001/* 002 * Copyright (C) 2011 The Guava Authors 003 * 004 * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except 005 * in compliance with the License. You may obtain a copy of the License at 006 * 007 * http://www.apache.org/licenses/LICENSE-2.0 008 * 009 * Unless required by applicable law or agreed to in writing, software distributed under the License 010 * is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express 011 * or implied. See the License for the specific language governing permissions and limitations under 012 * the License. 013 */ 014 015package com.google.common.net; 016 017import com.google.common.annotations.Beta; 018import com.google.common.annotations.GwtCompatible; 019 020/** 021 * Contains constant definitions for the HTTP header field names. See: 022 * 023 * <ul> 024 * <li><a href="http://www.ietf.org/rfc/rfc2109.txt">RFC 2109</a> 025 * <li><a href="http://www.ietf.org/rfc/rfc2183.txt">RFC 2183</a> 026 * <li><a href="http://www.ietf.org/rfc/rfc2616.txt">RFC 2616</a> 027 * <li><a href="http://www.ietf.org/rfc/rfc2965.txt">RFC 2965</a> 028 * <li><a href="http://www.ietf.org/rfc/rfc5988.txt">RFC 5988</a> 029 * </ul> 030 * 031 * 032 * @author Kurt Alfred Kluever 033 * @since 11.0 034 */ 035@GwtCompatible 036public final class HttpHeaders { 037 private HttpHeaders() {} 038 039 // HTTP Request and Response header fields 040 041 /** The HTTP {@code Cache-Control} header field name. */ 042 public static final String CACHE_CONTROL = "Cache-Control"; 043 /** The HTTP {@code Content-Length} header field name. */ 044 public static final String CONTENT_LENGTH = "Content-Length"; 045 /** The HTTP {@code Content-Type} header field name. */ 046 public static final String CONTENT_TYPE = "Content-Type"; 047 /** The HTTP {@code Date} header field name. */ 048 public static final String DATE = "Date"; 049 /** The HTTP {@code Pragma} header field name. */ 050 public static final String PRAGMA = "Pragma"; 051 /** The HTTP {@code Via} header field name. */ 052 public static final String VIA = "Via"; 053 /** The HTTP {@code Warning} header field name. */ 054 public static final String WARNING = "Warning"; 055 056 // HTTP Request header fields 057 058 /** The HTTP {@code Accept} header field name. */ 059 public static final String ACCEPT = "Accept"; 060 /** The HTTP {@code Accept-Charset} header field name. */ 061 public static final String ACCEPT_CHARSET = "Accept-Charset"; 062 /** The HTTP {@code Accept-Encoding} header field name. */ 063 public static final String ACCEPT_ENCODING = "Accept-Encoding"; 064 /** The HTTP {@code Accept-Language} header field name. */ 065 public static final String ACCEPT_LANGUAGE = "Accept-Language"; 066 /** The HTTP {@code Access-Control-Request-Headers} header field name. */ 067 public static final String ACCESS_CONTROL_REQUEST_HEADERS = "Access-Control-Request-Headers"; 068 /** The HTTP {@code Access-Control-Request-Method} header field name. */ 069 public static final String ACCESS_CONTROL_REQUEST_METHOD = "Access-Control-Request-Method"; 070 /** The HTTP {@code Authorization} header field name. */ 071 public static final String AUTHORIZATION = "Authorization"; 072 /** The HTTP {@code Connection} header field name. */ 073 public static final String CONNECTION = "Connection"; 074 /** The HTTP {@code Cookie} header field name. */ 075 public static final String COOKIE = "Cookie"; 076 /** The HTTP {@code Expect} header field name. */ 077 public static final String EXPECT = "Expect"; 078 /** The HTTP {@code