01
Validated header syntax
Reject invalid names, multiline values, malformed custom rows, and invalid CORS origins before copying.
Start typing to search 139 tools.
API Key GeneratorGeneratorGenerate secure API keys with configurable length, prefix, quantity, and URL-safe, hexadecimal, Base32, or alphanumeric formats.→Alternating Case ConverterTextConvert ordinary text into alternating uppercase and lowercase letters while preserving spaces, punctuation, numbers, and line breaks.→BCrypt Hash GeneratorGeneratorUse this free BCrypt Hash Generator to create a salted password hash with a configurable cost and copy it for secure password-storage testing.→BCrypt VerifyValidatorVerify a plain-text password against a BCrypt hash safely, understand match results, and troubleshoot invalid hash formats without attempting to decode the hash.→Base64 DecoderEncode DecodeDecode Base64 into readable Unicode text for debugging, data recovery, API checks, configuration review, and development work→Base64 EncoderEncode DecodeEncode Unicode text as Base64 for data transport, API payloads, configuration values, testing, and development tasks→CRC32 GeneratorGeneratorGenerate CRC32 checksums from exact text in hexadecimal and decimal formats for compatibility checks, fixtures, archives, and data-transfer testing.→CSP Policy BuilderGeneratorBuild a Content Security Policy header with source directives, reporting, nonce and security options.→CSS BeautifierDeveloperUse CSS Beautifier to format compressed or inconsistent CSS online with readable indentation, line breaks, declarations, selectors, comments, and nested blocks.→CSS MinifierDeveloperMinify CSS by removing unnecessary spaces and comments for smaller stylesheets, cleaner delivery, and deployment workflows→CSV FormatterTableNormalize CSV rows, delimiters, quoting, whitespace, and column structure into consistent downloadable output.→CSV MergerTableCombine compatible CSV datasets into one file while checking headers, delimiters, and record structure.→CSV SplitterTableSplit a large CSV dataset into smaller files by row count while preserving the header and record structure.→CSV ValidatorValidatorValidate CSV structure, detect inconsistent rows, and identify quoting or delimiter problems before import.→CSV ViewerTableOpen CSV data in a clear table, inspect rows and columns, and review structured records before using them elsewhere.→CSV to JSON: Best Free Online ConverterDeveloperCSV to JSON converts CSV rows into structured JSON for APIs, imports, scripts, testing, and migration. Review headers, values, quoting, and the final result before copying the output.→Case ConverterTextConvert text to camelCase, PascalCase, snake_case and more.→Certificate DecoderEncode DecodeDecode X.509 PEM certificates and inspect subject, issuer, validity, fingerprints, SAN entries, signature algorithm, and key usage.→Character CounterTextMeasure characters with and without spaces, plus words and lines, for social posts, forms, metadata, and editing→Checksum CalculatorEncode DecodeCalculate CRC32, MD5, SHA-1, SHA-256, SHA-384, or SHA-512 checksums from exact text and compare deterministic outputs across systems.→Collapse SpacesTextCollapse repeated horizontal spaces into one space while preserving line breaks, paragraph structure, and the order of your text.→Comma List to LinesTextConvert comma-separated values into one trimmed item per line, omit empty entries, and prepare a clean vertical list for spreadsheets or imports.→Cron Expression BuilderGeneratorBuild and validate five-field cron expressions with presets and human-readable explanations.→Duplicate Paragraph RemoverTextRemove repeated paragraphs while preserving order.→Email ExtractorTextFind email addresses in authorized pasted text, remove repeated matches, and return a clean copyable list in first-seen order.→Emoji RemoverTextRemove emoji symbols and related joiner characters from text while preserving surrounding words, punctuation, spacing, and line structure.→Find and ReplaceTextReplace every exact occurrence of a chosen text value while keeping the source available for comparison.→GraphQL FormatterDeveloperGraphQL Formatter turns compressed GraphQL queries, mutations, fragments, and variables into readable structured output for faster review, debugging, and team collaboration.→GraphQL MinifierDeveloperGraphQL Minifier removes unnecessary whitespace and comments from GraphQL queries while preserving operations, fragments, variables, directives, and string values.→HMAC GeneratorGeneratorGenerate keyed HMAC digests from a message and secret using SHA-256, SHA-384, or SHA-512, with clear hexadecimal output for testing integrations.→HTML BeautifierDeveloperFormat compact or inconsistent HTML with readable indentation, line breaks, nested elements, comments, and document structure.