Headers

The Headers tab displays all HTTP headers returned by the server. Headers are organized into three sections: General Headers, CORS, and Caching. This organization makes it easy to find specific headers without scrolling through a long list.

General Headers

General headers include all response headers except CORS and caching headers. They are sorted by priority with the most commonly used headers appearing first.

HeaderDescription
content-typeMIME type of the response body (e.g., application/json)
content-lengthSize of the response body in bytes
content-encodingCompression algorithm used (e.g., gzip, br)
serverServer software information
dateDate and time the response was generated
set-cookieCookies to store (shown in detail in Cookies tab)
x-request-idUnique identifier for debugging/tracing
Tip: You can select and copy header values directly. Right-click copying preserves the exact value without line breaks.

CORS (Cross-Origin Resource Sharing)

CORS headers control how browsers share resources between different origins. This section only appears if the response contains CORS headers.

HeaderPurposeExample Value
Allow-OriginOrigins allowed to access the resource*, https://example.com
Allow-MethodsHTTP methods allowed for cross-origin requestsGET, POST, PUT, DELETE
Allow-HeadersRequest headers allowed in cross-origin requestsContent-Type, Authorization
Allow-CredentialsWhether credentials (cookies, auth) are allowedtrue, false
Expose-HeadersHeaders that browsers can access from responseX-Request-Id, X-Rate-Limit
Max-AgeHow long preflight results can be cached (seconds)86400 (1 day)
Visual Display

CORS headers are displayed in a card format with parsed values for easy reading:

Allow-Originhttps://example.com
Allow-Methods
GETPOSTPUTDELETE
Allow-Headers
Content-TypeAuthorization
Note: CORS headers are set by the server. If you're seeing CORS errors in your browser, the server needs to include these headers in its response.

Caching

Caching headers control how responses are stored and reused. This section only appears if the response contains caching-related headers.

HeaderPurpose
Cache-ControlPrimary caching directives (parsed into individual badges)
ETagVersion identifier for conditional requests
Last-ModifiedWhen the resource was last changed
ExpiresDate after which the response is stale (legacy)
AgeHow long the response has been in cache (seconds)
Cache-Control Directives

The Cache-Control header is automatically parsed and displayed as individual badges:

Cache-Control
publicmax-age=3600must-revalidate
DirectiveMeaning
publicCan be cached by browsers and CDNs
privateCan only be cached by browsers, not CDNs
no-cacheMust revalidate before using cached version
no-storeDo not cache at all
max-age=NCache is fresh for N seconds
s-maxage=NMax age for shared caches (CDNs)
must-revalidateMust check server when stale
immutableContent will never change
Conditional Requests with ETag

ETags enable conditional requests to save bandwidth:

  1. Server returns response with ETag: "abc123"
  2. Client caches the response with the ETag
  3. Next request includes If-None-Match: "abc123"
  4. If unchanged, server returns 304 Not Modified (no body)
  5. If changed, server returns new response with new ETag

Section Visibility

The CORS and Caching sections are context-aware and only appear when relevant:

CORS Section Shows When
  • Access-Control-Allow-Origin is present
  • Access-Control-Allow-Methods is present
  • Access-Control-Allow-Headers is present
  • Any other Access-Control-* header is present
Caching Section Shows When
  • Cache-Control is present
  • ETag is present
  • Last-Modified is present
  • Expires is present
  • Age is present
BodyCookies