HTTP
Guides
Resources and URIs
HTTP guide
HTTP security
HTTP access control (CORS)
HTTP authentication
HTTP caching
HTTP compression
HTTP conditional requests
HTTP content negotiation
HTTP cookies
HTTP range requests
HTTP redirects
HTTP specifications
Permissions Policy
References
HTTP headers
1. Accept
2. Accept-CH
3. Accept-CH-Lifetime 非標準已棄用
4. Accept-Charset
5. Accept-Encoding
6. Accept-Language
7. Accept-Patch
8. Accept-Post
9. Accept-Ranges
10. Access-Control-Allow-Credentials
11. Access-Control-Allow-Headers
12. Access-Control-Allow-Methods
13. Access-Control-Allow-Origin
14. Access-Control-Expose-Headers
15. Access-Control-Max-Age
16. Access-Control-Request-Headers
17. Access-Control-Request-Method
18. Age
19. Allow
20. Alt-Svc
21. Authorization
22. Cache-Control
23. Clear-Site-Data
24. Connection
25. Content-Disposition
26. Content-DPR 非標準已棄用
27. Content-Encoding
28. Content-Language
29. Content-Length
30. Content-Location
31. Content-Range
32. Content-Security-Policy
33. Content-Security-Policy-Report-Only
34. Content-Type
35. Cookie
36. Critical-CH 實驗性質
37. Cross-Origin-Embedder-Policy
38. Cross-Origin-Opener-Policy
39. Cross-Origin-Resource-Policy
40. Date
41. Device-Memory 實驗性質
42. Digest
43. DNT 已棄用
44. Downlink 實驗性質
45. DPR 非標準已棄用
46. Early-Data 實驗性質
47. ECT 實驗性質
48. ETag
49. Expect
50. Expect-CT
51. Expires
52. Forwarded
53. From
54. Host
55. If-Match
56. If-Modified-Since
57. If-None-Match
58. If-Range
59. If-Unmodified-Since
60. Keep-Alive
61. Large-Allocation 非標準已棄用
62. Last-Modified
63. Link
64. Location
65. Max-Forwards
66. NEL 實驗性質
67. Origin
68. Permissions-Policy
69. Pragma 已棄用
70. Proxy-Authenticate
71. Proxy-Authorization
72. Range
73. Referer
74. Referrer-Policy
75. Retry-After
76. RTT 實驗性質
77. Save-Data 實驗性質
78. Sec-CH-Prefers-Reduced-Motion 實驗性質
79. Sec-CH-UA 實驗性質
80. Sec-CH-UA-Arch 實驗性質
81. Sec-CH-UA-Bitness 實驗性質
82. Sec-CH-UA-Full-Version 已棄用
83. Sec-CH-UA-Full-Version-List 實驗性質
84. Sec-CH-UA-Mobile 實驗性質
85. Sec-CH-UA-Model 實驗性質
86. Sec-CH-UA-Platform 實驗性質
87. Sec-CH-UA-Platform-Version 實驗性質
88. Sec-Fetch-Dest
89. Sec-Fetch-Mode
90. Sec-Fetch-Site
91. Sec-Fetch-User
92. Sec-GPC 實驗性質
93. Sec-WebSocket-Accept
94. Server
95. Server-Timing
96. Service-Worker-Navigation-Preload
97. Set-Cookie
98. SourceMap
99. Strict-Transport-Security
100. TE
101. Timing-Allow-Origin
102. Tk 已棄用
103. Trailer
104. Transfer-Encoding
105. Upgrade
106. Upgrade-Insecure-Requests
107. User-Agent
108. Vary
109. Via
110. Viewport-Width 非標準已棄用
111. Want-Digest
112. Warning 已棄用
113. Width 非標準已棄用
114. WWW-Authenticate
115. X-Content-Type-Options
116. X-DNS-Prefetch-Control 非標準
117. X-Forwarded-For 非標準
118. X-Forwarded-Host 非標準
119. X-Forwarded-Proto 非標準
120. X-Frame-Options
121. X-XSS-Protection 非標準
HTTP request methods
HTTP response status codes
CSP directives
1. CSP source values
2. CSP: base-uri
3. CSP: block-all-mixed-content 已棄用
4. CSP: child-src
5. CSP: connect-src
6. CSP: default-src
7. CSP: font-src
8. CSP: form-action
9. CSP: frame-ancestors
10. CSP: frame-src
11. CSP: img-src
12. CSP: manifest-src
13. CSP: media-src
14. CSP: object-src
15. CSP: plugin-types 非標準已棄用
16. CSP: prefetch-src 非標準已棄用
17. CSP: referrer 非標準已棄用
18. CSP: report-to
19. CSP: report-uri 已棄用
20. CSP: require-trusted-types-for 實驗性質
21. CSP: sandbox
22. CSP: script-src
23. CSP: script-src-attr
24. CSP: script-src-elem
25. CSP: style-src
26. CSP: style-src-attr
27. CSP: style-src-elem
28. CSP: trusted-types 實驗性質
29. CSP: upgrade-insecure-requests
30. CSP: worker-src
CORS errors
1. Reason: CORS disabled
2. Reason: CORS header 'Access-Control-Allow-Origin' does not match 'xyz'
3. Reason: CORS header 'Access-Control-Allow-Origin' missing
4. Reason: CORS header 'Origin' cannot be added
5. Reason: CORS preflight channel did not succeed
6. Reason: CORS request did not succeed
7. Reason: CORS request external redirect not allowed
8. Reason: CORS request not HTTP
9. Reason: Credential is not supported if the CORS header 'Access-Control-Allow-Origin' is '*'
10. Reason: Did not find method in CORS header 'Access-Control-Allow-Methods'
11. Reason: expected 'true' in CORS header 'Access-Control-Allow-Credentials'
12. Reason: invalid token 'xyz' in CORS header 'Access-Control-Allow-Headers'
13. Reason: invalid token 'xyz' in CORS header 'Access-Control-Allow-Methods'
14. Reason: missing token 'xyz' in CORS header 'Access-Control-Allow-Headers' from CORS preflight channel
15. Reason: Multiple CORS header 'Access-Control-Allow-Origin' not allowed
Permissions-Policy directives

狀態

規範

參見