→HTML DecoderEncode DecodeDecode HTML entities into readable characters for content cleanup, debugging, migration, and template review→HTML EncoderEncode DecodeEncode reserved HTML characters into entities for safe display in examples, documentation, templates, and web content→HTML MinifierDeveloperMinify HTML by removing unnecessary whitespace and comments for smaller markup, faster transfer, and deployment preparation→HTML Tag RemoverDeveloperRemove HTML tags from markup while keeping readable text for cleanup, migration, extraction, and content preparation→HTTP Header BuilderGeneratorBuild validated HTTP request and response header blocks for APIs, security, caching, CORS, and content negotiation.→HTTP Status Code LookupNetworkLook up an HTTP response code and understand its official class, common meaning, and practical debugging context.→Hash GeneratorGeneratorUse this free Hash Generator to create MD5, SHA-1, SHA-256, and SHA-512 hashes from text, verify exact input, and copy results online.→Hashtag ExtractorTextExtract unique hashtags from captions, notes, and campaign text in their original first-seen order.→JSON CompareCompareCompare two JSON documents online, validate their syntax, normalize formatting, and highlight added, removed, changed, and unchanged lines.→JSON Diff ViewerCompareCompare two JSON documents online, validate their syntax, normalize formatting, and inspect added, removed, or changed values in a clear diff.→JSON EscapeEncode DecodeEscape quotes, backslashes, line breaks, tabs and Unicode-safe text for use inside JSON string values, API payloads and configuration files.→JSON FormatterDeveloperFormat and indent JSON so objects, arrays, keys, and values are easier to inspect, debug, validate, and share→JSON MergeConverterMerge 2 JSON documents online with recursive object merging, selectable conflict priority and replace, append or unique array strategies.→JSON MinifierDeveloperMinify formatted JSON into a compact single-line representation for APIs, storage, testing, and data transfer.→JSON Schema GeneratorGeneratorGenerate a JSON Schema from sample JSON online. Choose Draft 4, 6, 7, 2019-09 or 2020-12, infer nested types and detect common string formats.→JSON Schema ValidatorValidatorJSON Schema Validator checks JSON against a schema, reports exact validation paths, and helps you review required fields, types, formats, arrays, and nested objects online.→JSON SorterDeveloperUse this free JSON Sorter to alphabetize object keys recursively while preserving values, nested structures, and array order online.→JSON UnescapeEncode DecodeDecode JSON escape sequences such as escaped quotes, backslashes, newlines, tabs and Unicode sequences into readable text.→JSON ValidatorValidatorValidate JSON syntax and identify parsing errors before using data in an API, application, import, or configuration.→JSON ViewerDeveloperView JSON online as a readable tree, pretty-printed document, or flattened JSON path list with value types and depth controls.→JSON to CSVConverterConvert a JSON array of objects into CSV rows for spreadsheets, reports, imports, and structured-data review.→JSON to YAMLConverterConvert JSON data to readable YAML.→JWT DecoderEncode DecodeDecode JWT header and payload data for inspection without verifying the token signature or authenticity.→JWT GeneratorGeneratorCreate signed HS256 JSON Web Tokens.→JavaScript BeautifierDeveloperUse JavaScript Beautifier to format compact JavaScript online with readable indentation, braces, statements, operators, comments, strings, and template literals.→JavaScript MinifierDeveloperUse JavaScript Minifier to remove comments and unnecessary whitespace from JavaScript online while preserving strings, template literals, identifiers, and operators.→Line CounterTextCount total, non-empty, and blank lines in text, code, lists, logs, and documents with a clear browser workflow→Lines to Comma ListTextJoin non-empty trimmed lines into one comma-separated list while preserving the original item order.→Lowercase ConverterTextConvert cased letters to lowercase while preserving punctuation, spaces, and line breaks.→MD5 GeneratorGeneratorUse this free MD5 Generator to generate a MD5 hash from exact text, verify whitespace and encoding, and copy a clean hexadecimal digest online.→Markdown PreviewTextRender common Markdown syntax as safe HTML so structure and formatting can be reviewed before publishing.→Markdown to HTMLConverterConvert common Markdown syntax into HTML for previews, documentation, articles, notes, and lightweight publishing workflows.→Mention ExtractorTextExtract unique @mentions from authorized text and preserve the order in which accounts first appear.→Number ExtractorTextExtract signed integers and decimal values from mixed text while preserving their original order.→OpenAPI GeneratorGeneratorGenerate an OpenAPI 3.1 document from endpoint settings and JSON request or response samples.→OpenAPI ValidatorValidatorOpenAPI Validator reviews OpenAPI documents for structural and reference problems, helping teams detect invalid paths, operations, schemas, parameters, and responses online.