From} header field name. */ 079 public static final String FROM = "From"; 080 /** 081 * The HTTP <a href="https://tools.ietf.org/html/rfc7239">{@code Forwarded}</a> header field name. 082 * 083 * @since 20.0 084 */ 085 public static final String FORWARDED = "Forwarded"; 086 /** 087 * The HTTP {@code Follow-Only-When-Prerender-Shown} header field name. 088 * 089 * @since 17.0 090 */ 091 @Beta 092 public static final String FOLLOW_ONLY_WHEN_PRERENDER_SHOWN = "Follow-Only-When-Prerender-Shown"; 093 /** The HTTP {@code Host} header field name. */ 094 public static final String HOST = "Host"; 095 /** The HTTP {@code If-Match} header field name. */ 096 public static final String IF_MATCH = "If-Match"; 097 /** The HTTP {@code If-Modified-Since} header field name. */ 098 public static final String IF_MODIFIED_SINCE = "If-Modified-Since"; 099 /** The HTTP {@code If-None-Match} header field name. */ 100 public static final String IF_NONE_MATCH = "If-None-Match"; 101 /** The HTTP {@code If-Range} header field name. */ 102 public static final String IF_RANGE = "If-Range"; 103 /** The HTTP {@code If-Unmodified-Since} header field name. */ 104 public static final String IF_UNMODIFIED_SINCE = "If-Unmodified-Since"; 105 /** The HTTP {@code Last-Event-ID} header field name. */ 106 public static final String LAST_EVENT_ID = "Last-Event-ID"; 107 /** The HTTP {@code Max-Forwards} header field name. */ 108 public static final String MAX_FORWARDS = "Max-Forwards"; 109 /** The HTTP {@code Origin} header field name. */ 110 public static final String ORIGIN = "Origin"; 111 /** The HTTP {@code Proxy-Authorization} header field name. */ 112 public static final String PROXY_AUTHORIZATION = "Proxy-Authorization"; 113 /** The HTTP {@code Range} header field name. */ 114 public static final String RANGE = "Range"; 115 /** The HTTP {@code Referer} header field name. */ 116 public static final String REFERER = "Referer"; 117 /** 118 * The HTTP <a href="https://www.w3.org/TR/referrer-policy/">{@code Referrer-Policy}</a> header 119 * field name. 120 * 121 * @since 23.4 122 */ 123 public static final String REFERRER_POLICY = "Referrer-Policy"; 124 125 /** 126 * Values for the <a href="https://www.w3.org/TR/referrer-policy/">{@code Referrer-Policy}</a> 127 * header. 128 * 129 * @since 23.4 130 */ 131 public static final class ReferrerPolicyValues { 132 private ReferrerPolicyValues() {} 133 134 public static final String NO_REFERRER = "no-referrer"; 135 public static final String NO_REFFERER_WHEN_DOWNGRADE = "no-referrer-when-downgrade"; 136 public static final String SAME_ORIGIN = "same-origin"; 137 public static final String ORIGIN = "origin"; 138 public static final String STRICT_ORIGIN = "strict-origin"; 139 public static final String ORIGIN_WHEN_CROSS_ORIGIN = "origin-when-cross-origin"; 140 public static final String STRICT_ORIGIN_WHEN_CROSS_ORIGIN = "strict-origin-when-cross-origin"; 141 public static final String UNSAFE_URL = "unsafe-url"; 142 } 143 144 /** 145 * The HTTP <a href="https://www.w3.org/TR/service-workers/#update-algorithm">{@code 146 * Service-Worker}</a> header field name. 147 */ 148 public static final String SERVICE_WORKER = "Service-Worker"; 149 /** The HTTP {@code TE} header field name. */ 150 public static final String TE = "TE"; 151 /** The HTTP {@code Upgrade} header field name. */ 152 public static final String UPGRADE = "Upgrade"; 153 /** The HTTP {@code User-Agent} header field name. */ 154 public static final String USER_AGENT = "User-Agent"; 155 156 // HTTP