HTTP
Guides
Resources and URIs
HTTP guide
HTTP security
HTTP access control (CORS)
HTTP authentication
HTTP caching
HTTP compression
HTTP conditional requests
HTTP content negotiation
HTTP cookies
HTTP range requests
HTTP redirects
HTTP specifications
Permissions Policy
References
HTTP headers
1. Accept
2. Accept-CH
3. Accept-CH-Lifetime 非標準已棄用
4. Accept-Charset
5. Accept-Encoding
6. Accept-Language
7. Accept-Patch
8. Accept-Post
9. Accept-Ranges
10. Access-Control-Allow-Credentials
11. Access-Control-Allow-Headers
12. Access-Control-Allow-Methods
13. Access-Control-Allow-Origin
14. Access-Control-Expose-Headers
15. Access-Control-Max-Age
16. Access-Control-Request-Headers
17. Access-Control-Request-Method
18. Age
19. Allow
20. Alt-Svc
21. Alt-Used
22. Authorization
23. Cache-Control
24. Clear-Site-Data
25. Connection
26. Content-Disposition
27. Content-DPR 非標準已棄用
28. Content-Encoding
29. Content-Language
30. Content-Length
31. Content-Location
32. Content-Range
33. Content-Security-Policy
34. Content-Security-Policy-Report-Only
35. Content-Type
36. Cookie
37. Critical-CH 實驗性質
38. Cross-Origin-Embedder-Policy
39. Cross-Origin-Opener-Policy
40. Cross-Origin-Resource-Policy
41. Date
42. Device-Memory 實驗性質
43. Digest 已棄用
44. DNT 已棄用
45. Downlink 實驗性質
46. DPR 非標準已棄用
47. Early-Data 實驗性質
48. ECT 實驗性質
49. ETag
50. Expect
51. Expect-CT
52. Expires
53. Forwarded
54. From
55. Host
56. If-Match
57. If-Modified-Since
58. If-None-Match
59. If-Range
60. If-Unmodified-Since
61. Keep-Alive
62. Large-Allocation 非標準已棄用
63. Last-Modified
64. Link
65. Location
66. Max-Forwards
67. NEL 實驗性質
68. Origin
69. Permissions-Policy
70. Pragma 已棄用
71. Proxy-Authenticate
72. Proxy-Authorization
73. Range
74. Referer
75. Referrer-Policy
76. Retry-After
77. RTT 實驗性質
78. Save-Data 實驗性質
79. Sec-CH-Prefers-Color-Scheme 實驗性質
80. Sec-CH-Prefers-Reduced-Motion 實驗性質
81. Sec-CH-Prefers-Reduced-Transparency 實驗性質
82. Sec-CH-UA 實驗性質
83. Sec-CH-UA-Arch 實驗性質
84. Sec-CH-UA-Bitness 實驗性質
85. Sec-CH-UA-Full-Version 已棄用
86. Sec-CH-UA-Full-Version-List 實驗性質
87. Sec-CH-UA-Mobile 實驗性質
88. Sec-CH-UA-Model 實驗性質
89. Sec-CH-UA-Platform 實驗性質
90. Sec-CH-UA-Platform-Version 實驗性質
91. Sec-Fetch-Dest
92. Sec-Fetch-Mode
93. Sec-Fetch-Site
94. Sec-Fetch-User
95. Sec-GPC 實驗性質
96. Sec-Purpose
97. Sec-WebSocket-Accept
98. Server
99. Server-Timing
100. Service-Worker-Navigation-Preload
101. Set-Cookie
102. SourceMap
103. Strict-Transport-Security
104. TE
105. Timing-Allow-Origin
106. Tk 已棄用
107. Trailer
108. Transfer-Encoding
109. Upgrade
110. Upgrade-Insecure-Requests
111. User-Agent
112. Vary
113. Via
114. Viewport-Width 非標準已棄用
115. Want-Digest 已棄用
116. Warning 已棄用
117. Width 非標準已棄用
118. WWW-Authenticate
119. X-Content-Type-Options
120. X-DNS-Prefetch-Control 非標準
121. X-Forwarded-For 非標準
122. X-Forwarded-Host 非標準
123. X-Forwarded-Proto 非標準
124. X-Frame-Options
125. X-XSS-Protection 非標準
HTTP request methods
HTTP response status codes
CSP directives
1. CSP source values
2. CSP: base-uri
3. CSP: block-all-mixed-content 已棄用
4. CSP: child-src
5. CSP: connect-src
6. CSP: default-src
7. CSP: font-src
8. CSP: form-action
9. CSP: frame-ancestors
10. CSP: frame-src
11. CSP: img-src
12. CSP: manifest-src
13. CSP: media-src
14. CSP: object-src
15. CSP: plugin-types 非標準已棄用
16. CSP: prefetch-src 非標準已棄用
17. CSP: referrer 非標準已棄用
18. CSP: report-to
19. CSP: report-uri 已棄用
20. CSP: require-trusted-types-for 實驗性質
21. CSP: sandbox
22. CSP: script-src
23. CSP: script-src-attr
24. CSP: script-src-elem
25. CSP: style-src
26. CSP: style-src-attr
27. CSP: style-src-elem
28. CSP: trusted-types 實驗性質
29. CSP: upgrade-insecure-requests
30. CSP: worker-src
CORS errors
1. Reason: CORS disabled
2. Reason: CORS header 'Access-Control-Allow-Origin' does not match 'xyz'
3. Reason: CORS header 'Access-Control-Allow-Origin' missing
4. Reason: CORS header 'Origin' cannot be added
5. Reason: CORS preflight channel did not succeed
6. Reason: CORS request did not succeed
7. Reason: CORS request external redirect not allowed
8. Reason: CORS request not HTTP
9. Reason: Credential is not supported if the CORS header 'Access-Control-Allow-Origin' is '*'
10. Reason: Did not find method in CORS header 'Access-Control-Allow-Methods'
11. Reason: expected 'true' in CORS header 'Access-Control-Allow-Credentials'
12. Reason: invalid token 'xyz' in CORS header 'Access-Control-Allow-Headers'
13. Reason: invalid token 'xyz' in CORS header 'Access-Control-Allow-Methods'
14. Reason: missing token 'xyz' in CORS header 'Access-Control-Allow-Headers' from CORS preflight channel
15. Reason: Multiple CORS header 'Access-Control-Allow-Origin' not allowed
Permissions-Policy directives

狀態

規範

參見