Difference between revisions of "HTTP headers"
Jump to navigation
Jump to search
↑ https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
| (7 intermediate revisions by the same user not shown) | |||
| Line 1: | Line 1: | ||
| − | [[wikipedia:HTTP headers]] | + | [[wikipedia:HTTP headers]] https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers |
* <code>[[WWW-Authenticate]]</code> | * <code>[[WWW-Authenticate]]</code> | ||
* <code>[[HTTP Header: Authorization|Authorization:]]</code> | * <code>[[HTTP Header: Authorization|Authorization:]]</code> | ||
| − | * <code>[[Content-Security-Policy]]</code><ref>https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy</ref> | + | * <code>[[Content-Security-Policy]]:</code><ref>https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy</ref> <code>[[frame-ancestors]] ['none' | 'self' | https://trusted.example.com ]</code> |
* <code>[[X-Frame-Options]]</code> (deprecated): https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options | * <code>[[X-Frame-Options]]</code> (deprecated): https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options | ||
| Line 15: | Line 15: | ||
* <code>[[Cache-Control]]: [[no-cache]], [[no-store]], [[max-age]]</code> | * <code>[[Cache-Control]]: [[no-cache]], [[no-store]], [[max-age]]</code> | ||
* [[X-Forwarded-For (XFF)]] | * [[X-Forwarded-For (XFF)]] | ||
| + | * <code>[[Sec-Fetch-Mode]]</code> | ||
| + | * <code>[[if-none-match]]</code> | ||
| Line 28: | Line 30: | ||
* [[HTTP Security headers]] | * [[HTTP Security headers]] | ||
* <code>[[has been blocked by CORS policy]] no '[[access-control-allow-origin]]' header is present on the request</code> | * <code>[[has been blocked by CORS policy]] no '[[access-control-allow-origin]]' header is present on the request</code> | ||
| − | * [[Request Header Fields]] | + | * [[Request Header Fields]]: https://www.rfc-editor.org/rfc/rfc2616#section-5.3 |
== Activities == | == Activities == | ||
Latest revision as of 12:21, 6 May 2026
wikipedia:HTTP headers https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers
WWW-AuthenticateAuthorization:Content-Security-Policy:[1]frame-ancestors ['none' | 'self' | https://trusted.example.com ]X-Frame-Options(deprecated): https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
strict-Transport-Security- Content-Security-Policy
- X-Frame-Options
- X-Content-Type-Options
- Referrer-Policy
- Permissions-Policy
Cache-Control: no-cache, no-store, max-age- X-Forwarded-For (XFF)
Sec-Fetch-Modeif-none-match
Activities[edit]
- Use Terraform aws lb: drop_invalid_header_fields to drop not valid headers
Related terms[edit]
aws s3 cp --cache-control- Clickjacking
- Bearer token:
Authorization: Bearer .../... curl --header- Python,
urlliblibrary - HTTP Security headers
has been blocked by CORS policy no 'access-control-allow-origin' header is present on the request- Request Header Fields: https://www.rfc-editor.org/rfc/rfc2616#section-5.3
Activities[edit]
- Read about Amazon CloudFront: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/example-function-add-security-headers.html
- Cloudflare: https://developers.cloudflare.com/pages/how-to/add-custom-http-headers/
See also[edit]
- X-Forwarded-For (XFF), HTTP/1.1: Request Header Fields
- HTTP headers, Security headers, HTTP Security headers, X-Forwarded-For (XFF),
if-none-match - HTTP Headers:
Authorization:, X-Frame-Options, Content-Security-Policy, Cache-Control, Terraform:drop_invalid_header_fields
Advertising:
