001/*
002 * Copyright (C) 2011 The Guava Authors
003 *
004 * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except
005 * in compliance with the License. You may obtain a copy of the License at
006 *
007 * http://www.apache.org/licenses/LICENSE-2.0
008 *
009 * Unless required by applicable law or agreed to in writing, software distributed under the License
010 * is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express
011 * or implied. See the License for the specific language governing permissions and limitations under
012 * the License.
013 */
014
015package com.google.common.net;
016
017import com.google.common.annotations.GwtCompatible;
018
019/**
020 * Contains constant definitions for the HTTP header field names. See:
021 *
022 * <ul>
023 *   <li><a href="http://www.ietf.org/rfc/rfc2109.txt">RFC 2109</a>
024 *   <li><a href="http://www.ietf.org/rfc/rfc2183.txt">RFC 2183</a>
025 *   <li><a href="http://www.ietf.org/rfc/rfc2616.txt">RFC 2616</a>
026 *   <li><a href="http://www.ietf.org/rfc/rfc2965.txt">RFC 2965</a>
027 *   <li><a href="http://www.ietf.org/rfc/rfc5988.txt">RFC 5988</a>
028 * </ul>
029 *
030 * @author Kurt Alfred Kluever
031 * @since 11.0
032 */
033@GwtCompatible
034public final class HttpHeaders {
035  private HttpHeaders() {}
036
037  // HTTP Request and Response header fields
038
039  /** The HTTP {@code Cache-Control} header field name. */
040  public static final String CACHE_CONTROL = "Cache-Control";
041
042  /** The HTTP {@code Content-Length} header field name. */
043  public static final String CONTENT_LENGTH = "Content-Length";
044
045  /** The HTTP {@code Content-Type} header field name. */
046  public static final String CONTENT_TYPE = "Content-Type";
047
048  /** The HTTP {@code Date} header field name. */
049  public static final String DATE = "Date";
050
051  /** The HTTP {@code Pragma} header field name. */
052  public static final String PRAGMA = "Pragma";
053
054  /** The HTTP {@code Via} header field name. */
055  public static final String VIA = "Via";
056
057  /** The HTTP {@code Warning} header field name. */
058  public static final String WARNING = "Warning";
059
060  // HTTP Request header fields
061
062  /** The HTTP {@code Accept} header field name. */
063  public static final String ACCEPT = "Accept";
064
065  /** The HTTP {@code Accept-Charset} header field name. */
066  public static final String ACCEPT_CHARSET = "Accept-Charset";
067
068  /** The HTTP {@code Accept-Encoding} header field name. */
069  public static final String ACCEPT_ENCODING = "Accept-Encoding";
070
071  /** The HTTP {@code Accept-Language} header field name. */
072  public static final String ACCEPT_LANGUAGE = "Accept-Language";
073
074  /** The HTTP {@code Access-Control-Request-Headers} header field name. */
075  public static final String ACCESS_CONTROL_REQUEST_HEADERS = "Access-Control-Request-Headers";
076
077  /** The HTTP {@code Access-Control-Request-Method} header field name. */
078  public static final String ACCESS_CONTROL_REQUEST_METHOD = "Access-Control-Request-Method";
079
080  /** The HTTP {@code Authorization} header field name. */
081  public static final String AUTHORIZATION = "Authorization";
082
083  /** The HTTP {@code Connection} header field name. */
084  public static final String CONNECTION = "Connection";
085
086  /** The HTTP {@code Cookie} header field name. */
087  public static final String COOKIE = "Cookie";
088
089  /**
090   * The HTTP <a href="https://fetch.spec.whatwg.org/#cross-origin-resource-policy-header">{@code
091   * Cross-Origin-Resource-Policy}</a> header field name.
092   *
093   * @since 28.0
094   */
095  public static final String CROSS_ORIGIN_RESOURCE_POLICY = "Cross-Origin-Resource-Policy";
096
097  /**
098   * The HTTP <a href="https://datatracker.ietf.org/doc/html/rfc8470">{@code Early-Data}</a> header
099   * field name.
100   *
101   * @since 27.0
102   */
103  public static final String EARLY_DATA = "Early-Data";
104
105  /** The HTTP {@code Expect} header field name. */
106  public static final String EXPECT = "Expect";
107
108  /** The HTTP {@code From} header field name. */
109  public static final String FROM = "From";
110
111  /**
112   * The HTTP <a href="https://datatracker.ietf.org/doc/html/rfc7239">{@code Forwarded}</a> header
113   * field name.
114   *
115   * @since 20.0
116   */
117  public static final String FORWARDED = "Forwarded";
118
119  /**
120   * The HTTP {@code Follow-Only-When-Prerender-Shown} header field name.
121   *
122   * @since 17.0
123   */
124  public static final String FOLLOW_ONLY_WHEN_PRERENDER_SHOWN = "Follow-Only-When-Prerender-Shown";
125
126  /** The HTTP {@code Host} header field name. */
127  public static final String HOST = "Host";
128
129  /**
130   * The HTTP <a href="https://datatracker.ietf.org/doc/html/rfc7540#section-3.2.1">{@code
131   * HTTP2-Settings} </a> header field name.
