• HTTP
  • HTTP
  • A typical HTTP session
  • HTTP caching
  • HTTP conditional requests
  • Protocol upgrade mechanism
  • HTTP Observatory
  • Permissions Policy Experimental
  • CORS errors
    1. Reason: CORS header 'Origin' cannot be added
    2. Reason: CORS request not HTTP
    3. Reason: invalid token 'xyz' in CORS header 'Access-Control-Allow-Headers'
    4. Reference
    5. Accept-Encoding
    6. Accept-Ranges
    7. Access-Control-Allow-Origin
    8. Access-Control-Request-Method
    9. Alt-Used
    10. Attribution-Reporting-Eligible Experimental
    11. Attribution-Reporting-Register-Source Experimental
    12. Attribution-Reporting-Register-Trigger Experimental
    13. Connection
    14. Content-DPR Non-standard Deprecated
    15. Content-Location
    16. Content-Type
    17. Critical-CH Experimental
    18. Date
    19. DNT Non-standard Deprecated
    20. Downlink Experimental
    21. DPR Non-standard Deprecated
    22. Early-Data Experimental
    23. ECT Experimental
    24. Expect-CT Deprecated
    25. Host
    26. If-Range
    27. Link
    28. NEL Experimental
    29. No-Vary-Search Experimental
    30. Observe-Browsing-Topics Experimental Non-standard
    31. Origin-Agent-Cluster Experimental
    32. Permissions-Policy Experimental
    33. Pragma Deprecated
    34. Range
    35. Report-To Non-standard Deprecated
    36. Reporting-Endpoints Experimental
    37. RTT Experimental
    38. Save-Data Experimental
    39. Sec-Browsing-Topics Experimental Non-standard
    40. Sec-CH-Prefers-Color-Scheme Experimental
    41. Sec-CH-Prefers-Reduced-Motion Experimental
    42. Sec-CH-Prefers-Reduced-Transparency Experimental
    43. Sec-CH-UA Experimental
    44. Sec-CH-UA-Arch Experimental
    45. Sec-CH-UA-Bitness Experimental
    46. Sec-CH-UA-Form-Factors Experimental
    47. Sec-CH-UA-Full-Version Deprecated
    48. Sec-CH-UA-Full-Version-List Experimental
    49. Sec-CH-UA-Mobile Experimental
    50. Sec-CH-UA-Model Experimental
    51. Sec-CH-UA-Platform Experimental
    52. Sec-CH-UA-Platform-Version Experimental
    53. Sec-CH-UA-WoW64 Experimental
    54. Sec-Fetch-User
    55. Sec-GPC Experimental
    56. Sec-WebSocket-Key
    57. Server-Timing
    58. Set-Cookie
    59. Set-Login Experimental
    60. Speculation-Rules Experimental
    61. Supports-Loading-Mode Experimental
    62. Tk Non-standard Deprecated
    63. Upgrade-Insecure-Requests
    64. Viewport-Width Non-standard Deprecated
    65. Warning Deprecated
    66. Width Non-standard Deprecated
    67. X-DNS-Prefetch-Control Non-standard
    68. X-Forwarded-For Non-standard
    69. X-Forwarded-Host Non-standard
    70. X-Forwarded-Proto Non-standard
    71. X-Permitted-Cross-Domain-Policies Non-standard
    72. X-Powered-By Non-standard
    73. X-Robots-Tag Non-standard
    74. X-XSS-Protection Non-standard Deprecated
  • GET
  • POST
  • 100 Continue
  • 200 OK
  • 204 No Content
  • 208 Already Reported
  • 302 Found
  • 308 Permanent Redirect
  • 403 Forbidden
  • 407 Proxy Authentication Required
  • 411 Length Required
  • 415 Unsupported Media Type
  • 421 Misdirected Request
  • 425 Too Early
  • 431 Request Header Fields Too Large
  • 502 Bad Gateway
  • 506 Variant Also Negotiates
  • 511 Network Authentication Required
  • CSP: block-all-mixed-content Deprecated
  • CSP: fenced-frame-src Experimental
  • CSP: frame-src
  • CSP: object-src
  • CSP: prefetch-src Non-standard Deprecated
  • CSP: report-uri Deprecated
  • CSP: script-src-attr
  • CSP: style-src-elem
  • Permissions-Policy directives Experimental
    1. Permissions-Policy: accelerometer Experimental
    2. Permissions-Policy: ambient-light-sensor Experimental
    3. Permissions-Policy: attribution-reporting Experimental
    4. Permissions-Policy: autoplay Experimental
    5. Permissions-Policy: bluetooth Experimental
    6. Permissions-Policy: browsing-topics Experimental Non-standard
    7. Permissions-Policy: camera Experimental
    8. Permissions-Policy: compute-pressure Experimental
    9. Permissions-Policy: cross-origin-isolated Experimental
    10. Permissions-Policy: display-capture Experimental
    11. Permissions-Policy: document-domain Experimental
    12. Permissions-Policy: encrypted-media Experimental
    13. Permissions-Policy: fullscreen Experimental
    14. Permissions-Policy: gamepad Experimental
    15. Permissions-Policy: geolocation Experimental
    16. Permissions-Policy: gyroscope Experimental
    17. Permissions-Policy: hid Experimental
    18. Permissions-Policy: identity-credentials-get Experimental
    19. Permissions-Policy: idle-detection Experimental
    20. Permissions-Policy: local-fonts Experimental
    21. Permissions-Policy: magnetometer Experimental
    22. Permissions-Policy: microphone Experimental
    23. Permissions-Policy: midi Experimental
    24. Permissions-Policy: otp-credentials Experimental
    25. Permissions-Policy: payment Experimental
    26. Permissions-Policy: picture-in-picture Experimental
    27. Permissions-Policy: publickey-credentials-create Experimental
    28. Permissions-Policy: publickey-credentials-get Experimental
    29. Permissions-Policy: screen-wake-lock Experimental
    30. Permissions-Policy: serial Experimental
    31. Permissions-Policy: speaker-selection Experimental
    32. Permissions-Policy: storage-access Experimental
    33. Permissions-Policy: usb Experimental
    34. Permissions-Policy: web-share Experimental
    35. Permissions-Policy: window-management Experimental
    36. Permissions-Policy: xr-spatial-tracking Experimental
  • experimental technology
    Check the Browser compatibility table carefully before using this in production.