→PEM FormatterEncode DecodeFormat PEM certificates and keys, validate matching boundary labels, and wrap Base64 content into standard 64-character lines.→Paragraph CounterTextCount non-empty text paragraphs separated by one or more blank lines.→Password Generator AdvancedGeneratorGenerate strong random passwords with custom length, character sets, exclusions, quantity controls, and secure browser-friendly output.→Password Strength CheckerValidatorCheck password strength using length, character variety, repetition, sequences, and common-pattern signals while keeping the result easy to understand.→Phone Number ExtractorTextExtract likely phone numbers from mixed text while preserving their original appearance and order.→Prefix LinesTextAdd the same prefix to every following line while preserving line order and line breaks.→Query String ParserNetworkParse a complete URL or raw query string into structured, readable JSON without changing the original input.→Quote LinesTextWrap every source line in quotation marks while preserving line order and line breaks.→RSA Key GeneratorGeneratorGenerate RSA public and private key pairs in PEM format with selectable key sizes and optional passphrase protection.→Random Password GeneratorGeneratorGenerate strong random passwords with a chosen length for accounts, test data, temporary credentials, and security-focused workflows.→Reading Time CalculatorCalculatorEstimate how long a text takes to read from its word count using a clear words-per-minute model.→Regex BuilderGeneratorBuild practical regular expressions from common matching requirements.→Regex ExtractorDeveloperExtract all regex matches and capture groups from text.→Regex ReplaceDeveloperReplace regex matches with text or capture-group references.→Regex Tester PRODeveloperTest regular expressions with detailed matches, named groups, offsets, line and column positions, execution timing, and highlighted previews.→Remove All SpacesTextRemove every whitespace character, including spaces, tabs, and line breaks, to create one uninterrupted string.→Remove Duplicate LinesTextKeep the first occurrence of each exact line, remove later duplicates, and preserve the original line order.→Remove Duplicate WordsTextRemove repeated words case-insensitively while keeping each first spelling and the original first-seen order.→Remove Empty LinesTextDelete blank and whitespace-only lines while preserving every populated line in its original order.→Remove Line NumbersTextStrip common leading line-number formats while leaving the remaining line content intact. Use it on copied transcripts, numbered exports, documentation and code samples.→Remove NumbersTextRemove numeric digits from text while keeping letters, punctuation, spacing, and line order available for review.→Remove PunctuationTextRemove punctuation characters from text while preserving words, numbers, spaces, and line order for review.→Remove TabsTextRemove tab characters from text while keeping the remaining content and line structure visible for comparison.→Remove WordTextremove word with a focused browser utility that targets the entered term while keeping the original source visible for careful comparison.→Reverse LinesTextreverse lines with a focused browser tool that changes only the order of complete lines while keeping every word, number, symbol, and punctuation mark inside each line unchanged.→Reverse TextTextreverse text with a browser utility that returns characters in the opposite order while keeping the original source visible for direct comparison.→Reverse WordsTextreverse words with a focused tool that changes the order of word tokens while keeping the characters inside each individual word readable.→SHA1 GeneratorGeneratorUse this free SHA1 Generator to generate a SHA-1 hash from exact text, verify whitespace and encoding, and copy a clean hexadecimal digest online.→SHA256 GeneratorGeneratorUse this free SHA256 Generator to generate a SHA-256 hash from exact text, verify whitespace and encoding, and copy a clean hexadecimal digest online.→SHA512 GeneratorGeneratorUse this free SHA512 Generator to generate a SHA-512 hash from exact text, verify whitespace and encoding, and copy a clean hexadecimal digest online.→SQL BeautifierDeveloperFormat SQL queries with readable clauses, indentation, line breaks, joins, conditions, grouping, and ordering.→SQL FormatterDeveloperFormat SQL statements with clearer indentation and line breaks for review, debugging, documentation, and database development.→SQL MinifierDeveloperCompress SQL queries by removing comments and unnecessary whitespace while keeping statements easy to copy and deploy.→SSH Key GeneratorGeneratorGenerate an RSA SSH public and private key pair with selectable strength, OpenSSH public-key output, and a SHA-256 fingerprint.→Secure Random GeneratorGeneratorGenerate cryptographically secure random bytes, strings, URL-safe values, and integers for development and security workflows.→Sentence Case ConverterTextThis sentence case converter changes irregular capitalization into a sentence-style pattern while keeping the original text available for comparison.