Request headers

Request headers add context the server needs to interpret a message. They ride on every request, even when there is no body.

A typical browser-style GET looks like this:

GET /blog/ HTTP/1.1
Host: flaviocopes.com
Accept: text/html,application/xhtml+xml
Accept-Language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 ...

Host names the site you want on this IP address. One server can host many domains; without Host, it would not know which site you mean.

Accept lists formats the client can handle. Accept-Language states language preferences for content negotiation.

When you send a body, Content-Type describes its encoding (application/json, application/x-www-form-urlencoded, etc.). Content-Length or chunked encoding tells the server how to read the bytes.

Authentication and state show up in headers too. Authorization often carries a bearer token. Cookie sends stored cookies that match the URL. The header name is Referer, misspelled in the spec on purpose. It can tell the server which page linked here, though browsers may strip it for privacy.

See what your curl install sends by default:

curl -v -o /dev/null -s https://httpbin.org/get

httpbin reflects the request in JSON. Look at "headers": you will see Host, Accept, and User-Agent even though you only typed a URL.

Add your own:

curl -v https://httpbin.org/post \
  -H 'Authorization: Bearer demo-token' \
  -H 'Content-Type: application/json' \
  -d '{"title":"Learn HTTP"}'

The echoed headers include Authorization and Content-Type exactly as you set them.

Headers are not proof by themselves. Any client can forge User-Agent, Referer, or X-Forwarded-For. Make security decisions with cryptography, session validation, and infrastructure you control, not with trusting raw header text.

Custom headers like X-Request-Id are fine for tracing, but remember they are advisory unless your edge network sets them and strips forgeries from the public internet.

Try this on your own project: log incoming request headers in development for one endpoint, then cross out any header you should not rely on for authorization.