Accept-Encoding: br, gzip\n Note over Server: The resource is sent compressed. The Vary header indicates that content negotiation has been used to select the algorithm.\n Server->>Client: HTTP/1.1 200 OK
Content-Encoding: br
Vary: Accept-Encoding\n -->\n
As compression brings significant performance improvements, it is recommended to activate it for all files except already compressed ones like images, audio files and videos.
\nApache supports compression and uses mod_deflate; for Nginx there is ngx_http_gzip_module; for IIS, the <httpCompression>
element.
Modern compression formats such as Brotli compression and Zstandard compression can use dictionaries of frequently used data to further increase compression over just referencing those from within the file being compressed. Typically, for HTTP responses, this uses the predefined static dictionary included in that format (for example the Brotli static dictionary is available in the source code).
\nCompression Dictionary Transport enables a developer to specify a resource which can be used as a dictionary for future requests. This can either be a specific dictionary file, or an existing resource (for example, using app.v1.js
as a dictionary when downloading app.v2.js
). This typically improves compression and therefore load time. In the app.vX.js
example, most of the download would consist of only the delta between the two versions, and the common bytes could be referenced from the original app.v1.js
file that is already downloaded.
Hop-by-hop compression, though similar to end-to-end compression, differs by one fundamental element: the compression doesn't happen on the resource in the server, creating a specific representation that is then transmitted, but on the body of the message between any two nodes on the path between the client and the server. Connections between successive intermediate nodes may apply a different compression.
\n\u003c!-- \n%%{init: { \"sequence\": { \"wrap\": true, \"width\": 130, \"noteAlign\": \"center\", \"messageAlign\": \"left\" }} }%%\n\nsequenceDiagram\n participant Client\n participant N1 as Node\n participant N2 as Node\n participant N3 as Node\n participant Server\n\n Client->>N1: Uncompressed\n Note left of Client: Client sends an uncompressed body.\n Note over N1,N3: Intermediate nodes send the body with or without compression on a hop-by-hop basis.\n N1->>N2: Uncompressed\n N2->>N3: Compressed\n N3->>Server: Uncompressed\n Note right of Server: The server receives an uncompressed body.\n -->\nTo do this, HTTP uses a mechanism similar to the content negotiation for end-to-end compression: the node transmitting the request advertizes its will using the TE
header and the other node chooses the adequate method, applies it, and indicates its choice with the Transfer-Encoding
header.
In practice, hop-by-hop compression is transparent for the server and the client, and is rarely used. TE
and Transfer-Encoding
are mostly used to send a response by chunks, allowing to start transmitting a resource without knowing its length.
Note that using Transfer-Encoding
and compression at the hop level is so rare that most servers, like Apache, Nginx, or IIS, have no easy way to configure it. Such configuration usually happens at the proxy level.
Reason: CORS disabled
Reason: CORS header 'Access-Control-Allow-Origin' does not match 'xyz'
Reason: CORS header 'Access-Control-Allow-Origin' missing
Reason: CORS header 'Origin' cannot be added
Reason: CORS preflight channel did not succeed