→Sentence CounterTextUse this sentence counter to estimate the number of sentence units in articles, essays, notes, product descriptions, and other text.→Shuffle LinesTextShuffle lines into a random order while keeping every line available for review in a separate result.→Slug Generator: Best Free Online ToolTextSlug Generator creates a clean, lowercase, hyphenated URL slug from any title or phrase. Use this free online tool to review an SEO-friendly result before publishing or changing a permalink.→Sort LinesTextSort lines in ascending alphabetical or natural order while preserving the original source for comparison.→Sort Lines DescendingTextSort lines from Z to A or from higher to lower natural values with a separate result for verification.→Suffix LinesTextAdd the same suffix to every line while keeping the original list visible for careful comparison.→Tabs to SpacesTextReplace tab characters with a consistent number of spaces for code, plain text, logs, tables, and formatting cleanup→Text Diff CheckerCompareCompare two text versions line by line and identify additions, removals, and unchanged content.→Text RepeaterTextRepeat text a chosen number of times with predictable separators for testing, templates, sample data, and content preparation→Text StatisticsTextMeasure words, characters, sentences, paragraphs, lines, and estimated reading time in one document overview.→Timestamp ConverterConverterConvert Unix timestamps and date-time values.→Title Case ConverterTextConvert headings and titles into consistent title case for articles, pages, product names, documents, and publishing workflows→Token GeneratorGeneratorGenerate secure session, CSRF, URL-safe, hexadecimal, and Base64 tokens from cryptographically secure random bytes.→Trim WhitespaceTextRemove unwanted spaces around every line without changing the meaningful text inside each line.→URL DecoderEncode DecodeDecode percent-encoded URLs and query values into readable text for debugging, analysis, testing, and content review→URL EncoderEncode DecodeEncode text and reserved characters for query strings, links, redirects, API requests, and safe URL handling→URL ExtractorTextExtract web addresses from text, HTML, logs, exports, and documents for audits, migration, outreach, and review→URL ParserNetworkUse this free URL Parser to split any absolute link into scheme, host, port, path, query parameters, and fragment online.→UUID DecoderEncode DecodeDecode a UUID into version, variant, hexadecimal fields, node data, clock sequence, and timestamp information when the version supports it.→UUID GeneratorGeneratorGenerate random UUID version 4 identifiers for development, databases, fixtures, APIs, testing, and content-management workflows.→UUID ValidatorValidatorValidate UUID syntax online, identify versions 1 through 8, confirm the RFC variant, and understand why an identifier is invalid.→Unique Word FinderTextFind distinct words, repeated terms, and vocabulary patterns in text for editing, research, SEO, and content analysis→Uppercase ConverterTextConvert letters to uppercase instantly while preserving punctuation, numbers, spacing, and line order.→Word CounterTextCount words, characters, sentences, and paragraphs in text for writing, editing, SEO, study, and content planning→Word Frequency CounterTextCount how often every word appears, rank repeated terms, and inspect vocabulary balance in any pasted text.→Words to LinesTextPlace words or separated values on individual lines for lists, imports, cleanup, deduplication, and data preparation→XML CompareCompareCompare two XML documents online, validate their structure, normalize indentation, and review changed elements, attributes, text nodes, and line positions.→XML Formatter: 7 Amazing Proven TipsDeveloperFormat and indent XML for easier inspection, debugging, configuration review, data exchange, and development workflows→XML Validator: 7 Amazing Proven TipsValidatorValidate XML structure and syntax to find malformed tags, broken nesting, and parsing problems before import or deployment→XML to CSVConverterConvert repeated XML records into CSV rows for spreadsheets, imports, reporting, and data review.→XML to JSONConverterConvert XML elements, attributes, text values, and repeated nodes into readable structured JSON online.→YAML CompareCompareYAML Compare helps you compare two YAML documents, detect added, removed, changed, and type-mismatched values, and review differences with a clear online workflow.→YAML FormatterDeveloperFormat and indent YAML data.→YAML ValidatorValidatorValidate YAML syntax and structure.→YAML to JSONConverterConvert YAML data to formatted JSON.→cURL BuilderGeneratorBuild secure cURL commands for HTTP requests with methods, headers, query parameters, authentication, and request bodies.→
Generator
Ready
HTTP Header Builder
Build validated HTTP request and response header blocks for APIs, security, caching, CORS, and content negotiation.