132   *
133   * @since 24.0
134   */
135  public static final String HTTP2_SETTINGS = "HTTP2-Settings";
136
137  /** The HTTP {@code If-Match} header field name. */
138  public static final String IF_MATCH = "If-Match";
139
140  /** The HTTP {@code If-Modified-Since} header field name. */
141  public static final String IF_MODIFIED_SINCE = "If-Modified-Since";
142
143  /** The HTTP {@code If-None-Match} header field name. */
144  public static final String IF_NONE_MATCH = "If-None-Match";
145
146  /** The HTTP {@code If-Range} header field name. */
147  public static final String IF_RANGE = "If-Range";
148
149  /** The HTTP {@code If-Unmodified-Since} header field name. */
150  public static final String IF_UNMODIFIED_SINCE = "If-Unmodified-Since";
151
152  /** The HTTP {@code Last-Event-ID} header field name. */
153  public static final String LAST_EVENT_ID = "Last-Event-ID";
154
155  /** The HTTP {@code Max-Forwards} header field name. */
156  public static final String MAX_FORWARDS = "Max-Forwards";
157
158  /** The HTTP {@code Origin} header field name. */
159  public static final String ORIGIN = "Origin";
160
161  /**
162   * The HTTP <a href="https://github.com/WICG/origin-isolation">{@code Origin-Isolation}</a> header
163   * field name.
164   *
165   * @since 30.1
166   */
167  public static final String ORIGIN_ISOLATION = "Origin-Isolation";
168
169  /** The HTTP {@code Proxy-Authorization} header field name. */
170  public static final String PROXY_AUTHORIZATION = "Proxy-Authorization";
171
172  /** The HTTP {@code Range} header field name. */
173  public static final String RANGE = "Range";
174
175  /** The HTTP {@code Referer} header field name. */
176  public static final String REFERER = "Referer";
177
178  /**
179   * The HTTP <a href="https://www.w3.org/TR/referrer-policy/">{@code Referrer-Policy}</a> header
180   * field name.
181   *
182   * @since 23.4
183   */
184  public static final String REFERRER_POLICY = "Referrer-Policy";
185
186  /**
187   * Values for the <a href="https://www.w3.org/TR/referrer-policy/">{@code Referrer-Policy}</a>
188   * header.
189   *
190   * @since 23.4
191   */
192  public static final class ReferrerPolicyValues {
193    private ReferrerPolicyValues() {}
194
195    /** The {@code no-referrer} referrer policy. */
196    public static final String NO_REFERRER = "no-referrer";
197
198    /** The {@code no-referrer-when-downgrade} referrer policy. */
199    public static final String NO_REFFERER_WHEN_DOWNGRADE = "no-referrer-when-downgrade";
200
201    /** The {@code same-origin} referrer policy. */
202    public static final String SAME_ORIGIN = "same-origin";
203
204    /** The {@code origin} referrer policy. */
205    public static final String ORIGIN = "origin";
206
207    /** The {@code strict-origin} referrer policy. */
208    public static final String STRICT_ORIGIN = "strict-origin";
209
210    /** The {@code origin-when-cross-origin} referrer policy. */
211    public static final String ORIGIN_WHEN_CROSS_ORIGIN = "origin-when-cross-origin";
212
213    /** The {@code strict-origin-when-cross-origin} referrer policy. */
214    public static final String STRICT_ORIGIN_WHEN_CROSS_ORIGIN = "strict-origin-when-cross-origin";
215
216    /** The {@code unsafe-url} referrer policy. */
217    public static final String UNSAFE_URL = "unsafe-url";
218  }
219
220  /**
221   * The HTTP <a href="https://www.w3.org/TR/service-workers/#update-algorithm">{@code
222   * Service-Worker}</a> header field name.
223   *
224   * @since 20.0
225   */
226  public static final String SERVICE_WORKER = "Service-Worker";
227
228  /** The HTTP {@code TE} header field name. */
229  public static final String TE = "TE";
230
231  /** The HTTP {@code Upgrade} header field name. */
232  public static final String UPGRADE = "Upgrade";
233
234  /**
235   * The HTTP <a href="https://w3c.github.io/webappsec-upgrade-insecure-requests/#preference">{@code
236   * Upgrade-Insecure-Requests}</a> header field name.
237   *
238   * @since 28.1
239   */
240  public static final String UPGRADE_INSECURE_REQUESTS = "Upgrade-Insecure-Requests";
241
242  /** The HTTP {@code User-Agent} header field name. */
243  public static final String USER_AGENT = "User-Agent";
244
245  // HTTP Response header fields
246
247  /** The HTTP {@code Accept-Ranges} header field name. */
248  public static final String ACCEPT_RANGES = "Accept-Ranges";
249
250  /** The HTTP {@code Access-Control-Allow-Headers} header field name. */
251  public static final String ACCESS_CONTROL_ALLOW_HEADERS = "Access-Control-Allow-Headers";
252
253  /** The HTTP {@code Access-Control-Allow-Methods} header field name. */
254  public static final String ACCESS_CONTROL_ALLOW_METHODS = "Access-Control-Allow-Methods";
255
256  /** The HTTP {@code Access-Control-Allow-Origin} header field name. */
257  public static final String ACCESS_CONTROL_ALLOW_ORIGIN = "Access-Control-Allow-Origin";
258
259  /**
260   * The HTTP <a href="https://wicg.github.io/private-network-access/#headers">{@code
261   * Access-Control-Allow-Private-Network}</a> header field name.
262   *
263   * @since 31.1
264   */
265  public static final String ACCESS_CONTROL_ALLOW_PRIVATE_NETWORK =
266      "Access-Control-Allow-Private-Network";
267
268  /** The HTTP {@code Access-Control-Allow-Credentials} header field name. */
269  public static final String ACCESS_CONTROL_ALLOW_CREDENTIALS = "Access-Control-Allow-Credentials";
270
271  /** The HTTP {@code Access-Control-Expose-Headers} header field name. */
272  public static final String ACCESS_CONTROL_EXPOSE_HEADERS = "Access-Control-Expose-Headers";
273
274  /** The HTTP {@code Access-Control-Max-Age} header field name. */
275  public static final String ACCESS_CONTROL_MAX_AGE = "Access-Control-Max-Age";
276
277  /** The HTTP {@code Age} header field name. */
278  public static final String AGE = "Age";
279
280  /** The HTTP {@code Allow} header field name. */
281  public static final String ALLOW = "Allow";
282
283  /**
284   * The HTTP <a href="https://datatracker.ietf.org/doc/rfc9213/">{@code CDN-Cache-Control}</a>
285   * header field name.
