programmazione:http:header
Appunti su http
Autore: Fabio Di Matteo
Ultima revisione: 10/08/2026 18:47
Request
Un esempio di richiesta http. Richiedo la pagina “page0.html”
GET /page0.html HTTP/1.1 Host: example.com User-Agent: Mozilla/5.0 Accept: text/html Connection: keep-alive
Response
Un esempio completo di response http. Header+body. Tra response e body occorre sempre che sia una riga vuota. Ovvero : \r\n\r\n
HTTP/1.1 200 OK Date: Fri, 04 Jul 2026 12:00:00 GMT Server: nginx Content-Type: text/html; charset=UTF-8 Content-Length: 138 Connection: keep-alive Cache-Control: no-cache <!doctype html> <html lang="it"> <head> <meta charset="utf-8"> <title>Pagina di esempio</title> </head> <body> <h1>Ciao mondo</h1> <p>Questa è una response HTTP completa con header e body.</p> </body> </html>
Elenco header http
Puo' essere utile quando prepariamo request o response.
| Header | Descrizione | Esempi |
|---|---|---|
| Content-Type | Tipo di contenuto restituito | `text/html`, `application/json`, `text/plain`, `image/png`, `text/css`, `application/javascript`, `application/xml`, `multipart/form-data`, `application/pdf`, `video/mp4` |
| Content-Length | Dimensione della risposta | `1234`, `0`, `56789`, `1048576`, `2048`, `999`, `43210`, `8192`, `65536`, `150000` |
| Server | Informazioni sul server web | `Apache`, `nginx`, `Microsoft-IIS/10.0`, `Caddy`, `LiteSpeed`, `OpenResty`, `cloudflare`, `gunicorn`, `envoy`, `Tomcat` |
| Date | Data/ora della risposta | `Mon, 01 Jul 2026 10:00:00 GMT`, `Tue, 02 Jul 2026 11:15:00 GMT`, `Wed, 03 Jul 2026 12:30:00 GMT`, `Thu, 04 Jul 2026 13:45:00 GMT`, `Fri, 05 Jul 2026 14:00:00 GMT`, `Sat, 06 Jul 2026 15:20:00 GMT`, `Sun, 07 Jul 2026 16:35:00 GMT`, `Mon, 08 Jul 2026 17:50:00 GMT`, `Tue, 09 Jul 2026 18:05:00 GMT`, `Wed, 10 Jul 2026 19:10:00 GMT` |
| Cache-Control | Regole di cache | `no-cache`, `no-store`, `max-age=3600`, `public`, `private`, `must-revalidate`, `s-maxage=600`, `immutable`, `stale-while-revalidate=30`, `proxy-revalidate` |
| Expires | Scadenza della cache | `Wed, 21 Oct 2026 07:28:00 GMT`, `Thu, 22 Oct 2026 07:28:00 GMT`, `Fri, 23 Oct 2026 07:28:00 GMT`, `Sat, 24 Oct 2026 07:28:00 GMT`, `Sun, 25 Oct 2026 07:28:00 GMT`, `Mon, 26 Oct 2026 07:28:00 GMT`, `Tue, 27 Oct 2026 07:28:00 GMT`, `Wed, 28 Oct 2026 07:28:00 GMT`, `Thu, 29 Oct 2026 07:28:00 GMT`, `Fri, 30 Oct 2026 07:28:00 GMT` |
| Last-Modified | Ultima modifica del contenuto | `Thu, 03 Jul 2026 18:20:00 GMT`, `Wed, 02 Jul 2026 09:10:00 GMT`, `Tue, 01 Jul 2026 21:45:00 GMT`, `Mon, 30 Jun 2026 16:00:00 GMT`, `Sun, 29 Jun 2026 08:30:00 GMT`, `Sat, 28 Jun 2026 12:15:00 GMT`, `Fri, 27 Jun 2026 19:55:00 GMT`, `Thu, 26 Jun 2026 07:40:00 GMT`, `Wed, 25 Jun 2026 14:25:00 GMT`, `Tue, 24 Jun 2026 10:05:00 GMT` |