Request and response header modes Accept and Content-Type configuration Bearer and Basic Authorization generation Cache-Control presets
Do not publish real authorization tokens, API keys, cookies, or session identifiers. Review CORS and caching rules before production deployment.
INPUT Custom headers
Generated HTTP headers
Validated request or response header block ready to copy.
About the tool
What HTTP Header Builder does
HTTP Header Builder is a powerful online HTTP header builder for developers who need clean, validated request or response headers without repeatedly typing common fields. It can generate content negotiation headers, authorization values, cache rules, CORS settings, and browser-focused security headers while keeping the final block readable and ready to copy.
The HTTP Header Builder supports both sides of an HTTP exchange. Request headers describe what a client sends or accepts, while response headers tell the client how to interpret, cache, or protect returned content. The tool validates header names, blocks line breaks inside values, checks CORS origins, replaces duplicate names case-insensitively, and sorts the final output for easier review.
Use this builder for API documentation, curl commands, JavaScript fetch requests, backend integrations, reverse-proxy configuration, debugging, and test fixtures. Never paste production tokens, session cookies, or private credentials into screenshots or shared systems.
How to use
- Select the header type. Choose request mode for client headers or response mode for server headers.
- Set content negotiation. Configure Accept and Content-Type values that match the data format.
- Add authentication carefully. Choose Bearer or Basic only when needed and avoid exposing real secrets.
- Choose caching and CORS rules. Use restrictive defaults unless your application requires public caching or cross-origin access.
- Add custom headers. Enter one Header-Name: value pair per line.
- Generate and test. Copy the output into the target environment and confirm actual behavior with browser or API diagnostics.
Built for the task
Why use HTTP Header Builder?
Focused controls, predictable output, and a workflow designed around this exact transformation.
02
Security-aware defaults
Generate restrictive caching and optional response security headers while keeping credentials visible for review.
03
API-ready output
Copy a clean Header-Name: value block into API clients, source code, documentation, or configuration.
04
Duplicate handling
Custom headers replace earlier duplicates case-insensitively instead of creating conflicting output.
Useful answers
Questions about HTTP Header Builder
Practical details about input, output, privacy, limits, and the best way to use this tool.
Answer 01
What is an HTTP Header Builder?
An HTTP Header Builder creates formatted HTTP request or response header lines from selected settings. It reduces syntax mistakes and helps developers review authentication, content type, caching, CORS, and security rules together.
Answer 02
What is the difference between request and response headers?
Request headers are sent by a client to a server. Response headers are returned by the server and describe the response, caching rules, security policies, or cross-origin permissions.
Answer 03
What does the Accept header mean?
Accept tells the server which media types the client can process, such as application/json. It does not describe the format of a request body; Content-Type handles that purpose.
Answer 04
What does Content-Type mean?
Content-Type describes the media type and optional character encoding of the current message body, for example application/json; charset=utf-8.
Answer 05
Can the builder generate a Bearer token header?
Yes. Choose Bearer authorization and enter the token. The output uses Authorization: Bearer followed by the supplied value. Do not expose production tokens publicly.
Answer 06
How is Basic authorization generated?
Enter username:password. The builder Base64-encodes that value and creates an Authorization: Basic header. Base64 is encoding, not encryption, so HTTPS is still required.
Answer 07
Should Access-Control-Allow-Origin be set to an asterisk?
Only when any origin may access the resource and credentials are not required. Sensitive applications should usually specify trusted origins and enforce CORS on the server.
Answer 08
Which response security headers are added?
The recommended preset adds X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, and X-Frame-Options: SAMEORIGIN. A complete security policy may require CSP, HSTS, Permissions-Policy, and application-specific rules.
Answer 09
Does this tool send a network request?
No. It builds a header block only. Test the result separately with your API client, browser developer tools, server logs, or integration tests.
Answer 10
Can custom headers override generated values?
Yes. A custom line with the same header name replaces the earlier value case-insensitively, which makes deliberate overrides possible without duplicate output.
What is an HTTP Header Builder?
An HTTP Header Builder creates formatted HTTP request or response header lines from selected settings. It reduces syntax mistakes and helps developers review authentication, content type, caching, CORS, and security rules together.
What is the difference between request and response headers?
