001/* 002 * Copyright (C) 2011 The Guava Authors 003 * 004 * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except 005 * in compliance with the License. You may obtain a copy of the License at 006 * 007 * http://www.apache.org/licenses/LICENSE-2.0 008 * 009 * Unless required by applicable law or agreed to in writing, software distributed under the License 010 * is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express 011 * or implied. See the License for the specific language governing permissions and limitations under 012 * the License. 013 */ 014 015package com.google.common.net; 016 017import com.google.common.annotations.GwtCompatible; 018 019/** 020 * Contains constant definitions for the HTTP header field names. See: 021 * 022 * <ul> 023 * <li><a href="http://www.ietf.org/rfc/rfc2109.txt">RFC 2109</a> 024 * <li><a href="http://www.ietf.org/rfc/rfc2183.txt">RFC 2183</a> 025 * <li><a href="http://www.ietf.org/rfc/rfc2616.txt">RFC 2616</a> 026 * <li><a href="http://www.ietf.org/rfc/rfc2965.txt">RFC 2965</a> 027 * <li><a href="http://www.ietf.org/rfc/rfc5988.txt">RFC 5988</a> 028 * </ul> 029 * 030 * @author Kurt Alfred Kluever 031 * @since 11.0 032 */ 033@GwtCompatible 034public final class HttpHeaders { 035 private HttpHeaders() {} 036 037 // HTTP Request and Response header fields 038 039 /** The HTTP {@code Cache-Control} header field name. */ 040 public static final String CACHE_CONTROL = "Cache-Control"; 041 042 /** The HTTP {@code Content-Length} header field name. */ 043 public static final String CONTENT_LENGTH = "Content-Length"; 044 045 /** The HTTP {@code Content-Type} header field name. */ 046 public static final String CONTENT_TYPE = "Content-Type"; 047 048 /** The HTTP {@code Date} header field name. */ 049 public static final String DATE = "Date"; 050 051 /** The HTTP {@code Pragma} header field name. */ 052 public static final String PRAGMA = "Pragma"; 053 054 /** The HTTP {@code Via} header field name. */ 055 public static final String VIA = "Via"; 056 057 /** The HTTP {@code Warning} header field name. */ 058 public static final String WARNING = "Warning"; 059 060 // HTTP Request header fields 061 062 /** The HTTP {@code Accept} header field name. */ 063 public static final String ACCEPT = "Accept"; 064 065 /** The HTTP {@code Accept-Charset} header field name. */ 066 public static final String ACCEPT_CHARSET = "Accept-Charset"; 067 068 /** The HTTP {@code Accept-Encoding} header field name. */ 069 public static final String ACCEPT_ENCODING = "Accept-Encoding"; 070 071 /** The HTTP {@code Accept-Language} header field name. */ 072 public static final String ACCEPT_LANGUAGE = "Accept-Language"; 073 074 /** The HTTP {@code Access-Control-Request-Headers} header field name. */ 075 public static final String ACCESS_CONTROL_REQUEST_HEADERS = "Access-Control-Request-Headers"; 076 077 /** The HTTP {@code Access-Control-Request-Method} header field name. */ 078 public static final String ACCESS_CONTROL_REQUEST_METHOD = "Access-Control-Request-Method"; 079 080 /** The HTTP {@code Authorization} header field name. */ 081 public static final String AUTHORIZATION = "Authorization"; 082 083 /** The HTTP {@code Connection} header field name. */ 084 public static final String CONNECTION = "Connection"; 085 086 /** The HTTP {@code Cookie} header field name. */ 087 public static final String COOKIE = "Cookie"; 088 089 /** 090 * The HTTP <a href="https://fetch.spec.whatwg.org/#cross-origin-resource-policy-header">{@code 091 * Cross-Origin-Resource-Policy}</a> header field name. 092 * 093 * @since 28.0 094 */ 095 public static final String CROSS_ORIGIN_RESOURCE_POLICY = "Cross-Origin-Resource-Policy"; 096 097 /** 098 * The HTTP <a href="https://datatracker.ietf.org/doc/html/rfc8470">{@code Early-Data}</a> header 099 * field name. 100 * 101 * @since 27.0 102 */ 103 public static final String EARLY_DATA = "Early-Data"; 104 105 /** The HTTP {@code Expect} header field name. */ 106 public static final String EXPECT = "Expect"; 107 108 /** The HTTP {@code From} header field name. */ 109 public static final String FROM = "From"; 110 111 /** 112 * The HTTP <a href="https://datatracker.ietf.org/doc/html/rfc7239">{@code Forwarded}</a> header 113 * field name. 114 * 115 * @since 20.0 116 */ 117 public static final String FORWARDED = "Forwarded"; 118 119 /** 120 * The HTTP {@code Follow-Only-When-Prerender-Shown} header field name. 121 * 122 * @since 17.0 123 */ 124 public static final String FOLLOW_ONLY_WHEN_PRERENDER_SHOWN = "Follow-Only-When-Prerender-Shown"; 125 126 /** The HTTP {@code Host} header field name. */ 127 public static final String HOST = "Host"; 128 129 /** 130 * The HTTP <a href="https://datatracker.ietf.org/doc/html/rfc7540#section-3.2.1">{@code 131 * HTTP2-Settings} </a> header field name. 132 * 133 * @since 24.0 134 */ 135 public static final String