HTTP/1.0 Headers (case insensitive?)
Allow - returned by server
- Allow: GET, HEAD
- never used in practice - clients know what they can do
Authorization - sent by client
- Authorization: <credentials>
- “Basic Auth” is commonly used
- <credentials> = Base64( username:password )
- ok if inside an SSL connection (encrypted)
Content-Encoding - sent by either
- Content-Encoding: x-gzip
- selects an encoding for the transport, not the content
- sadly, no common support for encodings (Windows)