Response header fields 157 158 /** The HTTP {@code Accept-Ranges} header field name. */ 159 public static final String ACCEPT_RANGES = "Accept-Ranges"; 160 /** The HTTP {@code Access-Control-Allow-Headers} header field name. */ 161 public static final String ACCESS_CONTROL_ALLOW_HEADERS = "Access-Control-Allow-Headers"; 162 /** The HTTP {@code Access-Control-Allow-Methods} header field name. */ 163 public static final String ACCESS_CONTROL_ALLOW_METHODS = "Access-Control-Allow-Methods"; 164 /** The HTTP {@code Access-Control-Allow-Origin} header field name. */ 165 public static final String ACCESS_CONTROL_ALLOW_ORIGIN = "Access-Control-Allow-Origin"; 166 /** The HTTP {@code Access-Control-Allow-Credentials} header field name. */ 167 public static final String ACCESS_CONTROL_ALLOW_CREDENTIALS = "Access-Control-Allow-Credentials"; 168 /** The HTTP {@code Access-Control-Expose-Headers} header field name. */ 169 public static final String ACCESS_CONTROL_EXPOSE_HEADERS = "Access-Control-Expose-Headers"; 170 /** The HTTP {@code Access-Control-Max-Age} header field name. */ 171 public static final String ACCESS_CONTROL_MAX_AGE = "Access-Control-Max-Age"; 172 /** The HTTP {@code Age} header field name. */ 173 public static final String AGE = "Age"; 174 /** The HTTP {@code Allow} header field name. */ 175 public static final String ALLOW = "Allow"; 176 /** The HTTP {@code Content-Disposition} header field name. */ 177 public static final String CONTENT_DISPOSITION = "Content-Disposition"; 178 /** The HTTP {@code Content-Encoding} header field name. */ 179 public static final String CONTENT_ENCODING = "Content-Encoding"; 180 /** The HTTP {@code Content-Language} header field name. */ 181 public static final String CONTENT_LANGUAGE = "Content-Language"; 182 /** The HTTP {@code Content-Location} header field name. */ 183 public static final String CONTENT_LOCATION = "Content-Location"; 184 /** The HTTP {@code Content-MD5} header field name. */ 185 public static final String CONTENT_MD5 = "Content-MD5"; 186 /** The HTTP {@code Content-Range} header field name. */ 187 public static final String CONTENT_RANGE = "Content-Range"; 188 /** 189 * The HTTP <a href="http://w3.org/TR/CSP/#content-security-policy-header-field">{@code 190 * Content-Security-Policy}</a> header field name. 191 * 192 * @since 15.0 193 */ 194 public static final String CONTENT_SECURITY_POLICY = "Content-Security-Policy"; 195 /** 196 * The HTTP <a href="http://w3.org/TR/CSP/#content-security-policy-report-only-header-field"> 197 * {@code Content-Security-Policy-Report-Only}</a> header field name. 198 * 199 * @since 15.0 200 */ 201 public static final String CONTENT_SECURITY_POLICY_REPORT_ONLY = 202 "Content-Security-Policy-Report-Only"; 203 /** 204 * The HTTP nonstandard {@code X-Content-Security-Policy} header field name. It was introduced in 205 * <a href="https://www.w3.org/TR/2011/WD-CSP-20111129/">CSP v.1</a> and used by the Firefox until 206 * version 23 and the Internet Explorer version 10. Please, use {@link #CONTENT_SECURITY_POLICY} 207 * to pass the CSP. 208 * 209 * @since 20.0 210 */ 211 public static final String X_CONTENT_SECURITY_POLICY = "X-Content-Security-Policy"; 212 /** 213 * The HTTP nonstandard {@code X-Content-Security-Policy-Report-Only} header field name. It was 214 * introduced in <a href="https://www.w3.org/TR/2011/WD-CSP-20111129/">CSP v.1</a> and used by the 215 * Firefox until version 23 and the Internet Explorer version 10. Please, use {@link 216 * #CONTENT_SECURITY_POLICY_REPORT_ONLY} to