Dries Buytaert

Explanation

The Retry-After header indicates how long the user agent should wait before making a follow-up request. It's commonly used with 503 (Service Unavailable) responses or for rate limiting. The value can be either a number of seconds to wait or an HTTP-date after which to retry. This header helps in managing traffic and server load by instructing clients when to retry their requests.

The type of the message body, specified as a MIME type.

Used by the server to advertise its support of partial HTTP requests. The browser can ask for a range or subset of the response body. It's a feature that allows a browser to resume an interrupted download. bytes is the only range unit currently supported. none means that the server does not support range requests.

The date and time at which the request was made. A browser uses it for age calculations rather than using its own internal date and time; e.g. when comparing against Max-Age or Expires.

Provides timing information about the journey of a request through Fastly's network. Format: s<timestamp>,vs<seconds>,ve<seconds>, where s is the start time of the request, ve stands for Varnish start and ve stands for Varnish end. The length of the trip is ve - vs milliseconds.

Communicates one or more metrics for a given request-response cycle. Can includes metrics for CPU time, database read/writes, file system access, etc.

The Timing-Allow-Origin header is part of the Resource Timing API. It controls which origins can access detailed timing information about the resource. This can be used to measure performance while still maintaining some level of privacy.
Any origin is allowed to access the timing information for this resource.

The X-Content-Type-Options header, when set to nosniff, prevents MIME type sniffing. This enhances security by ensuring browsers respect the declared Content-Type of the response, mitigating MIME confusion attacks.
The value nosniff is correctly set, providing protection against MIME type sniffing attacks.

The Content Security Policy (CSP) header helps prevent cross-site scripting (XSS), clickjacking, and other code injection attacks by specifying which dynamic resources are allowed to load.
upgrade-insecure-requests instructs browsers to replace insecure URLs (HTTP) with secure URLs (HTTPS).

The Accept-CH header specifies HTTP Client Hints that the server requests from the client (typically a browser) to optimize content delivery.

Instructs a browser to selectively allow or deny certain browser APIs and features. It helps improve security.

The size of the message body, in bytes.

missing Add a Strict-Transport-Security header. The Strict-Transport-Security header or HSTS header is used to instruct browsers to only use HTTPS, instead of using HTTP. It helps enforce secure communication.

missing Add a Referrer-Policy header. When a visitor navigates from one page to another, browsers often pass along referrer information. The Referrer-Policy header controls how much referrer information a browser can share. This is important to configure when private information is embedded in the path or query string and passed onto an external destination.

missing Add a Cross-Origin-Embedder-Policy to specify how this page can be loaded by cross-origin resources.

missing Add a Cross-Origin-Opener-Policy header to opt-in into better browser isolation.

missing Add a Cross-Origin-Resource-Policy header to specify who can load this page.

missing Add a X-Permitted-Cross-Domain-Policies header to prevent Flash, Adobe Reader and other clients from sharing data across domains.