HTTP Headers for REST APIs

Authorization: Bearer eyJhbGciOiJSUzI1NiJ9.eyJzdWIiOiJ1c2VyXzQyIn0...
Authorization: Basic dXNlcjpwYXNzd29yZA==   # base64(user:password)
Authorization: ApiKey your-api-key-here

Content-Type: application/json                  # JSON body (most common in REST)
Content-Type: application/x-www-form-urlencoded # HTML form data
Content-Type: multipart/form-data               # File uploads
Content-Type: application/json; charset=utf-8   # JSON with explicit encoding

Accept: application/json
Accept: application/json, application/xml;q=0.9, */*;q=0.8
Accept: application/vnd.api+json   # JSON:API content type

Accept-Encoding: gzip, deflate, br

# Server responds with:
Content-Encoding: gzip

# First request
GET /users/42
→ 200 OK
   ETag: "v3-a3f9c2b4"

# Subsequent request
GET /users/42
If-None-Match: "v3-a3f9c2b4"
→ 304 Not Modified   (no body, saves bandwidth)

If-Modified-Since: Wed, 22 Apr 2026 10:00:00 GMT
→ 304 Not Modified   (if resource unchanged)
→ 200 OK             (if resource has changed, with new body)

PUT /users/42
If-Match: "v3-a3f9c2b4"
{ "name": "Alice Smith" }

→ 200 OK            (if ETag matches — update applied)
→ 412 Precondition Failed  (if someone else modified the resource first)

Prefer: return=minimal    # Return 204 No Content instead of the full resource
Prefer: return=representation  # Return the full resource after POST/PUT
Prefer: respond-async    # Process asynchronously, return 202 Accepted

const crypto = require('crypto');

function generateETag(data) {
  return '"' + crypto
    .createHash('md5')
    .update(JSON.stringify(data))
    .digest('hex')
    .substring(0, 16) + '"';
}

app.get('/users/:id', async (req, res) => {
  const user = await db.users.findById(req.params.id);
  const etag = generateETag(user);

  // Check If-None-Match
  if (req.headers['if-none-match'] === etag) {
    return res.status(304).end();
  }

  res.set('ETag', etag);
  res.set('Cache-Control', 'private, max-age=60');
  res.json(user);
});

Access-Control-Allow-Origin: https://app.example.com  # Specific origin (recommended)
Access-Control-Allow-Origin: *                         # Any origin (no credentials)
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, PATCH, OPTIONS
Access-Control-Allow-Headers: Content-Type, Authorization, X-Requested-With
Access-Control-Expose-Headers: X-RateLimit-Remaining, ETag
Access-Control-Allow-Credentials: true   # Allow cookies/auth headers
Access-Control-Max-Age: 86400            # Cache preflight for 24 hours

// Express.js CORS middleware
app.options('*', (req, res) => {
  res.set({
    'Access-Control-Allow-Origin':  req.headers.origin || '*',
    'Access-Control-Allow-Methods': 'GET, POST, PUT, PATCH, DELETE, OPTIONS',
    'Access-Control-Allow-Headers': 'Content-Type, Authorization',
    'Access-Control-Max-Age':       '86400'
  });
  res.status(204).end();  // No content for OPTIONS
});

app.use((req, res, next) => {
  res.set('Access-Control-Allow-Origin', req.headers.origin || '*');
  next();
});