HTTP2_SETTINGS = "HTTP2-Settings"; 136 137 /** The HTTP {@code If-Match} header field name. */ 138 public static final String IF_MATCH = "If-Match"; 139 140 /** The HTTP {@code If-Modified-Since} header field name. */ 141 public static final String IF_MODIFIED_SINCE = "If-Modified-Since"; 142 143 /** The HTTP {@code If-None-Match} header field name. */ 144 public static final String IF_NONE_MATCH = "If-None-Match"; 145 146 /** The HTTP {@code If-Range} header field name. */ 147 public static final String IF_RANGE = "If-Range"; 148 149 /** The HTTP {@code If-Unmodified-Since} header field name. */ 150 public static final String IF_UNMODIFIED_SINCE = "If-Unmodified-Since"; 151 152 /** The HTTP {@code Last-Event-ID} header field name. */ 153 public static final String LAST_EVENT_ID = "Last-Event-ID"; 154 155 /** The HTTP {@code Max-Forwards} header field name. */ 156 public static final String MAX_FORWARDS = "Max-Forwards"; 157 158 /** The HTTP {@code Origin} header field name. */ 159 public static final String ORIGIN = "Origin"; 160 161 /** 162 * The HTTP <a href="https://github.com/WICG/origin-isolation">{@code Origin-Isolation}</a> header 163 * field name. 164 * 165 * @since 30.1 166 */ 167 public static final String ORIGIN_ISOLATION = "Origin-Isolation"; 168 169 /** The HTTP {@code Proxy-Authorization} header field name. */ 170 public static final String PROXY_AUTHORIZATION = "Proxy-Authorization"; 171 172 /** The HTTP {@code Range} header field name. */ 173 public static final String RANGE = "Range"; 174 175 /** The HTTP {@code Referer} header field name. */ 176 public static final String REFERER = "Referer"; 177 178 /** 179 * The HTTP <a href="https://www.w3.org/TR/referrer-policy/">{@code Referrer-Policy}</a> header 180 * field name. 181 * 182 * @since 23.4 183 */ 184 public static final String REFERRER_POLICY = "Referrer-Policy"; 185 186 /** 187 * Values for the <a href="https://www.w3.org/TR/referrer-policy/">{@code Referrer-Policy}</a> 188 * header. 189 * 190 * @since 23.4 191 */ 192 public static final class ReferrerPolicyValues { 193 private ReferrerPolicyValues() {} 194 195 /** The {@code no-referrer} referrer policy. */ 196 public static final String NO_REFERRER = "no-referrer"; 197 198 /** The {@code no-referrer-when-downgrade} referrer policy. */ 199 public static final String NO_REFFERER_WHEN_DOWNGRADE = "no-referrer-when-downgrade"; 200 201 /** The {@code same-origin} referrer policy. */ 202 public static final String SAME_ORIGIN = "same-origin"; 203 204 /** The {@code origin} referrer policy. */ 205 public static final String ORIGIN = "origin"; 206 207 /** The {@code strict-origin} referrer policy. */ 208 public static final String STRICT_ORIGIN = "strict-origin"; 209 210 /** The {@code origin-when-cross-origin} referrer policy. */ 211 public static final String ORIGIN_WHEN_CROSS_ORIGIN = "origin-when-cross-origin"; 212 213 /** The {@code strict-origin-when-cross-origin} referrer policy. */ 214 public static final String STRICT_ORIGIN_WHEN_CROSS_ORIGIN = "strict-origin-when-cross-origin"; 215 216 /** The {@code unsafe-url} referrer policy. */ 217 public static final String UNSAFE_URL = "unsafe-url"; 218 } 219 220 /** 221 * The HTTP <a href="https://www.w3.org/TR/service-workers/#update-algorithm">{@code 222 * Service-Worker}</a> header field name. 223 * 224 * @since 20.0 225 */ 226 public static final String SERVICE_WORKER = "Service-Worker"; 227 228 /** The HTTP {@code TE} header field name. */ 229 public static final String TE = "TE"; 230 231 /** The HTTP {@code Upgrade} header field name. */ 232 public static final String UPGRADE = "Upgrade"; 233 234 /** 235 * The HTTP <a href="https://w3c.github.io/webappsec-upgrade-insecure-requests/#preference">{@code 236 * Upgrade-Insecure-Requests}</a> header field name. 237 * 238 * @since 28.1 239 */ 240 public static final String UPGRADE_INSECURE_REQUESTS = "Upgrade-Insecure-Requests"; 241 242 /** The HTTP {@code User-Agent} header field name. */ 243 public static final String USER_AGENT = "User-Agent"; 244 245 // HTTP Response header fields 246 247 /** The HTTP {@code Accept-Ranges} header field name. */ 248 public static final String ACCEPT_RANGES = "Accept-Ranges"; 249 250 /** The HTTP {@code Access-Control-Allow-Headers} header field name. */ 251 public static final String ACCESS_CONTROL_ALLOW_HEADERS = "Access-Control-Allow-Headers"; 252 253 /** The HTTP {@code Access-Control-Allow-Methods} header field name. */ 254 public static final String ACCESS_CONTROL_ALLOW_METHODS = "Access-Control-Allow-Methods"; 255 256 /** The HTTP {@code Access-Control-Allow-Origin} header field name. */ 257 public static final String ACCESS_CONTROL_ALLOW_ORIGIN = "Access-Control-Allow-Origin"; 258 259 /** 260 * The HTTP <a href="https://wicg.github.io/private-network-access/#headers">{@code 261 * Access-Control-Allow-Private-Network}</a> header