Todo list of standard, permanent HTTP headers

[brendanzab]

I noticed when making my reverse proxy that the Forwarded header is not implemented, along with a bunch of others. So here's a list of 'permanent HTTP headers with a status of standard' on IANA's list, as of 2017-06-28:

• Accept: [RFC7231, Section 5.3.2]
• Accept-Charset: [RFC7231, Section 5.3.3]
• Accept-Encoding: [RFC7231, Section 5.3.4][RFC7694, Section 3]
• Accept-Language: [RFC7231, Section 5.3.5]
• Accept-Post: [https://www.w3.org/TR/ldp/]
• Accept-Ranges: [RFC7233, Section 2.3]
• Age: [RFC7234, Section 5.1]
• Allow: [RFC7231, Section 7.4.1]
• ALPN: [RFC7639, Section 2]
• Alt-Svc: [RFC7838]
• Alt-Used: [RFC7838]
• Authentication-Info: [RFC7615, Section 3]
• Authorization: [RFC7235, Section 4.2]
• Cache-Control: [RFC7234, Section 5.2]
• CalDAV-Timezones: [RFC7809, Section 7.1]
• Connection: [RFC7230, Section 6.1]
• Content-Disposition: [RFC6266]
• Content-Encoding: [RFC7231, Section 3.1.2.2]
• Content-Language: [RFC7231, Section 3.1.3.2]
• Content-Length: [RFC7230, Section 3.3.2]
• Content-Location: [RFC7231, Section 3.1.4.2]
• Content-Range: [RFC7233, Section 4.2]
• Content-Type: [RFC7231, Section 3.1.1.5]
• Cookie: [RFC6265]
• DASL: [RFC5323]
• DAV: [RFC4918]
• Date: [RFC7231, Section 7.1.1.2]
• Depth: [RFC4918]
• Destination: [RFC4918]
• ETag: [RFC7232, Section 2.3]
• Expect: [RFC7231, Section 5.1.1]
• Expires: [RFC7234, Section 5.3]
• Forwarded: [RFC7239]
• From: [RFC7231, Section 5.5.1]
• Host: [RFC7230, Section 5.4]
• HTTP2-Settings: [RFC7540, Section 3.2.1]
• If: [RFC4918]
• If-Match: [RFC7232, Section 3.1]
• If-Modified-Since: [RFC7232, Section 3.3]
• If-None-Match: [RFC7232, Section 3.2]
• If-Range: [RFC7233, Section 3.2]
• If-Schedule-Tag-Match: [RFC6638]
• If-Unmodified-Since: [RFC7232, Section 3.4]
• Last-Modified: [RFC7232, Section 2.2]
• Location: [RFC7231, Section 7.1.2]
• Lock-Token: [RFC4918]
• Max-Forwards: [RFC7231, Section 5.1.2]
• MIME-Version: [RFC7231, Appendix A.1]
• Ordering-Type: [RFC4229]
• Origin: [RFC6454]
• Overwrite: [RFC4918]
• Position: [RFC4229]
• Pragma: [RFC7234, Section 5.4]
• Prefer: [RFC7240]
• Preference-Applied: [RFC7240]
• Proxy-Authenticate: [RFC7235, Section 4.3]
• Proxy-Authentication-Info: [RFC7615, Section 4]
• Proxy-Authorization: [RFC7235, Section 4.4]
• Public-Key-Pins: [RFC7469]
• Public-Key-Pins-Report-Only: [RFC7469]
• Range: [RFC7233, Section 3.1]
• Referer: [RFC7231, Section 5.5.2]
• Retry-After: [RFC7231, Section 7.1.3]
• Schedule-Reply: [RFC6638]
• Schedule-Tag: [RFC6638]
• Sec-WebSocket-Accept: [RFC6455]
• Sec-WebSocket-Extensions: [RFC6455]
• Sec-WebSocket-Key: [RFC6455]
• Sec-WebSocket-Protocol: [RFC6455]
• Sec-WebSocket-Version: [RFC6455]
• Server: [RFC7231, Section 7.4.2]
• Set-Cookie: [RFC6265]
• SLUG: [RFC5023]
• Strict-Transport-Security: [RFC6797]
• TE: [RFC7230, Section 4.3]
• Timeout: [RFC4918]
• Topic: [RFC8030, Section 5.4]
• Trailer: [RFC7230, Section 4.4]
• Transfer-Encoding: [RFC7230, Section 3.3.1]
• TTL: [RFC8030, Section 5.2]
• Urgency: [RFC8030, Section 5.3]
• Upgrade: [RFC7230, Section 6.7]
• User-Agent: [RFC7231, Section 5.5.3]
• Vary: [RFC7231, Section 7.1.4]
• Via: [RFC7230, Section 5.7.1]
• WWW-Authenticate: [RFC7235, Section 4.1]
• Warning: [RFC7234, Section 5.5]

We have some other headers not in this list in our headers::common module:

• Access-Control-* - classed as 'provisional' by IANA - not sure what this means, see Access-Control-Allow-Credentials header #655
• Last-Event-ID - not listed, see Implement Last-Event-ID header #723
• Referer-Policy - not listed, see feat(headers): Add Referrer-Policy header #850

I'm not sure what we want to do with these - whether we keep them, or move them to another module for clarity. This list will also have to be kept up to date. I copied the HTML and used multiple cursors to make it, but it could be a bit error prone. It's a start at least though!

[seanmonstar]

I'm actually not too worried about what is in the IANA registry. People register all sorts of super specific headers there, but that doesn't mean that everyone actually uses them.

For instance, the Access-Control headers are quite common for web apps, Whereas all the DAV related headers are likely used by very few (I had no idea there was so many).

So far, we've added the headers as people have needed them. If the header isn't that common, it's been recommended to make a separate crate.

[brendanzab]

Sounds reasonable. Perhaps it would be good to document the position somewhere of what headers make it into the library?