286   *
287   * @since 33.6.0
288   */
289  public static final String CDN_CACHE_CONTROL = "CDN-Cache-Control";
290
291  /** The HTTP {@code Content-Disposition} header field name. */
292  public static final String CONTENT_DISPOSITION = "Content-Disposition";
293
294  /** The HTTP {@code Content-Encoding} header field name. */
295  public static final String CONTENT_ENCODING = "Content-Encoding";
296
297  /** The HTTP {@code Content-Language} header field name. */
298  public static final String CONTENT_LANGUAGE = "Content-Language";
299
300  /** The HTTP {@code Content-Location} header field name. */
301  public static final String CONTENT_LOCATION = "Content-Location";
302
303  /** The HTTP {@code Content-MD5} header field name. */
304  public static final String CONTENT_MD5 = "Content-MD5";
305
306  /** The HTTP {@code Content-Range} header field name. */
307  public static final String CONTENT_RANGE = "Content-Range";
308
309  /**
310   * The HTTP <a href="http://w3.org/TR/CSP/#content-security-policy-header-field">{@code
311   * Content-Security-Policy}</a> header field name.
312   *
313   * @since 15.0
314   */
315  public static final String CONTENT_SECURITY_POLICY = "Content-Security-Policy";
316
317  /**
318   * The HTTP <a href="http://w3.org/TR/CSP/#content-security-policy-report-only-header-field">
319   * {@code Content-Security-Policy-Report-Only}</a> header field name.
320   *
321   * @since 15.0
322   */
323  public static final String CONTENT_SECURITY_POLICY_REPORT_ONLY =
324      "Content-Security-Policy-Report-Only";
325
326  /**
327   * The HTTP nonstandard {@code X-Content-Security-Policy} header field name. It was introduced in
328   * <a href="https://www.w3.org/TR/2011/WD-CSP-20111129/">CSP v.1</a> and used by the Firefox until
329   * version 23 and the Internet Explorer version 10. Please, use {@link #CONTENT_SECURITY_POLICY}
330   * to pass the CSP.
331   *
332   * @since 20.0
333   */
334  public static final String X_CONTENT_SECURITY_POLICY = "X-Content-Security-Policy";
335
336  /**
337   * The HTTP nonstandard {@code X-Content-Security-Policy-Report-Only} header field name. It was
338   * introduced in <a href="https://www.w3.org/TR/2011/WD-CSP-20111129/">CSP v.1</a> and used by the
339   * Firefox until version 23 and the Internet Explorer version 10. Please, use {@link
340   * #CONTENT_SECURITY_POLICY_REPORT_ONLY} to pass the CSP.
341   *
342   * @since 20.0
343   */
344  public static final String X_CONTENT_SECURITY_POLICY_REPORT_ONLY =
345      "X-Content-Security-Policy-Report-Only";
346
347  /**
348   * The HTTP nonstandard {@code X-WebKit-CSP} header field name. It was introduced in <a
349   * href="https://www.w3.org/TR/2011/WD-CSP-20111129/">CSP v.1</a> and used by the Chrome until
350   * version 25. Please, use {@link #CONTENT_SECURITY_POLICY} to pass the CSP.
351   *
352   * @since 20.0
353   */
354  public static final String X_WEBKIT_CSP = "X-WebKit-CSP";
355
356  /**
357   * The HTTP nonstandard {@code X-WebKit-CSP-Report-Only} header field name. It was introduced in
358   * <a href="https://www.w3.org/TR/2011/WD-CSP-20111129/">CSP v.1</a> and used by the Chrome until
359   * version 25. Please, use {@link #CONTENT_SECURITY_POLICY_REPORT_ONLY} to pass the CSP.
360   *
361   * @since 20.0
362   */
363  public static final String X_WEBKIT_CSP_REPORT_ONLY = "X-WebKit-CSP-Report-Only";
364
365  /**
366   * The HTTP <a href="https://wicg.github.io/cross-origin-embedder-policy/#COEP">{@code
367   * Cross-Origin-Embedder-Policy}</a> header field name.
368   *
369   * @since 30.0
370   */
371  public static final String CROSS_ORIGIN_EMBEDDER_POLICY = "Cross-Origin-Embedder-Policy";
372
373  /**
374   * The HTTP <a href="https://wicg.github.io/cross-origin-embedder-policy/#COEP-RO">{@code
375   * Cross-Origin-Embedder-Policy-Report-Only}</a> header field name.
376   *
377   * @since 30.0
378   */
379  public static final String CROSS_ORIGIN_EMBEDDER_POLICY_REPORT_ONLY =
380      "Cross-Origin-Embedder-Policy-Report-Only";
381
382  /**
383   * The HTTP Cross-Origin-Opener-Policy header field name.
384   *
385   * @since 28.2
386   */
387  public static final String CROSS_ORIGIN_OPENER_POLICY = "Cross-Origin-Opener-Policy";
388
389  /** The HTTP {@code ETag} header field name. */
390  public static final String ETAG = "ETag";
391
392  /** The HTTP {@code Expires} header field name. */
393  public static final String EXPIRES = "Expires";
394
395  /** The HTTP {@code Last-Modified} header field name. */
396  public static final String LAST_MODIFIED = "Last-Modified";
397
398  /** The HTTP {@code Link} header field name. */
399  public static final String LINK = "Link";
400
401  /** The HTTP {@code Location} header field name. */
402  public static final String LOCATION = "Location";
403
404  /**
405   * The HTTP {@code Keep-Alive} header field name.