field name. 262 * 263 * @since 31.1 264 */ 265 public static final String ACCESS_CONTROL_ALLOW_PRIVATE_NETWORK = 266 "Access-Control-Allow-Private-Network"; 267 268 /** The HTTP {@code Access-Control-Allow-Credentials} header field name. */ 269 public static final String ACCESS_CONTROL_ALLOW_CREDENTIALS = "Access-Control-Allow-Credentials"; 270 271 /** The HTTP {@code Access-Control-Expose-Headers} header field name. */ 272 public static final String ACCESS_CONTROL_EXPOSE_HEADERS = "Access-Control-Expose-Headers"; 273 274 /** The HTTP {@code Access-Control-Max-Age} header field name. */ 275 public static final String ACCESS_CONTROL_MAX_AGE = "Access-Control-Max-Age"; 276 277 /** The HTTP {@code Age} header field name. */ 278 public static final String AGE = "Age"; 279 280 /** The HTTP {@code Allow} header field name. */ 281 public static final String ALLOW = "Allow"; 282 283 /** 284 * The HTTP <a href="https://datatracker.ietf.org/doc/rfc9213/">{@code CDN-Cache-Control}</a> 285 * header field name. 286 * 287 * @since 33.6.0 288 */ 289 public static final String CDN_CACHE_CONTROL = "CDN-Cache-Control"; 290 291 /** The HTTP {@code Content-Disposition} header field name. */ 292 public static final String CONTENT_DISPOSITION = "Content-Disposition"; 293 294 /** The HTTP {@code Content-Encoding} header field name. */ 295 public static final String CONTENT_ENCODING = "Content-Encoding"; 296 297 /** The HTTP {@code Content-Language} header field name. */ 298 public static final String CONTENT_LANGUAGE = "Content-Language"; 299 300 /** The HTTP {@code Content-Location} header field name. */ 301 public static final String CONTENT_LOCATION = "Content-Location"; 302 303 /** The HTTP {@code Content-MD5} header field name. */ 304 public static final String CONTENT_MD5 = "Content-MD5"; 305 306 /** The HTTP {@code Content-Range} header field name. */ 307 public static final String CONTENT_RANGE = "Content-Range"; 308 309 /** 310 * The HTTP <a href="http://w3.org/TR/CSP/#content-security-policy-header-field">{@code 311 * Content-Security-Policy}</a> header field name. 312 * 313 * @since 15.0 314 */ 315 public static final String CONTENT_SECURITY_POLICY = "Content-Security-Policy"; 316 317 /** 318 * The HTTP <a href="http://w3.org/TR/CSP/#content-security-policy-report-only-header-field"> 319 * {@code Content-Security-Policy-Report-Only}</a> header field name. 320 * 321 * @since 15.0 322 */ 323 public static final String CONTENT_SECURITY_POLICY_REPORT_ONLY = 324 "Content-Security-Policy-Report-Only"; 325 326 /** 327 * The HTTP nonstandard {@code X-Content-Security-Policy} header field name. It was introduced in 328 * <a href="https://www.w3.org/TR/2011/WD-CSP-20111129/">CSP v.1</a> and used by the Firefox until 329 * version 23 and the Internet Explorer version 10. Please, use {@link #CONTENT_SECURITY_POLICY} 330 * to pass the CSP. 331 * 332 * @since 20.0 333 */ 334 public static final String X_CONTENT_SECURITY_POLICY = "X-Content-Security-Policy"; 335 336 /** 337 * The HTTP nonstandard {@code X-Content-Security-Policy-Report-Only} header field name. It was 338 * introduced in <a href="https://www.w3.org/TR/2011/WD-CSP-20111129/">CSP v.1</a> and used by the 339 * Firefox until version 23 and the Internet Explorer version 10. Please, use {@link 340 * #CONTENT_SECURITY_POLICY_REPORT_ONLY} to pass the CSP. 341 * 342 * @since 20.0 343 */ 344 public static final String X_CONTENT_SECURITY_POLICY_REPORT_ONLY = 345 "X-Content-Security-Policy-Report-Only"; 346 347 /** 348 * The HTTP nonstandard {@code X-WebKit-CSP} header field name. It was introduced in <a 349 * href="https://www.w3.org/TR/2011/WD-CSP-20111129/">CSP v.1</a> and used by the Chrome until 350 * version 25. Please, use {@link #CONTENT_SECURITY_POLICY} to pass the CSP. 351 * 352 * @since 20.0 353 */ 354 public static final String X_WEBKIT_CSP = "X-WebKit-CSP"; 355 356 /** 357 * The HTTP nonstandard {@code X-WebKit-CSP-Report-Only} header field name. It was introduced in 358 * <a href="https://www.w3.org/TR/2011/WD-CSP-20111129/">CSP v.1</a> and used by the Chrome until 359 * version 25. Please, use {@link #CONTENT_SECURITY_POLICY_REPORT_ONLY} to pass the CSP. 360 * 361 * @since 20.0 362 */ 363 public static final String X_WEBKIT_CSP_REPORT_ONLY = "X-WebKit-CSP-Report-Only"; 364 365 /** 366 * The HTTP <a href="https://wicg.github.io/cross-origin-embedder-policy/#COEP">{@code 367 * Cross-Origin-Embedder-Policy}</a> header field name. 368 * 369 * @since 30.0 370 */ 371 public static final String CROSS_ORIGIN_EMBEDDER_POLICY = "Cross-Origin-Embedder-Policy"; 372 373 /** 374 * The HTTP <a href="https://wicg.github.io/cross-origin-embedder-policy/#COEP-RO">{@code 375 * Cross-Origin-Embedder-Policy-Report-Only}</a> header field name. 376 * 377 * @since 30.0 378 */ 379 public static final String CROSS_ORIGIN_EMBEDDER_POLICY_REPORT_ONLY = 380 "Cross-Origin-Embedder-Policy-Report-Only"; 381 382 /** 383 * The HTTP Cross-Origin-Opener-Policy header field name. 384 * 385 * @since 28.2 386 */ 387 public static final String CROSS_ORIGIN_OPENER_POLICY = "Cross-Origin-Opener-Policy"; 388 389 /** The HTTP {@code ETag} header field name. */ 390 public static final String ETAG = "ETag"; 391 392 /** The HTTP {@code Expires} header field name. */ 393 public static final String EXPIRES = "Expires"; 394 395 /** The HTTP {@code Last-Modified} header field name. */ 396 public static final String LAST_MODIFIED = "Last-Modified"; 397 398 /** The HTTP {@code Link} header field name. */ 399 public static final String LINK = "Link"; 400 401 /** The HTTP {@code Location} header field name. */ 402 public static final String LOCATION = "Location"; 403 404 /** 405 * The HTTP {@code Keep-Alive} header field name. 406 * 407 * @since 31.0 408 */ 409 public static final String KEEP_ALIVE = "Keep-Alive"; 410 411 /** 412 * The HTTP <a href="https://github.com/WICG/nav-speculation/blob/main/no-vary-search.md">{@code 413 * No-Vary-Search}</a> header field name. 414 * 415 * @since 32.0.0 416 */ 417 public static final String NO_VARY_SEARCH = "No-Vary-Search"; 418 419 /** 420 * The HTTP <a href="https://github.com/explainers-by-googlers/prefetch-activation-beacon">{@code 421 * on-prefetch-activation}</a> header field name. 422 * 423 * @since 33.7.0 424 */ 425 public static final String ON_PREFETCH_ACTIVATION = "on-prefetch-activation"; 426 427 /** 428 * The HTTP <a href="https://googlechrome.github.io/OriginTrials/#header">{@code Origin-Trial}</a> 429 * header field name. 430 * 431 * @since 27.1 432 */ 433 public static final String ORIGIN_TRIAL = "Origin-Trial"; 434 435 /** The HTTP {@code P3P} header field name. Limited browser support. */ 436 public static final String P3P = "P3P"; 437 438 /** The HTTP {@code Proxy-Authenticate} header field name. */ 439 public static final String PROXY_AUTHENTICATE = "Proxy-Authenticate"; 440 441 /** The HTTP {@code Refresh} header field name. Non-standard header supported by most browsers. */ 442 public static final String REFRESH = "Refresh"; 443 444 /** 445 * The HTTP <a href="https://www.w3.org/TR/reporting/">{@code Report-To}</a> header field name. 446 * 447 * @since 27.1 448 */ 449 public static final String REPORT_TO = "Report-To"; 450 451 /** The HTTP {@code Retry-After} header field name. */ 452 public static final String RETRY_AFTER = "Retry-After"; 453 454 /** The HTTP {@code Server} header field name. */ 455 public static final String SERVER = "Server"; 456 457 /** 458 * The HTTP <a href="https://www.w3.org/TR/server-timing/">{@code Server-Timing}</a> header field 459 * name. 460 * 461 * @since 23.6 462 */ 463 public static final String SERVER_TIMING = "Server-Timing"; 464 465 /** 466 * The HTTP <a href="https://www.w3.org/TR/service-workers/#update-algorithm">{@code 467 * Service-Worker-Allowed}</a> header field name. 468 * 469 * @since 20.0 470 */ 471 public static final String SERVICE_WORKER_ALLOWED = "Service-Worker-Allowed"; 472 473 /** The HTTP {@code Set-Cookie} header field name. */ 474 public static final String SET_COOKIE = "Set-Cookie"; 475 476 /** The HTTP {@code Set-Cookie2} header field name. */ 477 public static final String SET_COOKIE2 = "Set-Cookie2"; 478 479 /** 480 * The HTTP <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/SourceMap">{@code 481 * SourceMap}</a> header field name. 482 * 483 * @since 27.1 484 */ 485 public static final String SOURCE_MAP = "SourceMap"; 486 487 /** 488 * The HTTP <a href="https://github.com/WICG/nav-speculation/blob/main/opt-in.md">{@code 489 * Supports-Loading-Mode}</a> header field name. This can be used to specify, for example, <a 490 * href="https://developer.chrome.com/docs/privacy-sandbox/fenced-frame/#server-opt-in">fenced 491 * frames</a>. 492 * 493 * @since 32.0.0 494 */ 495 public static final String SUPPORTS_LOADING_MODE = "Supports-Loading-Mode"; 496 497 /** 498 * The HTTP <a href="http://tools.ietf.org/html/rfc6797#section-6.1">{@code 499 * Strict-Transport-Security}</a> header field name. 500 * 501 * @since 15.0 502 */ 503 public static final String STRICT_TRANSPORT_SECURITY = "Strict-Transport-Security"; 504 505 /** 506 * The HTTP <a href="https://www.w3.org/TR/resource-timing/#sec-timing-allow-origin">{@code 507 * Timing-Allow-Origin}</a> header field name. 508 * 509 * @since 15.0 510 */ 511 public static final String TIMING_ALLOW_ORIGIN = "Timing-Allow-Origin"; 512 513 /** The HTTP {@code Trailer} header field name. */ 514 public static final String TRAILER = "Trailer"; 515 516 /** The HTTP {@code Transfer-Encoding} header field name. */ 517 public static final String TRANSFER_ENCODING = "Transfer-Encoding"; 518 519 /** The HTTP {@code Vary} header field name. */ 520 public static final String VARY = "Vary"; 521 522 /** The HTTP {@code WWW-Authenticate} header field name. */ 523 public static final String WWW_AUTHENTICATE = "WWW-Authenticate"; 524 525 // Common, non-standard HTTP header fields 526 527 /** The HTTP {@code DNT} header field name. */ 528 public static final String DNT = "DNT"; 529 530 /** The HTTP {@code X-Content-Type-Options} header field name. */ 531 public static final String X_CONTENT_TYPE_OPTIONS = "X-Content-Type-Options"; 532 533 /** 534 * The HTTP <a 535 * href="https://iabtechlab.com/wp-content/uploads/2019/06/VAST_4.2_final_june26.pdf">{@code 536 * X-Device-IP}</a> header field name. Header used for VAST requests to provide the IP address of 537 * the device on whose behalf the request is being made. 538 * 539 * @since 31.0 540 */ 541 public static final String X_DEVICE_IP = "X-Device-IP"; 542 543 /** 544 * The HTTP <a 545 * href="https://iabtechlab.com/wp-content/uploads/2019/06/VAST_4.2_final_june26.pdf">{@code 546 * X-Device-Referer}</a> header field name. Header used for VAST requests to provide the {@link 547 * #REFERER} header value that the on-behalf-of client would have used when making a request 548 * itself. 549 * 550 * @since 31.0 551 */ 552 public static final String X_DEVICE_REFERER = "X-Device-Referer"; 553 554 /** 555 * The HTTP <a 556 * href="https://iabtechlab.com/wp-content/uploads/2019/06/VAST_4.2_final_june26.pdf">{@code 557 * X-Device-Accept-Language}</a> header field name. Header used for VAST requests to provide the 558 * {@link #ACCEPT_LANGUAGE} header value that the on-behalf-of client would have used when making 559 * a request itself. 560 * 561 * @since 31.0 562 */ 563 public static final String X_DEVICE_ACCEPT_LANGUAGE = "X-Device-Accept-Language"; 564 565 /** 566 * The HTTP <a 567 * href="https://iabtechlab.com/wp-content/uploads/2019/06/VAST_4.2_final_june26.pdf">{@code 568 * X-Device-Requested-With}</a> header field name. Header used for VAST requests to provide the 569 * {@link #X_REQUESTED_WITH} header value that the on-behalf-of client would have used when making 570 * a request itself. 571 * 572 * @since 31.0 573 */ 574 public static final String X_DEVICE_REQUESTED_WITH = "X-Device-Requested-With"; 575 576 /** The HTTP {@code X-Do-Not-Track} header field name. */ 577 public static final String X_DO_NOT_TRACK = "X-Do-Not-Track"; 578 579 /** The HTTP {@code X-Forwarded-For} header field name (superseded by {@code Forwarded}). */ 580 public static final String X_FORWARDED_FOR = "X-Forwarded-For"; 581 582 /** The HTTP {@code X-Forwarded-Proto} header field name. */ 583 public static final String X_FORWARDED_PROTO = "X-Forwarded-Proto"; 584 585 /** 586 * The HTTP <a 587 * href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-Host">{@code 588 * X-Forwarded-Host}</a> header field name. 589 * 590 * @since 20.0 591 */ 592 public static final String X_FORWARDED_HOST = "X-Forwarded-Host"; 593 594 /** 595 * The HTTP <a 596 * href="https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/x-forwarded-headers.html#x-forwarded-port">{@code 597 * X-Forwarded-Port}</a> header field name. 598 * 599 * @since 20.0 600 */ 601 public static final String X_FORWARDED_PORT = "X-Forwarded-Port"; 602 603 /** The HTTP {@code X-Frame-Options} header field name. */ 604 public static final String X_FRAME_OPTIONS = "X-Frame-Options"; 605 606 /** The HTTP {@code X-Powered-By} header field name. */ 607 public static final String X_POWERED_BY = "X-Powered-By"; 608 609 /** 610 * The HTTP <a href="http://tools.ietf.org/html/draft-evans-palmer-key-pinning">{@code 611 * Public-Key-Pins}</a> header field name. 612 * 613 * @since 15.0 614 */ 615 public static final String PUBLIC_KEY_PINS = "Public-Key-Pins"; 616 617 /** 618 * The HTTP <a href="http://tools.ietf.org/html/draft-evans-palmer-key-pinning">{@code 619 * Public-Key-Pins-Report-Only}</a> header field name. 620 * 621 * @since 15.0 622 */ 623 public static final String PUBLIC_KEY_PINS_REPORT_ONLY = "Public-Key-Pins-Report-Only"; 624 625 /** 626 * The HTTP {@code X-Request-ID} header field name. 627 * 628 * @since 30.1 629 */ 630 public static final String X_REQUEST_ID = "X-Request-ID"; 631 632 /** The HTTP {@code X-Requested-With} header field name. */ 633 public static final String X_REQUESTED_WITH = "X-Requested-With"; 634 635 /** The HTTP {@code X-User-IP} header field name. */ 636 public static final String X_USER_IP = "X-User-IP"; 637 638 /** 639 * The HTTP <a 640 * href="https://learn.microsoft.com/en-us/archive/blogs/ieinternals/internet-explorer-and-custom-http-headers#:~:text=X%2DDownload%2DOptions">{@code 641 * X-Download-Options}</a> header field name. 642 * 643 * <p>When the new X-Download-Options header is present with the value {@code noopen}, the user is 644 * prevented from opening a file download directly; instead, they must first save the file 645 * locally. 