pass the CSP. 217 * 218 * @since 20.0 219 */ 220 public static final String X_CONTENT_SECURITY_POLICY_REPORT_ONLY = 221 "X-Content-Security-Policy-Report-Only"; 222 /** 223 * The HTTP nonstandard {@code X-WebKit-CSP} header field name. It was introduced in <a 224 * href="https://www.w3.org/TR/2011/WD-CSP-20111129/">CSP v.1</a> and used by the Chrome until 225 * version 25. Please, use {@link #CONTENT_SECURITY_POLICY} to pass the CSP. 226 * 227 * @since 20.0 228 */ 229 public static final String X_WEBKIT_CSP = "X-WebKit-CSP"; 230 /** 231 * The HTTP nonstandard {@code X-WebKit-CSP-Report-Only} header field name. It was introduced in 232 * <a href="https://www.w3.org/TR/2011/WD-CSP-20111129/">CSP v.1</a> and used by the Chrome until 233 * version 25. Please, use {@link #CONTENT_SECURITY_POLICY_REPORT_ONLY} to pass the CSP. 234 * 235 * @since 20.0 236 */ 237 public static final String X_WEBKIT_CSP_REPORT_ONLY = "X-WebKit-CSP-Report-Only"; 238 /** The HTTP {@code ETag} header field name. */ 239 public static final String ETAG = "ETag"; 240 /** The HTTP {@code Expires} header field name. */ 241 public static final String EXPIRES = "Expires"; 242 /** The HTTP {@code Last-Modified} header field name. */ 243 public static final String LAST_MODIFIED = "Last-Modified"; 244 /** The HTTP {@code Link} header field name. */ 245 public static final String LINK = "Link"; 246 /** The HTTP {@code Location} header field name. */ 247 public static final String LOCATION = "Location"; 248 /** The HTTP {@code P3P} header field name. Limited browser support. */ 249 public static final String P3P = "P3P"; 250 /** The HTTP {@code Proxy-Authenticate} header field name. */ 251 public static final String PROXY_AUTHENTICATE = "Proxy-Authenticate"; 252 /** The HTTP {@code Refresh} header field name. Non-standard header supported by most browsers. */ 253 public static final String REFRESH = "Refresh"; 254 /** The HTTP {@code Retry-After} header field name. */ 255 public static final String RETRY_AFTER = "Retry-After"; 256 /** The HTTP {@code Server} header field name. */ 257 public static final String SERVER = "Server"; 258 /** 259 * The HTTP <a href="https://www.w3.org/TR/server-timing/">{@code Server-Timing}</a> header field 260 * name. 261 * 262 * @since 23.6 263 */ 264 public static final String SERVER_TIMING = "Server-Timing"; 265 /** 266 * The HTTP <a href="https://www.w3.org/TR/service-workers/#update-algorithm">{@code 267 * Service-Worker-Allowed}</a> header field name. 268 * 269 * @since 20.0 270 */ 271 public static final String SERVICE_WORKER_ALLOWED = "Service-Worker-Allowed"; 272 /** The HTTP {@code Set-Cookie} header field name. */ 273 public static final String SET_COOKIE = "Set-Cookie"; 274 /** The HTTP {@code Set-Cookie2} header field name. */ 275 public static final String SET_COOKIE2 = "Set-Cookie2"; 276 /** 277 * The HTTP <a href="http://tools.ietf.org/html/rfc6797#section-6.1">{@code 278 * Strict-Transport-Security}</a> header field name. 279 * 280 * @since 15.0 281 */ 282 public static final String STRICT_TRANSPORT_SECURITY = "Strict-Transport-Security"; 283 /** 284 * The HTTP <a href="http://www.w3.org/TR/resource-timing/#cross-origin-resources">{@code 285 * Timing-Allow-Origin}</a> header field name. 286 * 287 * @since 15.0 288 */ 289 public static final String TIMING_ALLOW_ORIGIN = "Timing-Allow-Origin"; 290 /** The HTTP {@code Trailer} header field name. */ 291 public static final String TRAILER = "Trailer"; 292 /** The HTTP {@code