406   *
407   * @since 31.0
408   */
409  public static final String KEEP_ALIVE = "Keep-Alive";
410
411  /**
412   * The HTTP <a href="https://github.com/WICG/nav-speculation/blob/main/no-vary-search.md">{@code
413   * No-Vary-Search}</a> header field name.
414   *
415   * @since 32.0.0
416   */
417  public static final String NO_VARY_SEARCH = "No-Vary-Search";
418
419  /**
420   * The HTTP <a href="https://github.com/explainers-by-googlers/prefetch-activation-beacon">{@code
421   * on-prefetch-activation}</a> header field name.
422   *
423   * @since 33.7.0
424   */
425  public static final String ON_PREFETCH_ACTIVATION = "on-prefetch-activation";
426
427  /**
428   * The HTTP <a href="https://googlechrome.github.io/OriginTrials/#header">{@code Origin-Trial}</a>
429   * header field name.
430   *
431   * @since 27.1
432   */
433  public static final String ORIGIN_TRIAL = "Origin-Trial";
434
435  /** The HTTP {@code P3P} header field name. Limited browser support. */
436  public static final String P3P = "P3P";
437
438  /** The HTTP {@code Proxy-Authenticate} header field name. */
439  public static final String PROXY_AUTHENTICATE = "Proxy-Authenticate";
440
441  /** The HTTP {@code Refresh} header field name. Non-standard header supported by most browsers. */
442  public static final String REFRESH = "Refresh";
443
444  /**
445   * The HTTP <a href="https://www.w3.org/TR/reporting/">{@code Report-To}</a> header field name.
446   *
447   * @since 27.1
448   */
449  public static final String REPORT_TO = "Report-To";
450
451  /** The HTTP {@code Retry-After} header field name. */
452  public static final String RETRY_AFTER = "Retry-After";
453
454  /** The HTTP {@code Server} header field name. */
455  public static final String SERVER = "Server";
456
457  /**
458   * The HTTP <a href="https://www.w3.org/TR/server-timing/">{@code Server-Timing}</a> header field
459   * name.
460   *
461   * @since 23.6
462   */
463  public static final String SERVER_TIMING = "Server-Timing";
464
465  /**
466   * The HTTP <a href="https://www.w3.org/TR/service-workers/#update-algorithm">{@code
467   * Service-Worker-Allowed}</a> header field name.
468   *
469   * @since 20.0
470   */
471  public static final String SERVICE_WORKER_ALLOWED = "Service-Worker-Allowed";
472
473  /** The HTTP {@code Set-Cookie} header field name. */
474  public static final String SET_COOKIE = "Set-Cookie";
475
476  /** The HTTP {@code Set-Cookie2} header field name. */
477  public static final String SET_COOKIE2 = "Set-Cookie2";
478
479  /**
480   * The HTTP <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/SourceMap">{@code
481   * SourceMap}</a> header field name.
482   *
483   * @since 27.1
484   */
485  public static final String SOURCE_MAP = "SourceMap";
486
487  /**
488   * The HTTP <a href="https://github.com/WICG/nav-speculation/blob/main/opt-in.md">{@code
489   * Supports-Loading-Mode}</a> header field name. This can be used to specify, for example, <a
490   * href="https://developer.chrome.com/docs/privacy-sandbox/fenced-frame/#server-opt-in">fenced
491   * frames</a>.
492   *
493   * @since 32.0.0
494   */
495  public static final String SUPPORTS_LOADING_MODE = "Supports-Loading-Mode";
496
497  /**
498   * The HTTP <a href="http://tools.ietf.org/html/rfc6797#section-6.1">{@code
499   * Strict-Transport-Security}</a> header field name.
500   *
501   * @since 15.0
502   */
503  public static final String STRICT_TRANSPORT_SECURITY = "Strict-Transport-Security";
504
505  /**
506   * The HTTP <a href="https://www.w3.org/TR/resource-timing/#sec-timing-allow-origin">{@code
507   * Timing-Allow-Origin}</a> header field name.
508   *
509   * @since 15.0
510   */
511  public static final String TIMING_ALLOW_ORIGIN = "Timing-Allow-Origin";
512
513  /** The HTTP {@code Trailer} header field name. */
514  public static final String TRAILER = "Trailer";
515
516  /** The HTTP {@code Transfer-Encoding} header field name. */
517  public static final String TRANSFER_ENCODING = "Transfer-Encoding";
518
519  /** The HTTP {@code Vary} header field name. */
520  public static final String VARY = "Vary";
521
522  /** The HTTP {@code WWW-Authenticate} header field name. */
523  public static final String WWW_AUTHENTICATE = "WWW-Authenticate";
524
525  // Common, non-standard HTTP header fields
526
527  /** The HTTP {@code DNT} header field name. */
528  public static final String DNT = "DNT";
529
530  /** The HTTP {@code X-Content-Type-Options} header field name. */
531  public static final String X_CONTENT_TYPE_OPTIONS = "X-Content-Type-Options";
532
533  /**
534   * The HTTP <a
535   * href="https://iabtechlab.com/wp-content/uploads/2019/06/VAST_4.2_final_june26.pdf">{@code
536   * X-Device-IP}</a> header field name. Header used for VAST requests to provide the IP address of
537   * the device on whose behalf the request is being made.