Request headers are sent by a client to a server. Response headers are returned by the server and describe the response, caching rules, security policies, or cross-origin permissions.
What does the Accept header mean?
Accept tells the server which media types the client can process, such as application/json. It does not describe the format of a request body; Content-Type handles that purpose.
What does Content-Type mean?
Content-Type describes the media type and optional character encoding of the current message body, for example application/json; charset=utf-8.
Can the builder generate a Bearer token header?
Yes. Choose Bearer authorization and enter the token. The output uses Authorization: Bearer followed by the supplied value. Do not expose production tokens publicly.
How is Basic authorization generated?
Enter username:password. The builder Base64-encodes that value and creates an Authorization: Basic header. Base64 is encoding, not encryption, so HTTPS is still required.
Should Access-Control-Allow-Origin be set to an asterisk?
Only when any origin may access the resource and credentials are not required. Sensitive applications should usually specify trusted origins and enforce CORS on the server.
Which response security headers are added?
The recommended preset adds X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, and X-Frame-Options: SAMEORIGIN. A complete security policy may require CSP, HSTS, Permissions-Policy, and application-specific rules.
Does this tool send a network request?
No. It builds a header block only. Test the result separately with your API client, browser developer tools, server logs, or integration tests.
Can custom headers override generated values?
Yes. A custom line with the same header name replaces the earlier value case-insensitively, which makes deliberate overrides possible without duplicate output.
How HTTP Header Builder works online
The HTTP Header Builder assembles a set of unique header names and values. Header names are checked against the token characters allowed by HTTP syntax. Values containing carriage returns or line feeds are rejected to reduce accidental header injection. Custom rows must contain a colon separating the name from the value.
HTTP field names are case-insensitive. For that reason, Content-Type and content-type refer to the same header. The builder replaces earlier duplicates and emits one final value per name.
HTTP Header Builder for Accept and Content-Type
Accept describes response formats the client prefers. Content-Type describes the actual format of the current message body. A JSON request commonly sends both Accept: application/json and Content-Type: application/json; charset=utf-8. A GET request without a body may not need Content-Type.
Common media types
Typical values include application/json, application/xml, text/plain, text/html, multipart/form-data, and application/x-www-form-urlencoded. The exact value must match the body and server expectations.
HTTP Header Builder authorization headers
Bearer authentication normally carries an access token. Basic authentication carries a Base64 representation of username and password. Both should be transmitted only over HTTPS and protected from logs, analytics, screenshots, and browser history. Many APIs also use custom headers such as X-API-Key; these can be added in the custom header field.
HTTP Header Builder for Cache-Control and CORS
Cache-Control: no-store is a restrictive option for sensitive data. no-cache allows storage but requires revalidation. Public max-age rules are suitable only when shared caches may safely reuse the response.
Access-Control-Allow-Origin is a response header. It does not grant access by itself when placed in a browser request. Configure CORS on the server and avoid combining wildcard origins with credentialed cross-origin requests.
HTTP Header Builder response security headers
The optional security preset adds practical baseline headers, but it is not a complete security configuration. Production websites should also evaluate Content-Security-Policy, Strict-Transport-Security, Permissions-Policy, cookie attributes, CSRF defenses, and framework-specific protections.
12 powerful HTTP Header Builder examples
JSON API request
Accept: application/json
Authorization: Bearer demo-token
Content-Type: application/json; charset=utf-8Private API response
Cache-Control: no-store
Content-Type: application/json; charset=utf-8
Referrer-Policy: strict-origin-when-cross-origin
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGINCORS-enabled response
Access-Control-Allow-Origin: https://app.example.com
Content-Type: application/json; charset=utf-8Common HTTP Header Builder mistakes
Using response headers in requests
Headers such as Access-Control-Allow-Origin are generated by the server. Adding them to a browser request does not bypass CORS enforcement.
Publishing secrets
Authorization values, API keys, cookies, and session identifiers should be treated as credentials. Replace real values with placeholders in documentation and screenshots.
Confusing Accept and Content-Type
Accept describes preferred response media types. Content-Type describes the body being sent or returned.
Unsafe public caching
Do not use public cache directives for personalized, authenticated, or confidential responses unless the architecture explicitly supports it.
HTTP Header Builder related tools
Create a complete command with cURL Builder, review response meanings with HTTP Status Code Lookup, or inspect URL parameters with Query String Parser.
Authoritative references
Review the HTTP Semantics specification and the MDN HTTP headers reference before deploying security-sensitive rules.