Transfer-Encoding} header field name. */ 293 public static final String TRANSFER_ENCODING = "Transfer-Encoding"; 294 /** The HTTP {@code Vary} header field name. */ 295 public static final String VARY = "Vary"; 296 /** The HTTP {@code WWW-Authenticate} header field name. */ 297 public static final String WWW_AUTHENTICATE = "WWW-Authenticate"; 298 299 // Common, non-standard HTTP header fields 300 301 /** The HTTP {@code DNT} header field name. */ 302 public static final String DNT = "DNT"; 303 /** The HTTP {@code X-Content-Type-Options} header field name. */ 304 public static final String X_CONTENT_TYPE_OPTIONS = "X-Content-Type-Options"; 305 /** The HTTP {@code X-Do-Not-Track} header field name. */ 306 public static final String X_DO_NOT_TRACK = "X-Do-Not-Track"; 307 /** The HTTP {@code X-Forwarded-For} header field name (superseded by {@code Forwarded}). */ 308 public static final String X_FORWARDED_FOR = "X-Forwarded-For"; 309 /** The HTTP {@code X-Forwarded-Proto} header field name. */ 310 public static final String X_FORWARDED_PROTO = "X-Forwarded-Proto"; 311 /** 312 * The HTTP <a href="http://goo.gl/lQirAH">{@code X-Forwarded-Host}</a> header field name. 313 * 314 * @since 20.0 315 */ 316 public static final String X_FORWARDED_HOST = "X-Forwarded-Host"; 317 /** 318 * The HTTP <a href="http://goo.gl/YtV2at">{@code X-Forwarded-Port}</a> header field name. 319 * 320 * @since 20.0 321 */ 322 public static final String X_FORWARDED_PORT = "X-Forwarded-Port"; 323 /** The HTTP {@code X-Frame-Options} header field name. */ 324 public static final String X_FRAME_OPTIONS = "X-Frame-Options"; 325 /** The HTTP {@code X-Powered-By} header field name. */ 326 public static final String X_POWERED_BY = "X-Powered-By"; 327 /** 328 * The HTTP <a href="http://tools.ietf.org/html/draft-evans-palmer-key-pinning">{@code 329 * Public-Key-Pins}</a> header field name. 330 * 331 * @since 15.0 332 */ 333 @Beta public static final String PUBLIC_KEY_PINS = "Public-Key-Pins"; 334 /** 335 * The HTTP <a href="http://tools.ietf.org/html/draft-evans-palmer-key-pinning">{@code 336 * Public-Key-Pins-Report-Only}</a> header field name. 337 * 338 * @since 15.0 339 */ 340 @Beta public static final String PUBLIC_KEY_PINS_REPORT_ONLY = "Public-Key-Pins-Report-Only"; 341 /** The HTTP {@code X-Requested-With} header field name. */ 342 public static final String X_REQUESTED_WITH = "X-Requested-With"; 343 /** The HTTP {@code X-User-IP} header field name. */ 344 public static final String X_USER_IP = "X-User-IP"; 345 /** The HTTP {@code X-XSS-Protection} header field name. */ 346 public static final String X_XSS_PROTECTION = "X-XSS-Protection"; 347 /** 348 * The HTTP <a 349 * href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-DNS-Prefetch-Control">{@code 350 * X-DNS-Prefetch-Control}</a> header controls DNS prefetch behavior. Value can be "on" or "off". 351 * By default, DNS prefetching is "on" for HTTP pages and "off" for HTTPS pages. 352 */ 353 public static final String X_DNS_PREFETCH_CONTROL = "X-DNS-Prefetch-Control"; 354 /** 355 * The HTTP <a href="http://html.spec.whatwg.org/multipage/semantics.html#hyperlink-auditing"> 356 * {@code Ping-From}</a> header field name. 357 * 358 * @since 19.0 359 */ 360 public static final String PING_FROM = "Ping-From"; 361 /** 362 * The HTTP <a href="http://html.spec.whatwg.org/multipage/semantics.html#hyperlink-auditing"> 363 * {@code Ping-To}</a> header field name. 364 * 365 * @since 19.0 366 */ 367 public static final String PING_TO = "Ping-To"; 368}