Reason: CORS request did not succeed
Reason: CORS request external redirect not allowed
Reason: CORS request not HTTP
Reason: Credential is not supported if the CORS header 'Access-Control-Allow-Origin' is '*'
Reason: Did not find method in CORS header 'Access-Control-Allow-Methods'
Reason: expected 'true' in CORS header 'Access-Control-Allow-Credentials'
Reason: invalid token 'xyz' in CORS header 'Access-Control-Allow-Headers'
Reason: invalid token 'xyz' in CORS header 'Access-Control-Allow-Methods'
Reason: missing token 'xyz' in CORS header 'Access-Control-Allow-Headers' from CORS preflight channel
Reason: Multiple CORS header 'Access-Control-Allow-Origin' not allowed
Accept
Accept-CH
Accept-Encoding
Accept-Language
Accept-
Accept-Post
Accept-Ranges
Access-Control-Allow-Credentials
Access-Control-Allow-Headers
Access-Control-Allow-Methods
Access-Control-Allow-Origin
Access-Control-Expose-Headers
Access-Control-Max-Age
Access-Control-Request-Headers
Access-Control-Request-Method
Age
Allow
Alt-Svc
Alt-Used
Attribution-Reporting-Eligible
\nExperimental\nAttribution-Reporting-Register-Source
\nExperimental\nAttribution-Reporting-Register-Trigger
\nExperimental\nAuthorization
Available-Dictionary
\nExperimental\nCache-Control
Clear-Site-Data
Connection
Content-Digest
Content-Disposition
Content-DPR
\nNon-standard\n\nDeprecated\nContent-Encoding
Content-Language
Content-Length
Content-Location
Content-Range
Content-Security-Policy
Content-Security-Policy-Report-Only
Content-Type
Cookie
Critical-CH
\nExperimental\nCross-Origin-Embedder-Policy
Cross-Origin-Opener-Policy
Cross-Origin-Resource-Policy
Date
Device-Memory
Dictionary-ID
\nExperimental\nDNT
\nNon-standard\n\nDeprecated\nDownlink
\nExperimental\nDPR
\nNon-standard\n\nDeprecated\nEarly-Data
\nExperimental\nECT
\nExperimental\nETag
Expect
Expect-CT
\nDeprecated\nExpires
Forwarded
From
Host
If-Match
If-Modified-Since
If-None-Match
If-Range
If-Unmodified-Since
Keep-Alive
Last-Modified
Link
Location
Max-Forwards
NEL
\nExperimental\nNo-Vary-Search
\nExperimental\nObserve-Browsing-Topics
\nExperimental\n\nNon-standard\nOrigin
Origin-Agent-Cluster
Permissions-Policy
\nExperimental\nPragma
\nDeprecated\nPrefer
Preference-Applied
Priority
Proxy-Authenticate
Proxy-Authorization
Range
Referer
Referrer-Policy
Refresh
Report-To
\nNon-standard\n\nDeprecated\nReporting-Endpoints
Repr-Digest
Retry-After
RTT
\nExperimental\nSave-Data
\nExperimental\nSec-Browsing-Topics
\nExperimental\n\nNon-standard\nSec-CH-Prefers-Color-Scheme
\nExperimental\nSec-CH-Prefers-Reduced-Motion
\nExperimental\nSec-CH-Prefers-Reduced-Transparency
\nExperimental\nSec-CH-UA
\nExperimental\nSec-CH-UA-Arch
\nExperimental\nSec-CH-UA-Bitness
\nExperimental\nSec-CH-UA-Form-Factors
\nExperimental\nSec-CH-UA-Full-Version
\nDeprecated\nSec-CH-UA-Full-Version-List
\nExperimental\nSec-CH-UA-Mobile
\nExperimental\nSec-CH-UA-Model
\nExperimental\nSec-CH-UA-Platform
\nExperimental\nSec-CH-UA-Platform-Version
\nExperimental\nSec-CH-UA-WoW64
\nExperimental\nSec-Fetch-Dest
Sec-Fetch-Mode
Sec-Fetch-Site
Sec-Fetch-User
Sec-GPC
\nExperimental\nSec-Purpose
Sec-Speculation-Tags
\nExperimental\nSec-WebSocket-Accept
Sec-WebSocket-Extensions
Sec-WebSocket-Key
Sec-WebSocket-Protocol
Sec-WebSocket-Version
Server
Server-Timing
Service-Worker
Service-Worker-Allowed
Service-Worker-Navigation-Preload
Set-Cookie
Set-Login
SourceMap
Speculation-Rules
\nExperimental\nStrict-Transport-Security
Supports-Loading-Mode
\nExperimental\nTE
Timing-Allow-Origin
Tk
\nNon-standard\n\nDeprecated\nTrailer