538   *
539   * @since 31.0
540   */
541  public static final String X_DEVICE_IP = "X-Device-IP";
542
543  /**
544   * The HTTP <a
545   * href="https://iabtechlab.com/wp-content/uploads/2019/06/VAST_4.2_final_june26.pdf">{@code
546   * X-Device-Referer}</a> header field name. Header used for VAST requests to provide the {@link
547   * #REFERER} header value that the on-behalf-of client would have used when making a request
548   * itself.
549   *
550   * @since 31.0
551   */
552  public static final String X_DEVICE_REFERER = "X-Device-Referer";
553
554  /**
555   * The HTTP <a
556   * href="https://iabtechlab.com/wp-content/uploads/2019/06/VAST_4.2_final_june26.pdf">{@code
557   * X-Device-Accept-Language}</a> header field name. Header used for VAST requests to provide the
558   * {@link #ACCEPT_LANGUAGE} header value that the on-behalf-of client would have used when making
559   * a request itself.
560   *
561   * @since 31.0
562   */
563  public static final String X_DEVICE_ACCEPT_LANGUAGE = "X-Device-Accept-Language";
564
565  /**
566   * The HTTP <a
567   * href="https://iabtechlab.com/wp-content/uploads/2019/06/VAST_4.2_final_june26.pdf">{@code
568   * X-Device-Requested-With}</a> header field name. Header used for VAST requests to provide the
569   * {@link #X_REQUESTED_WITH} header value that the on-behalf-of client would have used when making
570   * a request itself.
571   *
572   * @since 31.0
573   */
574  public static final String X_DEVICE_REQUESTED_WITH = "X-Device-Requested-With";
575
576  /** The HTTP {@code X-Do-Not-Track} header field name. */
577  public static final String X_DO_NOT_TRACK = "X-Do-Not-Track";
578
579  /** The HTTP {@code X-Forwarded-For} header field name (superseded by {@code Forwarded}). */
580  public static final String X_FORWARDED_FOR = "X-Forwarded-For";
581
582  /** The HTTP {@code X-Forwarded-Proto} header field name. */
583  public static final String X_FORWARDED_PROTO = "X-Forwarded-Proto";
584
585  /**
586   * The HTTP <a
587   * href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-Host">{@code
588   * X-Forwarded-Host}</a> header field name.
589   *
590   * @since 20.0
591   */
592  public static final String X_FORWARDED_HOST = "X-Forwarded-Host";
593
594  /**
595   * The HTTP <a
596   * href="https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/x-forwarded-headers.html#x-forwarded-port">{@code
597   * X-Forwarded-Port}</a> header field name.
598   *
599   * @since 20.0
600   */
601  public static final String X_FORWARDED_PORT = "X-Forwarded-Port";
602
603  /** The HTTP {@code X-Frame-Options} header field name. */
604  public static final String X_FRAME_OPTIONS = "X-Frame-Options";
605
606  /** The HTTP {@code X-Powered-By} header field name. */
607  public static final String X_POWERED_BY = "X-Powered-By";
608
609  /**
610   * The HTTP <a href="http://tools.ietf.org/html/draft-evans-palmer-key-pinning">{@code
611   * Public-Key-Pins}</a> header field name.
612   *
613   * @since 15.0
614   */
615  public static final String PUBLIC_KEY_PINS = "Public-Key-Pins";
616
617  /**
618   * The HTTP <a href="http://tools.ietf.org/html/draft-evans-palmer-key-pinning">{@code
619   * Public-Key-Pins-Report-Only}</a> header field name.
620   *
621   * @since 15.0
622   */
623  public static final String PUBLIC_KEY_PINS_REPORT_ONLY = "Public-Key-Pins-Report-Only";
624
625  /**
626   * The HTTP {@code X-Request-ID} header field name.
627   *
628   * @since 30.1
629   */
630  public static final String X_REQUEST_ID = "X-Request-ID";
631
632  /** The HTTP {@code X-Requested-With} header field name. */
633  public static final String X_REQUESTED_WITH = "X-Requested-With";
634
635  /** The HTTP {@code X-User-IP} header field name. */
636  public static final String X_USER_IP = "X-User-IP";
637
638  /**
639   * The HTTP <a
640   * href="https://learn.microsoft.com/en-us/archive/blogs/ieinternals/internet-explorer-and-custom-http-headers#:~:text=X%2DDownload%2DOptions">{@code
641   * X-Download-Options}</a> header field name.
642   *
643   * <p>When the new X-Download-Options header is present with the value {@code noopen}, the user is
644   * prevented from opening a file download directly; instead, they must first save the file
645   * locally.
646   *
647   * @since 24.1
648   */
649  public static final String X_DOWNLOAD_OPTIONS = "X-Download-Options";
650
651  /** The HTTP {@code X-XSS-Protection} header field name. */
652  public static final String X_XSS_PROTECTION = "X-XSS-Protection";
653
654  /**
655   * The HTTP <a
656   * href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-DNS-Prefetch-Control">{@code
657   * X-DNS-Prefetch-Control}</a> header controls DNS prefetch behavior. Value can be "on" or "off".
658   * By default, DNS prefetching is "on" for HTTP pages and "off" for HTTPS pages.
659   */
660  public static final String X_DNS_PREFETCH_CONTROL = "X-DNS-Prefetch-Control";
661
662  /**
663   * The HTTP <a href="http://html.spec.whatwg.org/multipage/semantics.html#hyperlink-auditing">
664   * {@code Ping-From}</a> header field name.
665   *
666   * @since 19.0
667   */
668  public static final String PING_FROM = "Ping-From";
669
670  /**
671   * The HTTP <a href="http://html.spec.whatwg.org/multipage/semantics.html#hyperlink-auditing">
672   * {@code Ping-To}</a> header field name.