646 * 647 * @since 24.1 648 */ 649 public static final String X_DOWNLOAD_OPTIONS = "X-Download-Options"; 650 651 /** The HTTP {@code X-XSS-Protection} header field name. */ 652 public static final String X_XSS_PROTECTION = "X-XSS-Protection"; 653 654 /** 655 * The HTTP <a 656 * href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-DNS-Prefetch-Control">{@code 657 * X-DNS-Prefetch-Control}</a> header controls DNS prefetch behavior. Value can be "on" or "off". 658 * By default, DNS prefetching is "on" for HTTP pages and "off" for HTTPS pages. 659 */ 660 public static final String X_DNS_PREFETCH_CONTROL = "X-DNS-Prefetch-Control"; 661 662 /** 663 * The HTTP <a href="http://html.spec.whatwg.org/multipage/semantics.html#hyperlink-auditing"> 664 * {@code Ping-From}</a> header field name. 665 * 666 * @since 19.0 667 */ 668 public static final String PING_FROM = "Ping-From"; 669 670 /** 671 * The HTTP <a href="http://html.spec.whatwg.org/multipage/semantics.html#hyperlink-auditing"> 672 * {@code Ping-To}</a> header field name. 673 * 674 * @since 19.0 675 */ 676 public static final String PING_TO = "Ping-To"; 677 678 /** 679 * The HTTP <a 680 * href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Link_prefetching_FAQ#As_a_server_admin.2C_can_I_distinguish_prefetch_requests_from_normal_requests.3F">{@code 681 * Purpose}</a> header field name. 682 * 683 * @since 28.0 684 */ 685 public static final String PURPOSE = "Purpose"; 686 687 /** 688 * The HTTP <a 689 * href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Link_prefetching_FAQ#As_a_server_admin.2C_can_I_distinguish_prefetch_requests_from_normal_requests.3F">{@code 690 * X-Purpose}</a> header field name. 691 * 692 * @since 28.0 693 */ 694 public static final String X_PURPOSE = "X-Purpose"; 695 696 /** 697 * The HTTP <a 698 * href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Link_prefetching_FAQ#As_a_server_admin.2C_can_I_distinguish_prefetch_requests_from_normal_requests.3F">{@code 699 * X-Moz}</a> header field name. 700 * 701 * @since 28.0 702 */ 703 public static final String X_MOZ = "X-Moz"; 704 705 /** 706 * The HTTP <a 707 * href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Device-Memory">{@code 708 * Device-Memory}</a> header field name. 709 * 710 * @since 31.0 711 */ 712 public static final String DEVICE_MEMORY = "Device-Memory"; 713 714 /** 715 * The HTTP <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Downlink">{@code 716 * Downlink}</a> header field name. 717 * 718 * @since 31.0 719 */ 720 public static final String DOWNLINK = "Downlink"; 721 722 /** 723 * The HTTP <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/ECT">{@code 724 * ECT}</a> header field name. 725 * 726 * @since 31.0 727 */ 728 public static final String ECT = "ECT"; 729 730 /** 731 * The HTTP <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/RTT">{@code 732 * RTT}</a> header field name. 733 * 734 * @since 31.0 735 */ 736 public static final String RTT = "RTT"; 737 738 /** 739 * The HTTP <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Save-Data">{@code 740 * Save-Data}</a> header field name. 741 * 742 * @since 31.0 743 */ 744 public static final String SAVE_DATA = "Save-Data"; 745 746 /** 747 * The HTTP <a 748 * href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Viewport-Width">{@code 749 * Viewport-Width}</a> header field name. 750 * 751 * @since 31.0 752 */ 753 public static final String VIEWPORT_WIDTH = "Viewport-Width"; 754 755 /** 756 * The HTTP <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Width">{@code 757 * Width}</a> header field name. 758 * 759 * @since 31.0 760 */ 761 public static final String WIDTH = "Width"; 762 763 /** 764 * The HTTP <a href="https://www.w3.org/TR/permissions-policy-1/">{@code Permissions-Policy}</a> 765 * header field name. 766 * 767 * @since 31.0 768 */ 769 public static final String PERMISSIONS_POLICY = "Permissions-Policy"; 770 771 /** 772 * The HTTP <a 773 * href="https://w3c.github.io/webappsec-permissions-policy/#permissions-policy-report-only-http-header-field">{@code 774 * Permissions-Policy-Report-Only}</a> header field name. 775 * 776 * @since 33.2.0 777 */ 778 public static final String PERMISSIONS_POLICY_REPORT_ONLY = "Permissions-Policy-Report-Only"; 779 780 /** 781 * The HTTP <a 782 * href="https://wicg.github.io/user-preference-media-features-headers/#sec-ch-prefers-color-scheme">{@code 783 * Sec-CH-Prefers-Color-Scheme}</a> header field name. 784 * 785 * <p>This header is experimental. 