The message body carries the core data, but the request/response needs metadata—content type, authentication, caching rules, client info—that shouldn’t be mixed with the payload.
Headers are key-value pairs providing metadata about the request or response. They’re like the address on a parcel—metadata that lets intermediaries process messages without opening the body.
Sent by the client to describe the request:
Authorization: Credentials (bearer token)Accept: Expected content types (JSON, HTML)User-Agent: Client identification
Used in both requests and responses:
Date: TimestampCache-Control: Caching directives (no-cache, max-age)Connection: Keep-alive or close
Describe the body content:
Content-Type: Media type (application/json)Content-Length: Size in bytesContent-Encoding: Compression (gzip, deflate)ETag: Unique identifier for caching
Enhance security:
Strict-Transport-Security(HSTS): Enforce HTTPSContent-Security-Policy(CSP): Restrict content sourcesX-Frame-Options: Prevent clickjackingSet-Cookie: With HttpOnly/Secure flags
- Built from: HTTP (the message structure)
- Related to: HTTP Status Codes (response metadata)
- Related to: CORS (uses headers for cross-origin control)
- Related to: HTTP Methods (define what the request wants to do)
- Custom headers can use
X-prefix but this is now discouraged - Headers are case-insensitive but conventionally Title-Case
- Large header values can cause issues with some proxies