673   *
674   * @since 19.0
675   */
676  public static final String PING_TO = "Ping-To";
677
678  /**
679   * The HTTP <a
680   * href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Link_prefetching_FAQ#As_a_server_admin.2C_can_I_distinguish_prefetch_requests_from_normal_requests.3F">{@code
681   * Purpose}</a> header field name.
682   *
683   * @since 28.0
684   */
685  public static final String PURPOSE = "Purpose";
686
687  /**
688   * The HTTP <a
689   * href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Link_prefetching_FAQ#As_a_server_admin.2C_can_I_distinguish_prefetch_requests_from_normal_requests.3F">{@code
690   * X-Purpose}</a> header field name.
691   *
692   * @since 28.0
693   */
694  public static final String X_PURPOSE = "X-Purpose";
695
696  /**
697   * The HTTP <a
698   * href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Link_prefetching_FAQ#As_a_server_admin.2C_can_I_distinguish_prefetch_requests_from_normal_requests.3F">{@code
699   * X-Moz}</a> header field name.
700   *
701   * @since 28.0
702   */
703  public static final String X_MOZ = "X-Moz";
704
705  /**
706   * The HTTP <a
707   * href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Device-Memory">{@code
708   * Device-Memory}</a> header field name.
709   *
710   * @since 31.0
711   */
712  public static final String DEVICE_MEMORY = "Device-Memory";
713
714  /**
715   * The HTTP <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Downlink">{@code
716   * Downlink}</a> header field name.
717   *
718   * @since 31.0
719   */
720  public static final String DOWNLINK = "Downlink";
721
722  /**
723   * The HTTP <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/ECT">{@code
724   * ECT}</a> header field name.
725   *
726   * @since 31.0
727   */
728  public static final String ECT = "ECT";
729
730  /**
731   * The HTTP <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/RTT">{@code
732   * RTT}</a> header field name.
733   *
734   * @since 31.0
735   */
736  public static final String RTT = "RTT";
737
738  /**
739   * The HTTP <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Save-Data">{@code
740   * Save-Data}</a> header field name.
741   *
742   * @since 31.0
743   */
744  public static final String SAVE_DATA = "Save-Data";
745
746  /**
747   * The HTTP <a
748   * href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Viewport-Width">{@code
749   * Viewport-Width}</a> header field name.
750   *
751   * @since 31.0
752   */
753  public static final String VIEWPORT_WIDTH = "Viewport-Width";
754
755  /**
756   * The HTTP <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Width">{@code
757   * Width}</a> header field name.
758   *
759   * @since 31.0
760   */
761  public static final String WIDTH = "Width";
762
763  /**
764   * The HTTP <a href="https://www.w3.org/TR/permissions-policy-1/">{@code Permissions-Policy}</a>
765   * header field name.
766   *
767   * @since 31.0
768   */
769  public static final String PERMISSIONS_POLICY = "Permissions-Policy";
770
771  /**
772   * The HTTP <a
773   * href="https://w3c.github.io/webappsec-permissions-policy/#permissions-policy-report-only-http-header-field">{@code
774   * Permissions-Policy-Report-Only}</a> header field name.
775   *
776   * @since 33.2.0
777   */
778  public static final String PERMISSIONS_POLICY_REPORT_ONLY = "Permissions-Policy-Report-Only";
779
780  /**
781   * The HTTP <a
782   * href="https://wicg.github.io/user-preference-media-features-headers/#sec-ch-prefers-color-scheme">{@code
783   * Sec-CH-Prefers-Color-Scheme}</a> header field name.
784   *
785   * <p>This header is experimental.
786   *
787   * @since 31.0
788   */
789  public static final String SEC_CH_PREFERS_COLOR_SCHEME = "Sec-CH-Prefers-Color-Scheme";
790
791  /**
792   * The HTTP <a
793   * href="https://www.rfc-editor.org/rfc/rfc8942#name-the-accept-ch-response-head">{@code
794   * Accept-CH}</a> header field name.
795   *
796   * @since 31.0
797   */
798  public static final String ACCEPT_CH = "Accept-CH";
799
800  /**
801   * The HTTP <a
802   * href="https://datatracker.ietf.org/doc/html/draft-davidben-http-client-hint-reliability-03.txt#section-3">{@code
803   * Critical-CH}</a> header field name.
804   *
805   * @since 31.0
806   */
807  public static final String CRITICAL_CH = "Critical-CH";
808
809  /**
810   * The HTTP <a href="https://wicg.github.io/ua-client-hints/#sec-ch-ua">{@code Sec-CH-UA}</a>
811   * header field name.
812   *
813   * @since 30.0
814   */
815  public static final String SEC_CH_UA = "Sec-CH-UA";
816
817  /**
818   * The HTTP <a href="https://wicg.github.io/ua-client-hints/#sec-ch-ua-arch">{@code
819   * Sec-CH-UA-Arch}</a> header field name.
820   *
821   * @since 30.0
822   */
823  public static final String SEC_CH_UA_ARCH = "Sec-CH-UA-Arch";
824
825  /**
826   * The HTTP <a href="https://wicg.github.io/ua-client-hints/#sec-ch-ua-model">{@code
827   * Sec-CH-UA-Model}</a> header field name.
828   *
829   * @since 30.0
830   */
831  public static final String SEC_CH_UA_MODEL = "Sec-CH-UA-Model";
832
833  /**
834   * The HTTP <a href="https://wicg.github.io/ua-client-hints/#sec-ch-ua-platform">{@code
835   * Sec-CH-UA-Platform}</a> header field name.