786 * 787 * @since 31.0 788 */ 789 public static final String SEC_CH_PREFERS_COLOR_SCHEME = "Sec-CH-Prefers-Color-Scheme"; 790 791 /** 792 * The HTTP <a 793 * href="https://www.rfc-editor.org/rfc/rfc8942#name-the-accept-ch-response-head">{@code 794 * Accept-CH}</a> header field name. 795 * 796 * @since 31.0 797 */ 798 public static final String ACCEPT_CH = "Accept-CH"; 799 800 /** 801 * The HTTP <a 802 * href="https://datatracker.ietf.org/doc/html/draft-davidben-http-client-hint-reliability-03.txt#section-3">{@code 803 * Critical-CH}</a> header field name. 804 * 805 * @since 31.0 806 */ 807 public static final String CRITICAL_CH = "Critical-CH"; 808 809 /** 810 * The HTTP <a href="https://wicg.github.io/ua-client-hints/#sec-ch-ua">{@code Sec-CH-UA}</a> 811 * header field name. 812 * 813 * @since 30.0 814 */ 815 public static final String SEC_CH_UA = "Sec-CH-UA"; 816 817 /** 818 * The HTTP <a href="https://wicg.github.io/ua-client-hints/#sec-ch-ua-arch">{@code 819 * Sec-CH-UA-Arch}</a> header field name. 820 * 821 * @since 30.0 822 */ 823 public static final String SEC_CH_UA_ARCH = "Sec-CH-UA-Arch"; 824 825 /** 826 * The HTTP <a href="https://wicg.github.io/ua-client-hints/#sec-ch-ua-model">{@code 827 * Sec-CH-UA-Model}</a> header field name. 828 * 829 * @since 30.0 830 */ 831 public static final String SEC_CH_UA_MODEL = "Sec-CH-UA-Model"; 832 833 /** 834 * The HTTP <a href="https://wicg.github.io/ua-client-hints/#sec-ch-ua-platform">{@code 835 * Sec-CH-UA-Platform}</a> header field name. 836 * 837 * @since 30.0 838 */ 839 public static final String SEC_CH_UA_PLATFORM = "Sec-CH-UA-Platform"; 840 841 /** 842 * The HTTP <a href="https://wicg.github.io/ua-client-hints/#sec-ch-ua-platform-version">{@code 843 * Sec-CH-UA-Platform-Version}</a> header field name. 844 * 845 * @since 30.0 846 */ 847 public static final String SEC_CH_UA_PLATFORM_VERSION = "Sec-CH-UA-Platform-Version"; 848 849 /** 850 * The HTTP <a href="https://wicg.github.io/ua-client-hints/#sec-ch-ua-full-version">{@code 851 * Sec-CH-UA-Full-Version}</a> header field name. 852 * 853 * @deprecated Prefer {@link SEC_CH_UA_FULL_VERSION_LIST}. 854 * @since 30.0 855 */ 856 @Deprecated public static final String SEC_CH_UA_FULL_VERSION = "Sec-CH-UA-Full-Version"; 857 858 /** 859 * The HTTP <a href="https://wicg.github.io/ua-client-hints/#sec-ch-ua-full-version-list">{@code 860 * Sec-CH-UA-Full-Version}</a> header field name. 861 * 862 * @since 31.1 863 */ 864 public static final String SEC_CH_UA_FULL_VERSION_LIST = "Sec-CH-UA-Full-Version-List"; 865 866 /** 867 * The HTTP <a href="https://wicg.github.io/ua-client-hints/#sec-ch-ua-mobile">{@code 868 * Sec-CH-UA-Mobile}</a> header field name. 869 * 870 * @since 30.0 871 */ 872 public static final String SEC_CH_UA_MOBILE = "Sec-CH-UA-Mobile"; 873 874 /** 875 * The HTTP <a href="https://wicg.github.io/ua-client-hints/#sec-ch-ua-wow64">{@code 876 * Sec-CH-UA-WoW64}</a> header field name. 877 * 878 * @since 32.0.0 879 */ 880 public static final String SEC_CH_UA_WOW64 = "Sec-CH-UA-WoW64"; 881 882 /** 883 * The HTTP <a href="https://wicg.github.io/ua-client-hints/#sec-ch-ua-bitness">{@code 884 * Sec-CH-UA-Bitness}</a> header field name. 885 * 886 * @since 31.0 887 */ 888 public static final String SEC_CH_UA_BITNESS = "Sec-CH-UA-Bitness"; 889 890 /** 891 * The HTTP <a href="https://wicg.github.io/ua-client-hints/#sec-ch-ua-form-factor">{@code 892 * Sec-CH-UA-Form-Factor}</a> header field name. 893 * 894 * @deprecated Prefer {@link SEC_CH_UA_FORM_FACTORS}. 895 * @since 32.0.0 896 */ 897 @Deprecated public static final String SEC_CH_UA_FORM_FACTOR = "Sec-CH-UA-Form-Factor"; 898 899 /** 900 * The HTTP <a href="https://wicg.github.io/ua-client-hints/#sec-ch-ua-form-factors">{@code 901 * Sec-CH-UA-Form-Factors}</a> header field name. 902 * 903 * @since 33.3.0 904 */ 905 public static final String SEC_CH_UA_FORM_FACTORS = "Sec-CH-UA-Form-Factors"; 906 907 /** 908 * The HTTP <a 909 * href="https://wicg.github.io/responsive-image-client-hints/#sec-ch-viewport-width">{@code 910 * Sec-CH-Viewport-Width}</a> header field name. 911 * 912 * @since 32.0.0 913 */ 914 public static final String SEC_CH_VIEWPORT_WIDTH = "Sec-CH-Viewport-Width"; 915 916 /** 917 * The HTTP <a 918 * href="https://wicg.github.io/responsive-image-client-hints/#sec-ch-viewport-height">{@code 919 * Sec-CH-Viewport-Height}</a> header field name. 920 * 921 * @since 32.0.0 922 */ 923 public static final String SEC_CH_VIEWPORT_HEIGHT = "Sec-CH-Viewport-Height"; 924 925 /** 926 * The HTTP <a href="https://wicg.github.io/responsive-image-client-hints/#sec-ch-dpr">{@code 927 * Sec-CH-DPR}</a> header field name. 928 * 929 * @since 32.0.0 930 */ 931 public static final String SEC_CH_DPR = "Sec-CH-DPR"; 932 933 /** 934 * The HTTP <a href="https://w3c.github.io/webappsec-fetch-metadata/">{@code Sec-Fetch-Dest}</a> 935 * header field name. 936 * 937 * @since 27.1 938 */ 939 public static final String SEC_FETCH_DEST = "Sec-Fetch-Dest"; 940 941 /** 942 * The HTTP <a href="https://w3c.github.io/webappsec-fetch-metadata/">{@code Sec-Fetch-Mode}</a> 943 * header field name. 944 * 945 * @since 27.1 946 */ 947 public static final String SEC_FETCH_MODE = "Sec-Fetch-Mode"; 948 949 /** 950 * The HTTP <a href="https://w3c.github.io/webappsec-fetch-metadata/">{@code