HTTP Header

An HTTP header is a key-value field included in an HTTP request or response to provide metadata about the message.

Headers can describe the client, server, content type, authentication method, caching policy, cookies, accepted formats, and many other details related to web communication.

HTTP headers are essential for browsers, APIs, proxies, web servers, and automated data systems.

Also known as: Request header, response header, HTTP metadata.

How Do HTTP Headers Work?

HTTP headers are transmitted alongside an HTTP request or response.

A typical request may include:

GET /products HTTP/1.1
Host: example.com
Accept: application/json
User-Agent: ExampleClient/1.0

The server may return:

HTTP/1.1 200 OK
Content-Type: application/json
Cache-Control: max-age=3600

Each header communicates additional information about how the request or response should be handled.

Request Headers

Request headers are sent from the client to the server.

They may describe:

• Requested content types
• Authentication credentials
• Browser or client information
• Cookies
• Language preferences
• Compression support
• Origin information

Common request headers include:

Host
User-Agent
Accept
Authorization
Cookie
Accept-Language
Accept-Encoding
Referer
Origin

Response Headers

Response headers are sent from the server to the client.

They may describe:

• Response content type
• Caching rules
• Cookies
• Redirect locations
• Server behavior
• Security policies

Common response headers include:

Content-Type
Content-Length
Cache-Control
Set-Cookie
Location
Server
ETag
Last-Modified

General Header Structure

An HTTP header usually follows this format:

Header-Name: value

For example:

Content-Type: application/json

or:

Authorization: Bearer TOKEN

The header name identifies the type of metadata, while the value contains the corresponding information.

Common HTTP Request Headers

Host

The Host header identifies the hostname of the server being requested.

For example:

Host: example.com

This is especially important when multiple websites share the same IP address.

User-Agent

The User-Agent header identifies information about the client making the request.

For example:

User-Agent: ExampleBrowser/1.0

Servers may use this information for compatibility, analytics, or traffic classification.

Accept

The Accept header tells the server which response formats the client can process.

For example:

Accept: application/json

Authorization

The Authorization header carries authentication credentials or tokens.

For example:

Authorization: Bearer TOKEN

Cookie

The Cookie header sends previously stored cookies back to the server.

For example:

Cookie: session_id=abc123

Common HTTP Response Headers

Content-Type

The Content-Type header tells the client what type of content is being returned.

Examples include:

text/html
application/json
image/png
text/css

For example:

Content-Type: application/json

Content-Length

The Content-Length header indicates the size of the response body in bytes.

Set-Cookie

The Set-Cookie header instructs the client to store a cookie.

For example:

Set-Cookie: session_id=abc123

Location

The Location header often specifies the destination of a redirect.

For example:

Location: /new-page

Cache-Control

The Cache-Control header defines caching behavior.

For example:

Cache-Control: max-age=3600

This tells compatible caches that the response may be reused for a limited period.

HTTP Headers vs. HTTP Body

Headers provide metadata about the message.

The body contains the actual content being transferred.

For example:

Content-Type: application/json

is a header, while:

{
  "product": "Wireless Mouse",
  "price": 29.99
}

is the response body.

In simple terms:

• HTTP Header: Describes the message.
• HTTP Body: Contains the main content.

HTTP Headers vs. Query Parameters

Query parameters are included in the requested path.

For example:

/products?category=electronics

Headers are separate metadata fields sent with the request.

In simple terms:

• Query Parameter: Usually describes resource-specific request data.
• HTTP Header: Usually describes how the request should be processed.

Both can influence server behavior.

Headers and Content Negotiation

HTTP headers allow clients and servers to negotiate formats.

For example, a client may send:

Accept: application/json

to request JSON.

Another client may request:

Accept: text/html

The server can return different formats depending on what it supports.

Headers and Authentication

Many APIs use headers for authentication.

A common pattern is:

Authorization: Bearer TOKEN

The server validates the supplied credential before allowing access to protected resources.

Authentication headers should be transmitted over encrypted HTTPS connections.

Headers and Caching

Caching behavior is often controlled through headers.

Examples include:

Cache-Control
ETag
Last-Modified
Expires

These headers help browsers, proxies, and content delivery systems determine whether they can reuse a previously downloaded response.

Headers and Cookies

Cookies are exchanged through HTTP headers.

The server may create a cookie with:

Set-Cookie: session_id=abc123

The client can later return it with:

Cookie: session_id=abc123

This allows websites to maintain session state across multiple HTTP requests.

HTTP Headers and Proxies

Proxies receive and forward HTTP requests, so they may also process headers.

Depending on configuration, a proxy may:

• Forward headers unchanged
• Add new headers
• Remove selected headers
• Rewrite values
• Add authentication information
• Add forwarding metadata

Common proxy-related headers may include fields used to describe forwarded requests or intermediary infrastructure.

The exact headers depend on the proxy and server configuration.

HTTP Headers and Web Data Collection

HTTP headers are important in API clients and web data workflows because servers can use them to determine how to process a request.

A data collection client may need to send headers such as:

Accept
Authorization
Content-Type
Cookie
User-Agent

For example, an API request may require:

Accept: application/json
Authorization: Bearer TOKEN

Without the expected headers, the server may return a different response or reject the request.

Security Considerations

HTTP headers can contain sensitive or security-related information.

Examples include:

• Authentication tokens
• Session cookies
• Origin information
• Security policies
• Cross-origin controls

Applications should avoid exposing secrets in logs and should use HTTPS when transmitting sensitive header values.

Servers should also validate incoming headers rather than assuming all client-supplied values are trustworthy.

Example

Suppose an application requests product data from an API.

The request may look like:

GET /products/1001 HTTP/1.1
Host: example.com
Accept: application/json
Authorization: Bearer TOKEN

The server may respond:

HTTP/1.1 200 OK
Content-Type: application/json
Cache-Control: no-cache

with a body such as:

{
  "id": 1001,
  "name": "Wireless Mouse",
  "price": 29.99
}

In this exchange, the headers describe how the request is authenticated, what format the client expects, and how the returned content should be handled.

Key Takeaway

An HTTP header is a metadata field included with an HTTP request or response.

Request headers tell servers about the client and how the request should be processed, while response headers describe the returned content and server behavior. Headers play an important role in authentication, caching, cookies, proxies, APIs, content negotiation, and web data workflows.