📋 HTTP Header 速查表
请求头(Request Header)和响应头(Response Header)对照表。覆盖Content-Type、Authorization、CORS、Cache-Control等。支持搜索。
📤 请求头 (Request Headers)
| Header | 说明 | 示例 |
|---|---|---|
| Accept | 客户端能接受的内容类型 | Accept: text/html, application/json |
| Accept-Encoding | 支持的压缩编码 | Accept-Encoding: gzip, deflate, br |
| Accept-Language | 偏好语言 | Accept-Language: zh-CN, en;q=0.9 |
| Authorization | 认证凭证 | Authorization: Bearer eyJhbGc... |
| Cache-Control | 缓存策略 | Cache-Control: no-cache |
| Cookie | Cookie数据 | Cookie: sessionId=abc123 |
| Content-Type | 请求体类型 | Content-Type: application/json |
| Content-Length | 请求体大小 | Content-Length: 1024 |
| Host | 目标主机 | Host: www.example.com |
| Origin | 请求来源(跨域) | Origin: https://example.com |
| Referer | 来源页面URL | Referer: https://example.com/page |
| User-Agent | 客户端信息 | User-Agent: Mozilla/5.0 ... |
| X-Requested-With | AJAX标识 | X-Requested-With: XMLHttpRequest |
| If-Modified-Since | 条件请求(缓存) | If-Modified-Since: Wed, 21 Oct 2025 07:28:00 GMT |
| If-None-Match | 条件请求(ETag) | If-None-Match: "abc123" |
📥 响应头 (Response Headers)
| Header | 说明 | 示例 |
|---|---|---|
| Access-Control-Allow-Origin | 允许跨域的来源 | Access-Control-Allow-Origin: * |
| Access-Control-Allow-Methods | 允许的HTTP方法 | Access-Control-Allow-Methods: GET, POST, PUT |
| Access-Control-Allow-Headers | 允许的请求头 | Access-Control-Allow-Headers: Content-Type |
| Cache-Control | 缓存策略 | Cache-Control: max-age=3600 |
| Content-Disposition | 文件下载 | Content-Disposition: attachment; filename="file.pdf" |
| Content-Encoding | 压缩编码 | Content-Encoding: gzip |
| Content-Type | 响应体类型 | Content-Type: application/json; charset=utf-8 |
| ETag | 资源版本标识 | ETag: "abc123" |
| Expires | 过期时间 | Expires: Wed, 21 Oct 2026 07:28:00 GMT |
| Last-Modified | 最后修改时间 | Last-Modified: Wed, 21 Oct 2025 07:28:00 GMT |
| Location | 重定向URL | Location: https://example.com/new |
| Server | 服务器信息 | Server: nginx/1.18.0 |
| Set-Cookie | 设置Cookie | Set-Cookie: sessionId=abc123; HttpOnly; Secure |
| Strict-Transport-Security | HSTS强制HTTPS | Strict-Transport-Security: max-age=31536000 |
| X-Content-Type-Options | 阻止MIME嗅探 | X-Content-Type-Options: nosniff |
| X-Frame-Options | 阻止点击劫持 | X-Frame-Options: DENY |
| X-XSS-Protection | XSS过滤 | X-XSS-Protection: 1; mode=block |
Content-Type常见值
text/html — HTML网页 | application/json — JSON数据 | application/x-www-form-urlencoded — 表单提交 | multipart/form-data — 文件上传 | text/plain — 纯文本 | application/xml — XML数据
CORS跨域相关Header
浏览器跨域请求时，服务器需要返回 Access-Control-Allow-Origin 头才能让浏览器接受响应。常见值：*（允许所有来源）、https://example.com（指定来源）。带Cookie的跨域需要 Access-Control-Allow-Credentials: true 且不能用*。