836   *
837   * @since 30.0
838   */
839  public static final String SEC_CH_UA_PLATFORM = "Sec-CH-UA-Platform";
840
841  /**
842   * The HTTP <a href="https://wicg.github.io/ua-client-hints/#sec-ch-ua-platform-version">{@code
843   * Sec-CH-UA-Platform-Version}</a> header field name.
844   *
845   * @since 30.0
846   */
847  public static final String SEC_CH_UA_PLATFORM_VERSION = "Sec-CH-UA-Platform-Version";
848
849  /**
850   * The HTTP <a href="https://wicg.github.io/ua-client-hints/#sec-ch-ua-full-version">{@code
851   * Sec-CH-UA-Full-Version}</a> header field name.
852   *
853   * @deprecated Prefer {@link SEC_CH_UA_FULL_VERSION_LIST}.
854   * @since 30.0
855   */
856  @Deprecated public static final String SEC_CH_UA_FULL_VERSION = "Sec-CH-UA-Full-Version";
857
858  /**
859   * The HTTP <a href="https://wicg.github.io/ua-client-hints/#sec-ch-ua-full-version-list">{@code
860   * Sec-CH-UA-Full-Version}</a> header field name.
861   *
862   * @since 31.1
863   */
864  public static final String SEC_CH_UA_FULL_VERSION_LIST = "Sec-CH-UA-Full-Version-List";
865
866  /**
867   * The HTTP <a href="https://wicg.github.io/ua-client-hints/#sec-ch-ua-mobile">{@code
868   * Sec-CH-UA-Mobile}</a> header field name.
869   *
870   * @since 30.0
871   */
872  public static final String SEC_CH_UA_MOBILE = "Sec-CH-UA-Mobile";
873
874  /**
875   * The HTTP <a href="https://wicg.github.io/ua-client-hints/#sec-ch-ua-wow64">{@code
876   * Sec-CH-UA-WoW64}</a> header field name.
877   *
878   * @since 32.0.0
879   */
880  public static final String SEC_CH_UA_WOW64 = "Sec-CH-UA-WoW64";
881
882  /**
883   * The HTTP <a href="https://wicg.github.io/ua-client-hints/#sec-ch-ua-bitness">{@code
884   * Sec-CH-UA-Bitness}</a> header field name.
885   *
886   * @since 31.0
887   */
888  public static final String SEC_CH_UA_BITNESS = "Sec-CH-UA-Bitness";
889
890  /**
891   * The HTTP <a href="https://wicg.github.io/ua-client-hints/#sec-ch-ua-form-factor">{@code
892   * Sec-CH-UA-Form-Factor}</a> header field name.
893   *
894   * @deprecated Prefer {@link SEC_CH_UA_FORM_FACTORS}.
895   * @since 32.0.0
896   */
897  @Deprecated public static final String SEC_CH_UA_FORM_FACTOR = "Sec-CH-UA-Form-Factor";
898
899  /**
900   * The HTTP <a href="https://wicg.github.io/ua-client-hints/#sec-ch-ua-form-factors">{@code
901   * Sec-CH-UA-Form-Factors}</a> header field name.
902   *
903   * @since 33.3.0
904   */
905  public static final String SEC_CH_UA_FORM_FACTORS = "Sec-CH-UA-Form-Factors";
906
907  /**
908   * The HTTP <a
909   * href="https://wicg.github.io/responsive-image-client-hints/#sec-ch-viewport-width">{@code
910   * Sec-CH-Viewport-Width}</a> header field name.
911   *
912   * @since 32.0.0
913   */
914  public static final String SEC_CH_VIEWPORT_WIDTH = "Sec-CH-Viewport-Width";
915
916  /**
917   * The HTTP <a
918   * href="https://wicg.github.io/responsive-image-client-hints/#sec-ch-viewport-height">{@code
919   * Sec-CH-Viewport-Height}</a> header field name.
920   *
921   * @since 32.0.0
922   */
923  public static final String SEC_CH_VIEWPORT_HEIGHT = "Sec-CH-Viewport-Height";
924
925  /**
926   * The HTTP <a href="https://wicg.github.io/responsive-image-client-hints/#sec-ch-dpr">{@code
927   * Sec-CH-DPR}</a> header field name.
928   *
929   * @since 32.0.0
930   */
931  public static final String SEC_CH_DPR = "Sec-CH-DPR";
932
933  /**
934   * The HTTP <a href="https://w3c.github.io/webappsec-fetch-metadata/">{@code Sec-Fetch-Dest}</a>
935   * header field name.
936   *
937   * @since 27.1
938   */
939  public static final String SEC_FETCH_DEST = "Sec-Fetch-Dest";
940
941  /**
942   * The HTTP <a href="https://w3c.github.io/webappsec-fetch-metadata/">{@code Sec-Fetch-Mode}</a>
943   * header field name.
944   *
945   * @since 27.1
946   */
947  public static final String SEC_FETCH_MODE = "Sec-Fetch-Mode";
948
949  /**
950   * The HTTP <a href="https://w3c.github.io/webappsec-fetch-metadata/">{@code Sec-Fetch-Site}</a>
951   * header field name.
952   *
953   * @since 27.1
954   */
955  public static final String SEC_FETCH_SITE = "Sec-Fetch-Site";
956
957  /**
958   * The HTTP <a href="https://w3c.github.io/webappsec-fetch-metadata/">{@code Sec-Fetch-User}</a>
959   * header field name.
960   *
961   * @since 27.1
962   */
963  public static final String SEC_FETCH_USER = "Sec-Fetch-User";
964
965  /**
966   * The HTTP <a href="https://w3c.github.io/webappsec-fetch-metadata/">{@code Sec-Metadata}</a>
967   * header field name.
