HTTP Status Code & Header Reference

HTTP 参考手册：状态码、消息头、写法配方

收录 72 个状态码（含触发场景与排查建议）、65 个消息头（含语法模板与例子）、12 个可直接粘贴的写法配方。全程离线可用。

72 条 · 点击任一行看场景与排查建议

状态码分段

  • 1xx · 信息性 — 请求已收到，继续处理
  • 2xx · 成功 — 请求已被理解并接受
  • 3xx · 重定向 — 还要再去别的地址一步
  • 4xx · 客户端错误 — 请求本身有问题，改调用方
  • 5xx · 服务端错误 — 服务端或上游故障

标了「扩展」的不是 IANA 登记的码：Cloudflare、nginx、部分 PaaS 各自定义了自有码，处理时要按厂商文档理解。

HTTP Status Code & Header Reference

72 status codes, 65 headers, 12 request recipes and a MIME cheat sheet, bilingual and offline

Runs locally · Nothing uploaded

Overview

This is an engineer-oriented HTTP reference. It answers not only what 404 means, but where to look once you get one, and exactly how the headers for a given request should be written. The status code table holds 72 entries, built on the complete RFC 9110 set and extended with codes standardised elsewhere (WebDAV RFC 4918, RFC 6585 for 426, 428, 429 and 431, RFC 8297 for 103 Early Hints, RFC 8470 for 425 Too Early, RFC 7725 for 451 Legal Reasons, RFC 7538, RFC 5842, RFC 2295, RFC 2774) plus the non-standard codes you actually meet in logs: nginx 499, Cloudflare 520-526, IIS 530. Anything outside the RFC 9110 set carries an extension badge with its source, so you never mistake it for standard behaviour. Each entry gives a bilingual meaning, real trigger scenarios, a triage direction, and related headers you can jump to. The header section covers 65 fields you genuinely have to write, each with a syntax template and a concrete example, with extra care on conditional requests, cache layers, CORS preflight and security response headers, which is where mistakes concentrate. The Recipes tab turns 12 frequent scenarios into copyable request blocks in curl, fetch, axios, Python requests, Go and more. The MIME table lists the 55 types worth handwriting and notes where a registered name differs from a tolerated alias. Everything ships in the bundle and works offline.

Features

  • 72 HTTP status codes: the full RFC 9110 set plus common extensions from WebDAV, RFC 6585, Cloudflare and nginx
  • Every code ships with its meaning, what actually triggers it, how to triage it, and which headers to check next
  • 65 headers you really write by hand, grouped into 12 categories: general, request, content, conditionals, caching, auth, cookie, CORS, security, WebSocket, proxies, observability
  • Every header ships with a syntax template, a paste-ready example, and the pitfalls around it
  • 12 request recipes: JSON APIs, auth, uploads, downloads, CORS, caching, SSE streaming, resumable downloads, rate limiting, security headers, reverse proxy, WebSocket handshake
  • Each recipe includes runnable snippets in curl, JavaScript, Python and more, with one-click copy
  • 55 practical MIME / Content-Type entries, flagging where the IANA registered name differs from what browsers accept
  • Bilingual Chinese and English, fully offline, no horizontal scrolling on mobile

How It Works

  1. 1 Four tabs up top: Status codes, Headers, Recipes, MIME. The first visit expands a short how-to-use guide
  2. 2 On the status tab a proportion bar and category chips let you isolate one band from 1xx to 5xx
  3. 3 Click any code to expand it into meaning, common triggers, triage steps, then related headers
  4. 4 Related headers are blue chips; clicking one switches to the Headers tab and scrolls to that field
  5. 5 Each header shows two blocks, syntax and example, each independently copyable
  6. 6 On the Recipes tab pick a scenario, read what problem it solves, copy the snippet for your language, then read the caveats below it
  7. 7 The MIME tab searches across both type name and extension, and the note column explains registered name versus alias

Tips

  • Write Content-Type as application/json. Header names are case-insensitive, but header values are not, and a wrong casing can break server-side parsing
  • Always send Retry-After with a 429, otherwise clients can only retry blindly and amplify the outage
  • Use 307 or 308 when the method must be preserved; legacy behaviour can turn a POST into a GET on 301 and 302
  • On a CORS failure, check first whether Access-Control-Allow-Origin is present at all; when the request carries credentials its value cannot be a wildcard and must echo the exact origin
  • When both ETag and Last-Modified are present, a conditional request must validate both before you get a 304
  • Behind a reverse proxy read X-Forwarded-For for the real client IP, but remember the client can forge it and only trust the hop your own proxy appended
  • HSTS is hard to take back once issued, since max-age can reach a year; validate on a short max-age and a small scope first
  • Use multipart/form-data for large uploads, Range with 206 for resumption, and for token streaming use SSE with Content-Type set to text/event-stream

Related tools

Tags HTTPStatus CodeMIMEDevelopment

FAQ

Which status codes are included, and why more than a typical table?

72 in total. The backbone is the full set defined by RFC 9110 (HTTP Semantics), extended with codes standardised by other documents (WebDAV RFC 4918; RFC 6585 for 426, 428, 429 and 431; RFC 8297 for 103 Early Hints; RFC 8470 for 425 Too Early; RFC 7725 for 451 Legal Reasons; RFC 7538; RFC 5842; RFC 2295; RFC 2774) and the non-standard codes that appear constantly in real logs, such as nginx 499, Cloudflare 520-526 and IIS 530. Anything outside the RFC 9110 set carries an extension badge naming its source, so you can judge how far to rely on it.

Why only 65 headers instead of every header?

Only fields you genuinely type into a request or have to explain from a capture. The bar for inclusion is that you either write it in code or need to interpret it while debugging. Each one gets a syntax template and an example. A short useful list beats a complete list nobody reads.

Can the recipe code be run as-is?

It is a paste-ready skeleton: the request shape and the headers are complete and correct. Swap in your own host, path, token and file paths. Each recipe ends with the caveats for that scenario.

Is 55 MIME types enough?

Deliberate trade-off. IANA registers thousands, but engineers hand-write a few dozen. Rather than bury the common ones in a wall of rows, these 55 are written precisely, and the notes separate registered names from tolerated aliases: image/jpeg is the registered form and image/jpg is only an alias, icons should be image/vnd.microsoft.icon while image/x-icon is historical, and application/gzip differs from application/x-gzip.

Can it send requests for me?

No. This is a purely offline reference and snippet generator. It contacts no server and needs no network. To verify a real response, use your browser devtools or curl alongside it.

Does it work on a phone?

Yes. Every code block wraps, the page never scrolls horizontally on narrow screens, and the category chips scroll sideways.

All Tools | 京ICP备16061460号-4 | Sitemap