Header-Name: Header-Value

Host: api.example.com:8080
Connection: keep-alive

Accept: application/json, text/html;q=0.9
Accept-Language: zh-CN, en-US;q=0.8
Accept-Encoding: gzip, br, deflate
Accept-Charset: utf-8

import requests

headers = {
    'Accept': 'application/json',
    'Accept-Language': 'zh-CN,en;q=0.9',
    'Accept-Encoding': 'gzip, br'
}
response = requests.get('https://api.example.com/data', headers=headers)
print(response.headers['Content-Type'])

Authorization: Bearer eyJhbGciOiJIUzI1NiIs...
Cookie: session=abc123; user=alice
Proxy-Authorization: Basic dXNlcjpwYXNz

If-None-Match: "etag-value"
If-Modified-Since: Wed, 10 May 2026 10:00:00 GMT
If-Match: "etag-value"
If-Unmodified-Since: Wed, 10 May 2026 10:00:00 GMT
If-Range: "etag-value"
Range: bytes=0-1023

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
Referer: https://example.com/previous-page
Origin: https://frontend.example.com
DNT: 1
X-Request-ID: 550e8400-e29b-41d4

Content-Type: application/json; charset=utf-8
Content-Length: 256
Content-Encoding: gzip
Content-Language: zh-CN
Content-Disposition: attachment; filename="report.pdf"
Content-Range: bytes 0-1023/10240

Cache-Control: max-age=3600, public
ETag: "abc123"
Last-Modified: Wed, 10 May 2026 10:00:00 GMT
Expires: Thu, 11 May 2026 10:00:00 GMT
Vary: Accept, Accept-Encoding

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: default-src 'self'
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-XSS-Protection: 1; mode=block
Referrer-Policy: strict-origin-when-cross-origin

Access-Control-Allow-Origin: https://frontend.example.com
Access-Control-Allow-Methods: GET, POST, PUT, DELETE
Access-Control-Allow-Headers: Content-Type, Authorization
Access-Control-Allow-Credentials: true
Access-Control-Max-Age: 86400
Access-Control-Expose-Headers: X-Total-Count

Set-Cookie: session=abc123; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=3600
Set-Cookie: theme=dark; Path=/; Max-Age=31536000

POST /upload HTTP/1.1
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW

------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="username"

alice
------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="avatar"; filename="photo.jpg"
Content-Type: image/jpeg

<binary image data>
------WebKitFormBoundary7MA4YWxkTrZu0gW--

import requests

# 文件上传
with open('photo.jpg', 'rb') as f:
    response = requests.post(
        'https://api.example.com/upload',
        files={
            'avatar': ('photo.jpg', f, 'image/jpeg'),
        },
        data={
            'username': 'alice'
        }
    )

# 静态资源（长期缓存，使用 hash 文件名）
Cache-Control: public, max-age=31536000, immutable

# API 响应（不缓存）
Cache-Control: no-store

# HTML 页面（协商缓存）
Cache-Control: no-cache

# 用户数据（仅浏览器缓存）
Cache-Control: private, max-age=300

# CDN + 浏览器缓存
Cache-Control: public, s-maxage=86400, max-age=3600

# Nginx 缓存配置
# 静态资源
location ~* \.(css|js|png|jpg|ico|woff2)$ {
    add_header Cache-Control "public, max-age=31536000, immutable";
}

# HTML
location / {
    add_header Cache-Control "no-cache";
}

# API
location /api/ {
    add_header Cache-Control "no-store";
}

# 请求追踪
X-Request-ID: 550e8400-e29b-41d4
X-Correlation-ID: abc-123

# API 版本
X-API-Version: v2

# 限流信息（响应头）
X-RateLimit-Limit: 100
X-RateLimit-Remaining: 85
X-RateLimit-Reset: 1715328000

# 分页信息（响应头）
X-Total-Count: 1500
X-Page-Count: 75

# 客户端信息
X-Forwarded-For: 203.0.113.1
X-Forwarded-Proto: https
X-Real-IP: 203.0.113.1

// Express.js 中间件：添加请求 ID
const { v4: uuidv4 } = require('uuid');

app.use((req, res, next) => {
    const requestId = req.headers['x-request-id'] || uuidv4();
    req.requestId = requestId;
    res.setHeader('X-Request-ID', requestId);
    next();
});

# 响应根据 Accept-Encoding 不同而不同
Vary: Accept-Encoding

# 根据 Accept 和 Authorization 不同
Vary: Accept, Authorization

# Nginx Vary 配置
gzip_vary on;  # 添加 Vary: Accept-Encoding

GET /api/users?page=1 HTTP/1.1
Host: api.example.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36
Accept: application/json, text/plain, */*
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Accept-Encoding: gzip, deflate, br
Authorization: Bearer eyJhbGciOiJIUzI1NiIs...
Origin: https://app.example.com
Referer: https://app.example.com/users
Connection: keep-alive
Cache-Control: no-cache
X-Request-ID: abc-123-def-456
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site

HTTP/1.1 200 OK
Date: Wed, 10 May 2026 10:00:00 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 256
Content-Encoding: br
Cache-Control: private, max-age=0, must-revalidate
ETag: "user-list-v5"
Vary: Accept, Accept-Encoding
X-Request-ID: abc-123-def-456
X-Total-Count: 150
X-Page-Count: 8
Access-Control-Allow-Origin: https://app.example.com
Access-Control-Expose-Headers: X-Total-Count, X-Page-Count
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff