Reference
HTTP headers, explained
Headers are the control plane of an HTTP message: they choose the site, describe the body, decide what may be cached and who may read it. These entries cover the ones that change behaviour in practice.
The same message, two directions
Request headers describe what the client wants and who it is; response headers describe what the server returned, how long it may be kept and what the browser must enforce. A handful of names, such as Content-Type, appear in both directions with the same meaning.
Header names are case-insensitive and the order is not significant. Duplicates are allowed for some fields and forbidden for others, so a parser must know the field, not just split on colons.
Headers are security surface
Several headers are effectively security policy: Content-Security-Policy constrains script execution, Strict-Transport-Security prevents protocol downgrade, Set-Cookie decides whether a session can be read by scripts or sent cross-site. Missing headers are as important as wrong ones.
Other headers are attacker-controlled input. Host, X-Forwarded-For and Referer must be validated before they are used to build URLs, make trust decisions or write logs.