What are HTTP Headers? — Request & Response Headers Explained
Definition
HTTP headers are key-value pairs transmitted at the beginning of every HTTP request and response. They carry metadata about the message — what format the body is in, what the client accepts, how long to cache the response, whether the connection should be kept alive, authentication credentials, security policies, and much more. Headers are separate from the URL and the body, appearing between the request line (or status line) and the message body.
How It Works
Headers have the format Name: Value, one per line, and are terminated by a blank line that separates them from the body. Request headers are sent by the client and describe what it wants (Accept-Language: en-US, Authorization: Bearer token) or what it is sending (Content-Type: application/json). Response headers are sent by the server and describe the response (Content-Type: application/json, Cache-Control: max-age=3600, Set-Cookie: session=abc). Some headers are standard; others are custom (often prefixed with X- historically). HTTP/2 and HTTP/3 compress headers to reduce overhead.
Common Use Cases
- ▸Setting Content-Type to tell the receiver how to parse the request or response body
- ▸Using Authorization: Bearer to authenticate API requests
- ▸Configuring Cache-Control and ETag for browser and CDN caching
- ▸Setting security headers like CSP, HSTS, and X-Frame-Options
- ▸Passing correlation IDs and trace context between microservices
Example
// Request headers: GET /api/data HTTP/1.1 Host: api.example.com Authorization: Bearer eyJhbGci... Content-Type: application/json Accept: application/json // Response headers: HTTP/1.1 200 OK Content-Type: application/json Cache-Control: no-store X-Request-Id: abc-123
Related Tools
FAQ
- What is the difference between request and response headers?
- Request headers are sent by the client to describe the request (what content types it accepts, what credentials it has, what it is sending). Response headers are sent by the server to describe the response (its content type, caching rules, cookies to set, security policies).
- What is the Content-Type header and why is it important?
- Content-Type tells the receiver how to interpret the message body. For requests, it describes the format being sent (application/json, multipart/form-data). For responses, it tells the browser how to display or process the data. A wrong Content-Type can cause parsing errors or security vulnerabilities.
- What security headers should every website have?
- Recommended security headers: Content-Security-Policy (restrict resource loading), Strict-Transport-Security (enforce HTTPS), X-Content-Type-Options: nosniff (prevent MIME sniffing), X-Frame-Options: DENY (prevent clickjacking), Referrer-Policy, and Permissions-Policy.