968   *
969   * @since 26.0
970   */
971  public static final String SEC_METADATA = "Sec-Metadata";
972
973  /**
974   * The HTTP <a href="https://datatracker.ietf.org/doc/html/draft-ietf-tokbind-https">{@code
975   * Sec-Token-Binding}</a> header field name.
976   *
977   * @since 25.1
978   */
979  public static final String SEC_TOKEN_BINDING = "Sec-Token-Binding";
980
981  /**
982   * The HTTP <a href="https://datatracker.ietf.org/doc/html/draft-ietf-tokbind-ttrp">{@code
983   * Sec-Provided-Token-Binding-ID}</a> header field name.
984   *
985   * @since 25.1
986   */
987  public static final String SEC_PROVIDED_TOKEN_BINDING_ID = "Sec-Provided-Token-Binding-ID";
988
989  /**
990   * The HTTP <a href="https://datatracker.ietf.org/doc/html/draft-ietf-tokbind-ttrp">{@code
991   * Sec-Referred-Token-Binding-ID}</a> header field name.
992   *
993   * @since 25.1
994   */
995  public static final String SEC_REFERRED_TOKEN_BINDING_ID = "Sec-Referred-Token-Binding-ID";
996
997  /**
998   * The HTTP <a href="https://datatracker.ietf.org/doc/html/rfc6455">{@code
999   * Sec-WebSocket-Accept}</a> header field name.
1000   *
1001   * @since 28.0
1002   */
1003  public static final String SEC_WEBSOCKET_ACCEPT = "Sec-WebSocket-Accept";
1004
1005  /**
1006   * The HTTP <a href="https://datatracker.ietf.org/doc/html/rfc6455">{@code
1007   * Sec-WebSocket-Extensions}</a> header field name.
1008   *
1009   * @since 28.0
1010   */
1011  public static final String SEC_WEBSOCKET_EXTENSIONS = "Sec-WebSocket-Extensions";
1012
1013  /**
1014   * The HTTP <a href="https://datatracker.ietf.org/doc/html/rfc6455">{@code Sec-WebSocket-Key}</a>
1015   * header field name.
1016   *
1017   * @since 28.0
1018   */
1019  public static final String SEC_WEBSOCKET_KEY = "Sec-WebSocket-Key";
1020
1021  /**
1022   * The HTTP <a href="https://datatracker.ietf.org/doc/html/rfc6455">{@code
1023   * Sec-WebSocket-Protocol}</a> header field name.
1024   *
1025   * @since 28.0
1026   */
1027  public static final String SEC_WEBSOCKET_PROTOCOL = "Sec-WebSocket-Protocol";
1028
1029  /**
1030   * The HTTP <a href="https://datatracker.ietf.org/doc/html/rfc6455">{@code
1031   * Sec-WebSocket-Version}</a> header field name.
1032   *
1033   * @since 28.0
1034   */
1035  public static final String SEC_WEBSOCKET_VERSION = "Sec-WebSocket-Version";
1036
1037  /**
1038   * The HTTP <a href="https://patcg-individual-drafts.github.io/topics/">{@code
1039   * Sec-Browsing-Topics}</a> header field name.
1040   *
1041   * @since 32.0.0
1042   */
1043  public static final String SEC_BROWSING_TOPICS = "Sec-Browsing-Topics";
1044
1045  /**
1046   * The HTTP <a href="https://patcg-individual-drafts.github.io/topics/">{@code
1047   * Observe-Browsing-Topics}</a> header field name.
1048   *
1049   * @since 32.0.0
1050   */
1051  public static final String OBSERVE_BROWSING_TOPICS = "Observe-Browsing-Topics";
1052
1053  /**
1054   * The HTTP <a
1055   * href="https://wicg.github.io/turtledove/#handling-direct-from-seller-signals">{@code
1056   * Sec-Ad-Auction-Fetch}</a> header field name.
1057   *
1058   * @since 33.0.0
1059   */
1060  public static final String SEC_AD_AUCTION_FETCH = "Sec-Ad-Auction-Fetch";
1061
1062  /**
1063   * The HTTP <a
1064   * href="https://privacycg.github.io/gpc-spec/#the-sec-gpc-header-field-for-http-requests">{@code
1065   * Sec-GPC}</a> header field name.
1066   *
1067   * @since 33.2.0
1068   */
1069  public static final String SEC_GPC = "Sec-GPC";
1070
1071  /**
1072   * The HTTP <a
1073   * href="https://wicg.github.io/turtledove/#handling-direct-from-seller-signals">{@code
1074   * Ad-Auction-Signals}</a> header field name.
1075   *
1076   * @since 33.0.0
1077   */
1078  public static final String AD_AUCTION_SIGNALS = "Ad-Auction-Signals";
1079
1080  /**
1081   * The HTTP <a href="https://wicg.github.io/turtledove/#http-headerdef-ad-auction-allowed">{@code
1082   * Ad-Auction-Allowed}</a> header field name.
1083   *
1084   * @since 33.2.0
1085   */
1086  public static final String AD_AUCTION_ALLOWED = "Ad-Auction-Allowed";
1087
1088  /**
1089   * The HTTP <a href="https://datatracker.ietf.org/doc/html/rfc8586">{@code CDN-Loop}</a> header
1090   * field name.
1091   *
1092   * @since 28.0
1093   */
1094  public static final String CDN_LOOP = "CDN-Loop";
1095
1096  /**
1097   * The HTTP <a href="https://datatracker.ietf.org/doc/html/rfc7838#page-8">{@code Alt-Svc}</a>
1098   * header field name.
1099   *
1100   * @since 33.4.0
1101   */
1102  public static final String ALT_SVC = "Alt-Svc";
1103}