Sec-Fetch-Site}</a> 951 * header field name. 952 * 953 * @since 27.1 954 */ 955 public static final String SEC_FETCH_SITE = "Sec-Fetch-Site"; 956 957 /** 958 * The HTTP <a href="https://w3c.github.io/webappsec-fetch-metadata/">{@code Sec-Fetch-User}</a> 959 * header field name. 960 * 961 * @since 27.1 962 */ 963 public static final String SEC_FETCH_USER = "Sec-Fetch-User"; 964 965 /** 966 * The HTTP <a href="https://w3c.github.io/webappsec-fetch-metadata/">{@code Sec-Metadata}</a> 967 * header field name. 968 * 969 * @since 26.0 970 */ 971 public static final String SEC_METADATA = "Sec-Metadata"; 972 973 /** 974 * The HTTP <a href="https://datatracker.ietf.org/doc/html/draft-ietf-tokbind-https">{@code 975 * Sec-Token-Binding}</a> header field name. 976 * 977 * @since 25.1 978 */ 979 public static final String SEC_TOKEN_BINDING = "Sec-Token-Binding"; 980 981 /** 982 * The HTTP <a href="https://datatracker.ietf.org/doc/html/draft-ietf-tokbind-ttrp">{@code 983 * Sec-Provided-Token-Binding-ID}</a> header field name. 984 * 985 * @since 25.1 986 */ 987 public static final String SEC_PROVIDED_TOKEN_BINDING_ID = "Sec-Provided-Token-Binding-ID"; 988 989 /** 990 * The HTTP <a href="https://datatracker.ietf.org/doc/html/draft-ietf-tokbind-ttrp">{@code 991 * Sec-Referred-Token-Binding-ID}</a> header field name. 992 * 993 * @since 25.1 994 */ 995 public static final String SEC_REFERRED_TOKEN_BINDING_ID = "Sec-Referred-Token-Binding-ID"; 996 997 /** 998 * The HTTP <a href="https://datatracker.ietf.org/doc/html/rfc6455">{@code 999 * Sec-WebSocket-Accept}</a> header field name. 1000 * 1001 * @since 28.0 1002 */ 1003 public static final String SEC_WEBSOCKET_ACCEPT = "Sec-WebSocket-Accept"; 1004 1005 /** 1006 * The HTTP <a href="https://datatracker.ietf.org/doc/html/rfc6455">{@code 1007 * Sec-WebSocket-Extensions}</a> header field name. 1008 * 1009 * @since 28.0 1010 */ 1011 public static final String SEC_WEBSOCKET_EXTENSIONS = "Sec-WebSocket-Extensions"; 1012 1013 /** 1014 * The HTTP <a href="https://datatracker.ietf.org/doc/html/rfc6455">{@code Sec-WebSocket-Key}</a> 1015 * header field name. 1016 * 1017 * @since 28.0 1018 */ 1019 public static final String SEC_WEBSOCKET_KEY = "Sec-WebSocket-Key"; 1020 1021 /** 1022 * The HTTP <a href="https://datatracker.ietf.org/doc/html/rfc6455">{@code 1023 * Sec-WebSocket-Protocol}</a> header field name. 1024 * 1025 * @since 28.0 1026 */ 1027 public static final String SEC_WEBSOCKET_PROTOCOL = "Sec-WebSocket-Protocol"; 1028 1029 /** 1030 * The HTTP <a href="https://datatracker.ietf.org/doc/html/rfc6455">{@code 1031 * Sec-WebSocket-Version}</a> header field name. 1032 * 1033 * @since 28.0 1034 */ 1035 public static final String SEC_WEBSOCKET_VERSION = "Sec-WebSocket-Version"; 1036 1037 /** 1038 * The HTTP <a href="https://patcg-individual-drafts.github.io/topics/">{@code 1039 * Sec-Browsing-Topics}</a> header field name. 1040 * 1041 * @since 32.0.0 1042 */ 1043 public static final String SEC_BROWSING_TOPICS = "Sec-Browsing-Topics"; 1044 1045 /** 1046 * The HTTP <a href="https://patcg-individual-drafts.github.io/topics/">{@code 1047 * Observe-Browsing-Topics}</a> header field name. 1048 * 1049 * @since 32.0.0 1050 */ 1051 public static final String OBSERVE_BROWSING_TOPICS = "Observe-Browsing-Topics"; 1052 1053 /** 1054 * The HTTP <a 1055 * href="https://wicg.github.io/turtledove/#handling-direct-from-seller-signals">{@code 1056 * Sec-Ad-Auction-Fetch}</a> header field name. 1057 * 1058 * @since 33.0.0 1059 */ 1060 public static final String SEC_AD_AUCTION_FETCH = "Sec-Ad-Auction-Fetch"; 1061 1062 /** 1063 * The HTTP <a 1064 * href="https://privacycg.github.io/gpc-spec/#the-sec-gpc-header-field-for-http-requests">{@code 1065 * Sec-GPC}</a> header field name. 1066 * 1067 * @since 33.2.0 1068 */ 1069 public static final String SEC_GPC = "Sec-GPC"; 1070 1071 /** 1072 * The HTTP <a 1073 * href="https://wicg.github.io/turtledove/#handling-direct-from-seller-signals">{@code 1074 * Ad-Auction-Signals}</a> header field name. 1075 * 1076 * @since 33.0.0 1077 */ 1078 public static final String AD_AUCTION_SIGNALS = "Ad-Auction-Signals"; 1079 1080 /** 1081 * The HTTP <a href="https://wicg.github.io/turtledove/#http-headerdef-ad-auction-allowed">{@code 1082 * Ad-Auction-Allowed}</a> header field name. 1083 * 1084 * @since 33.2.0 1085 */ 1086 public static final String AD_AUCTION_ALLOWED = "Ad-Auction-Allowed"; 1087 1088 /** 1089 * The HTTP <a href="https://datatracker.ietf.org/doc/html/rfc8586">{@code CDN-Loop}</a> header 1090 * field name. 1091 * 1092 * @since 28.0 1093 */ 1094 public static final String CDN_LOOP = "CDN-Loop"; 1095 1096 /** 1097 * The HTTP <a href="https://datatracker.ietf.org/doc/html/rfc7838#page-8">{@code Alt-Svc}</a> 1098 * header field name. 1099 * 1100 * @since 33.4.0 1101 */ 1102 public static final String ALT_SVC = "Alt-Svc"; 1103}