Web
HTTP headers cheat sheet
The request and response headers that control caching, cross-origin access and browser security, with the values you actually want in production.
Caching
CORS
Security
Content
Things worth remembering
- Cache-Control: public, max-age=31536000, immutable is correct only for content-hashed filenames.
- A wildcard Access-Control-Allow-Origin cannot be combined with credentials. Echo the origin instead.
- Content-Security-Policy is the single highest-value security header. Start in report-only mode.