the next blog.

Proxy-Authenticate: The authentication method used to access the proxy. Example: proxy-Authenticate: Basic

Refresh: Enables the client to jump to another URL after specified n seconds. Example: Refresh: 6, http://www.google.com.hk 6 seconds later jump to Google

Retry-after: Used to notify the client to retry the request after the specified time for some reason (for example, the resource is temporarily invalid), in seconds. For example, retry-after: 60 minutes and then try again to request the resource.

Server: Name of the server. For example, server: Apache/2.4.1 (UNIX)

Set-Cookie: Set cookie for the client. Example: set-COOKIE: userid = johndoe; max-age = 3600; version = 1

Strict-transport-Security: Indicates how the client caches HTTPS (how long the cache takes) and whether the cache takes effect for the subdomain. Example: strict-transport-security: Max-age = 16070400; includesubdomains

Trailer: When the response resource has been chunked encoded (please google the chunked encoding) for transmission, additional data at the end of each chunked-body.

Transfer-Encoding: The Transmission Encoding Method of the response content, such as chunked, deflate, and gzip.

Vary: Indicates the condition by which the cache proxy (such as squid) caches a request. Possible vary values include: vary: Accept-encoding, User-Agent vary: X-some-custom-header, host vary :*

Via: Tell the client that the response goes through the proxies. For example, via: 1.0 example1.com, 1.1 example2.com (Apache/1.1)

WWW-Authenticate: Indicates the authentication method used to access a resource. Example: www-Authenticate: Base

Common non-standard HTTP header fields:

X-XSS-protection: Enable or disable Cross-Site Scripting in IE8 +. For example: X-XSS-protection: 1; mode = block See: http://blogs.msdn.com/ B /ieinternals/archive/2011/01/31/controlling-the-internet-explorer-xss-filter-with-the-x-xss-protection-http-header.aspx

X-Content-Type-Options: A non-standard header field in IE and chrome, with only one value: nosniff. Generally, the Content-Type header field is included in the header field of the response to a request to describe the content MIME type, but some content does not provide its MIME type. In this case, the browser can test the content by itself.
The content type, and X-Content-Type-options: nosniff is used to disable the automatic sniffing function.

X-powered-: What technology is used to develop the current site (or resource), for example, X-powered-by: ASP. NET. There are also X-runtime, X-version, and X-ASPnet-version.