What keys are transmitted from the server to the client?

The main keys transmitted from the server to the client are used in HTTP caching mechanisms:

• Cache-Control: Manages caching behavior on both the client side and proxy servers. Indicates whether a resource can be cached, its maximum age (max-age), the need for revalidation (no-cache), cache prohibition (no-store), and other directives.
• Expires: Specifies the exact date and time after which the cached resource is considered stale. It is deprecated compared to Cache-Control: max-age.
• ETag: A unique identifier for the resource version. Used by the client in the If-None-Match header during subsequent requests to verify the freshness of the cached copy. If the ETag on the server matches the one sent by the client, the server returns a 304 Not Modified status.
• Last-Modified: The date and time of the last modification of the resource. Used by the client in the If-Modified-Since header for the same purpose as ETag. If the resource has not been modified since the specified date, the server returns 304 Not Modified.

In addition to caching, keys related to security and session management can be transmitted:

• Set-Cookie: Sets a cookie on the client side. Contains the cookie name, value, domain, path, expiration, flags (HttpOnly, Secure, SameSite).
• Strict-Transport-Security (HSTS): Instructs the browser that access to the domain should only be via HTTPS for a specified period.
• Public-Key-Pins (HPKP - deprecated): Instructed the browser which public keys should be associated with the domain. Used to prevent MITM attacks using fake certificates. Deprecated and not recommended for use.