Transfer-Encoding
Upgrade
Upgrade-Insecure-Requests
Use-As-Dictionary
\nExperimental\nUser-Agent
Vary
Via
Viewport-Width
\nNon-standard\n\nDeprecated\nWant-Content-Digest
Want-Repr-Digest
Warning
\nDeprecated\nWidth
\nNon-standard\n\nDeprecated\nWWW-Authenticate
X-Content-Type-Options
X-DNS-Prefetch-Control
\nNon-standard\nX-Forwarded-For
\nNon-standard\nX-Forwarded-Host
\nNon-standard\nX-Forwarded-Proto
\nNon-standard\nX-Frame-Options
X-Permitted-Cross-Domain-Policies
\nNon-standard\nX-Powered-By
\nNon-standard\nX-Robots-Tag
\nNon-standard\nX-XSS-Protection
\nNon-standard\n\nDeprecated\n100 Continue
101 Switching Protocols
102 Processing
103 Early Hints
200 OK
201 Created
202 Accepted
203 Non-Authoritative Information
204 No Content
205 Reset Content
206 Partial Content
207 Multi-Status
208 Already Reported
226 IM Used
300 Multiple Choices
301 Moved Permanently
302 Found
303 See Other
304 Not Modified
307 Temporary Redirect
308 Permanent Redirect
400 Bad Request
401 Unauthorized
402 Payment Required
403 Forbidden
404 Not Found
405 Method Not Allowed
406 Not Acceptable
407 Proxy Authentication Required
408 Request Timeout
409 Conflict
410 Gone
411 Length Required
412 Precondition Failed
413 Content Too Large
414 URI Too Long
415 Unsupported Media Type
416 Range Not Satisfiable
417 Expectation Failed
418 I'm a teapot
421 Misdirected Request
422 Unprocessable Content
423 Locked
424 Failed Dependency
425 Too Early
426 Upgrade Required
428 Precondition Required
429 Too Many Requests
431 Request Header Fields Too Large
451 Unavailable For Legal Reasons
500 Internal Server Error
501 Not Implemented
502 Bad Gateway
503 Service Unavailable
504 Gateway Timeout
505 HTTP Version Not Supported
506 Variant Also Negotiates
507 Insufficient Storage
508 Loop Detected
510 Not Extended
511 Network Authentication Required
base-uri
block-all-mixed-content
\nDeprecated\nchild-src
connect-src
default-src
fenced-frame-src
\nExperimental\nfont-src
form-action
frame-ancestors
frame-src
img-src
manifest-src
media-src
object-src
prefetch-src
\nNon-standard\n\nDeprecated\nreport-to
report-uri
\nDeprecated\nrequire-trusted-types-for
sandbox
script-src
script-src-attr
script-src-elem
style-src
style-src-attr
style-src-elem
trusted-types
upgrade-insecure-requests
worker-src
accelerometer
\nExperimental\nambient-light-sensor
\nExperimental\nattribution-reporting
\nExperimental\nautoplay
\nExperimental\nbluetooth
\nExperimental\nbrowsing-topics
\nExperimental\n\nNon-standard\ncamera
\nExperimental\ncompute-pressure
\nExperimental\ncross-origin-isolated
\nExperimental\ndeferred-fetch
\nExperimental\ndeferred-fetch-minimal
\nExperimental\ndisplay-capture
\nExperimental\nencrypted-media
\nExperimental\nfullscreen
\nExperimental\ngamepad
\nExperimental\ngeolocation
\nExperimental\ngyroscope
\nExperimental\nhid
\nExperimental\nidentity-credentials-get
\nExperimental\nidle-detection
\nExperimental\nlanguage-detector
\nExperimental\nlocal-fonts
\nExperimental\nmagnetometer
\nExperimental\nmicrophone
\nExperimental\nmidi
\nExperimental\notp-credentials
\nExperimental\npayment
\nExperimental\npicture-in-picture
\nExperimental\npublickey-credentials-create
\nExperimental\npublickey-credentials-get
\nExperimental\nscreen-wake-lock
\nExperimental\nserial
\nExperimental\nspeaker-selection
\nExperimental\nstorage-access
\nExperimental\nsummarizer
\nExperimental\ntranslator
\nExperimental\nusb
\nExperimental\nweb-share
\nExperimental\nwindow-management
\nExperimental\nxr-spatial-tracking
\nExperimental\n