| ETag | Identificatore della versione della risorsa | `“abc123”`, `“def456”`, `“v1-789xyz”`, `“W/\”12345\““`, `”etag-001”`, `“etag-002”`, `“res-20260704”`, `“a1b2c3d4”`, `“cache-789”`, `“version-10”` |
| Location | Redirect o nuova URL | `https://example.com/new`, `https://example.com/login`, `https://example.com/dashboard`, `https://example.com/en`, `https://example.com/it`, `https://example.com/product/123`, `https://example.com/cart`, `https://example.com/checkout`, `https://example.com/help`, `https://example.com/status` |
| Set-Cookie | Imposta un cookie lato client | `sessionid=…`, `userid=…`, `lang=it`, `theme=dark`, `csrf=…`, `auth=…`, `tracking=…`, `consent=yes`, `cart=…`, `remember=true` |
| Allow | Metodi HTTP consentiti | `GET`, `POST`, `HEAD`, `PUT`, `DELETE`, `PATCH`, `OPTIONS`, `TRACE`, `CONNECT`, `GET, POST, HEAD` |
| Content-Encoding | Codifica della risposta | `gzip`, `br`, `deflate`, `compress`, `identity`, `zstd`, `x-gzip`, `x-compress`, `pack200`, `bzip2` |
| Accept-Ranges | Supporto alle richieste parziali | `bytes`, `none`, `0-1024`, `0-2048`, `0-4096`, `0-8192`, `0-16384`, `0-32768`, `0-65536`, `0-131072` |
| Connection | Stato della connessione | `keep-alive`, `close`, `upgrade`, `Keep-Alive`, `Proxy-Connection`, `persistent`, `HTTP/1.1 keep-alive`, `HTTP/1.0 close`, `open`, `reuse` |
| Strict-Transport-Security | Forza HTTPS | `max-age=31536000`, `max-age=63072000`, `includeSubDomains`, `preload`, `max-age=86400`, `max-age=10886400`, `max-age=15768000`, `max-age=31536000; includeSubDomains`, `max-age=31536000; preload`, `max-age=0` |
| Content-Security-Policy | Regole di sicurezza per i contenuti | `default-src 'self'`, `img-src 'self'`, `script-src 'self'`, `style-src 'self'`, `connect-src 'self'`, `font-src 'self'`, `object-src 'none'`, `frame-ancestors 'none'`, `upgrade-insecure-requests`, `default-src 'self'; object-src 'none'` |
| X-Content-Type-Options | Previene MIME sniffing | `nosniff`, `sameorigin`, `allow`, `block`, `off`, `on`, `strict`, `default`, `secure`, `enabled` |
| X-Frame-Options | Protegge da clickjacking | `DENY`, `SAMEORIGIN`, `ALLOW-FROM https://example.com`, `DENY`, `SAMEORIGIN`, `ALLOW-FROM https://site1.com`, `ALLOW-FROM https://site2.com`, `DENY`, `SAMEORIGIN`, `DENY` |
| Referrer-Policy | Controlla l'invio del referrer | `no-referrer`, `same-origin`, `origin`, `strict-origin`, `origin-when-cross-origin`, `strict-origin-when-cross-origin`, `no-referrer-when-downgrade`, `unsafe-url`, `origin-when-crossorigin`, `same-origin` |
| Permissions-Policy | Limita API/browser feature | `geolocation=()`, `camera=()`, `microphone=()`, `fullscreen=(self)`, `payment=()`, `usb=()`, `interest-cohort=()`, `accelerometer=()`, `gyroscope=()`, `speaker=()` |
programmazione/http/header.txt · Ultima modifica: 10/08/2026 18:54 da Fabio Di Matteo