  • The HTTP Save-Data network client hint which indicates the client's preference for reduced data usage. This could be for reasons such as high transfer costs, slow connection speeds, etc.

    Save-Data is a Accept-CH response header. Further, it should be used to reduce data sent to the client irrespective of the values of other client hints that indicate network capability, like RTT.

    A value of On indicates explicit user opt-in into a reduced data usage mode on the client. When communicated to origins, this allows them to deliver alternative content to reduce the data downloaded such as smaller image and video resources, different markup and styling, disabled polling and automatic updates, and so on.

    Note: Disabling HTTP/2 Server Push (RFC 7540, section 8.2: Server Push) may reduce data downloads. Note that this feature is no longer supported by default in most major browser engines.

    Header type Request header, Client hint
    Forbidden request header No
    CORS-safelisted response header No

    Syntax

    http
    Save-Data: <sd-token>
    

    Directives

    <sd-token>

    A value indicating whether the client wants to opt in to reduced data usage mode. on indicates yes, while off (the default) indicates no.

    Examples

    Using Save-Data: on

    The following message requests a resource with Save-Data header indicating the client is opting in to reduced data mode:

    http
    GET /image.jpg HTTP/1.1
    Host: example.com
    Save-Data: on
    

    The server responds with a 200 response, and the Vary header indicates that Save-Data may have been used to create the response, and caches should be aware of this header to differentiate responses:

    http
    HTTP/1.1 200 OK
    Content-Length: 102832
    Vary: Accept-Encoding, Save-Data
    Cache-Control: public, max-age=31536000
    Content-Type: image/jpeg
    
    […]
    

    Omitting Save-Data

    In this case, the client requests the same resource without the Save-Data header:

    http
    GET /image.jpg HTTP/1.1
    Host: example.com
    

    The server's response provides the full version of the content. The Vary header ensures that responses should be separately cached based on the value of the Save-Data header. This can ensure that the user is not served a lower-quality image from the cache when the Save-Data header is no longer present (e.g., after having switched from cellular to Wi-Fi).

    http
    HTTP/1.1 200 OK
    Content-Length: 481770
    Vary: Accept-Encoding, Save-Data
    Cache-Control: public, max-age=31536000
    Content-Type: image/jpeg
    
    […]
    

    Specifications

    Specification
    Save Data API
    # save-data-request-header-field

    Browser compatibility

    See also