HTTP 헤더

일반

• Date, Connection(close/Keep-Alive), Cache-Control, Pragma, Trailer

엔티티(본문)

• Content-Type / Content-Language / Content-Encoding / Content-Length
• Content-Location, Content-Disposition(inline/attachment)
• Content-Security-Policy(예: default-src 'self'), Location(리다이렉트·201), Last-Modified
• Transfer-Encoding: chunked

요청

• Host(필수 1.1+), User-Agent, Cookie, Referer, Authorization
• If-Modified-Since, Origin(CORS), Accept/Accept-Charset/Accept-Encoding/Accept-Language

응답

• Server, Set-Cookie, Expires, Age, ETag, Allow
• Access-Control-Allow-Origin(* 주의)

CORS

1. Preflight: OPTIONS + Access-Control-Request-Method/-Headers
2. 서버 Access-Control-Allow-* 응답
3. 일치 시 실제 요청

캐시·쿠키

• Cache-Control: no-store / no-cache / must-revalidate / public·private / max-age
• If-None-Match → 동일 ETag면 304
• Set-Cookie: Expires/Max-Age, Secure, HttpOnly, Domain, Path