HTTP Headers - Request and Response

What You'll Learn:

• Understanding common HTTP headers and their purposes

• Custom headers for API versioning and tracking

• Security-related headers and CORS

Detailed Explanation:

Common Request Headers

Authentication & Authorization:

Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
API-Key: abc123def456

Content Negotiation:

Accept: application/json
Accept-Language: en-US,en;q=0.9
Accept-Encoding: gzip, deflate, br

Client Identification:

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Referer: https://example.com/previous-page

Caching:

If-None-Match: "abc123"
If-Modified-Since: Mon, 23 Jan 2023 10:00:00 GMT

Common Response Headers

Content Information:

Content-Type: application/json; charset=utf-8
Content-Length: 2048
Content-Encoding: gzip

Caching Control:

Cache-Control: public, max-age=3600
ETag: "abc123"
Last-Modified: Mon, 23 Jan 2023 10:00:00 GMT

Security:

Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-Frame-Options: DENY

Custom Headers for APIs

API Versioning:

# Request
API-Version: 2023-01-01
Accept-Version: 2.0.0

# Response
API-Version: 2023-01-01
Deprecation: true
Sunset: Mon, 23 Jul 2023 10:00:00 GMT

Tracking & Debugging:

# Request
X-Request-ID: req-123456
X-Correlation-ID: corr-789012
X-User-ID: user-456

# Response
X-Request-ID: req-123456
X-RateLimit-Limit: 1000
X-RateLimit-Remaining: 999
X-RateLimit-Reset: 1674473445

CORS (Cross-Origin Resource Sharing)

Simple Request:

GET /api/users HTTP/1.1
Host: api.example.com
Origin: https://app.example.com

Preflight Request:

OPTIONS /api/users HTTP/1.1
Host: api.example.com
Origin: https://app.example.com
Access-Control-Request-Method: POST
Access-Control-Request-Headers: Content-Type, Authorization

CORS Response Headers:

HTTP/1.1 200 OK
Access-Control-Allow-Origin: https://app.example.com
Access-Control-Allow-Methods: GET, POST, PUT, DELETE
Access-Control-Allow-Headers: Content-Type, Authorization
Access-Control-Allow-Credentials: true
Access-Control-Max-Age: 86400

Security Headers Best Practices

Essential Security Headers:

# Prevent MIME type sniffing
X-Content-Type-Options: nosniff

# Prevent clickjacking
X-Frame-Options: DENY

# Enable HSTS
Strict-Transport-Security: max-age=31536000; includeSubDomains

# Content Security Policy
Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline'

# Prevent cross-site scripting
X-XSS-Protection: 1; mode=block

Spring Boot Header Configuration

CORS Configuration:

@Configuration
public class WebConfig implements WebMvcConfigurer {
    
    @Override
    public void addCorsMappings(CorsRegistry registry) {
        registry.addMapping("/api/**")
            .allowedOrigins("https://app.example.com")
            .allowedMethods("GET", "POST", "PUT", "DELETE")
            .allowedHeaders("*")
            .allowCredentials(true)
            .maxAge(3600);
    }
}

Custom Header Filter:

@Component
public class CustomHeaderFilter implements Filter {
    
    @Override
    public void doFilter(ServletRequest request, ServletResponse response, 
                        FilterChain chain) throws IOException, ServletException {
        
        HttpServletResponse httpResponse = (HttpServletResponse) response;
        
        // Add security headers
        httpResponse.setHeader("X-Content-Type-Options", "nosniff");
        httpResponse.setHeader("X-Frame-Options", "DENY");
        httpResponse.setHeader("X-XSS-Protection", "1; mode=block");
        
        // Add custom headers
        httpResponse.setHeader("X-API-Version", "1.0.0");
        httpResponse.setHeader("X-Request-ID", generateRequestId());
        
        chain.doFilter(request, response);
    }
}

Header Usage Examples

Content Negotiation:

# Client requests JSON
GET /api/users/123 HTTP/1.1
Accept: application/json

# Server responds with JSON
HTTP/1.1 200 OK
Content-Type: application/json; charset=utf-8

{"id": 123, "name": "John Doe"}

Conditional Requests:

# First request
GET /api/users/123 HTTP/1.1

# Response with ETag
HTTP/1.1 200 OK
ETag: "abc123"
Content-Type: application/json

{"id": 123, "name": "John Doe"}

# Subsequent request with ETag
GET /api/users/123 HTTP/1.1
If-None-Match: "abc123"

# Server responds with 304 if not modified
HTTP/1.1 304 Not Modified