HTTP Headers Explained for Developers and DevOps

Every HTTP request and response consists of two parts: a header section and an optional body. Headers are newline-delimited key-value pairs sent before the body. They instruct the client and server how to handle the exchange — without being part of the content itself.

Headers follow the format Header-Name: value. Names are case-insensitive. Multiple headers with the same name are valid in HTTP/1.1 (treated as a comma-separated list for most headers, but handled differently for Set-Cookie).

Request headers are sent by the client (browser, API consumer, CLI tool) to the server. They carry authentication credentials, describe what content formats are acceptable, specify the target host, and provide browser/device information.

Response headers are sent by the server back to the client. They describe the content being returned, set caching rules, instruct the browser to apply security policies, redirect to another URL, or set cookies for subsequent requests.

GET /api/users HTTP/1.1
Host: api.example.com
Authorization: Bearer eyJhbGciOiJIUzI1NiJ9...
Accept: application/json
User-Agent: Mozilla/5.0 (compatible; MyApp/1.0)
Content-Type: application/json

HTTP/1.1 200 OK
Content-Type: application/json; charset=utf-8
Cache-Control: no-store
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Frame-Options: DENY
Set-Cookie: session=abc123; HttpOnly; Secure; SameSite=Strict

The most important request headers to understand when debugging APIs and HTTP traffic:

Response headers sent by the server control how the client (and intermediate proxies) handles the response:

Debugging APIs

When an API call fails or returns unexpected data, the first step is always to inspect the raw headers. A 401 Unauthorized means the Authorization header is missing, malformed, or expired. A 415 Unsupported Media Type means the Content-Type header is wrong or absent on a POST request. Use HTTP Header Analyzer to parse headers copied from browser DevTools or curl output.

CDN Caching

CDNs like Cloudflare, Fastly, and CloudFront cache responses based on the Cache-Control and Vary headers. If Cache-Control: no-store is set, the CDN never caches the response. If it is missing, the CDN may cache responses indefinitely. The Vary: Accept-Encoding header ensures separate cache entries for compressed and uncompressed responses.

Authentication and Sessions

Every authentication mechanism flows through headers. Bearer tokens arrive in Authorization: Bearer <token>. Session cookies set via Set-Cookie are returned by the browser on every subsequent request in the Cookie header. API keys are commonly passed in X-API-Key or as part of Authorization.

Browser Security Policies

Security headers apply policies that the browser enforces on behalf of the server. These must be explicitly set — they are never applied by default:

• • Content-Security-Policy — restricts sources for scripts, images, fonts, and frames (prevents XSS)
• • Strict-Transport-Security — forces HTTPS for future visits within the max-age window (HSTS)
• • X-Frame-Options — prevents your page from being loaded in an iframe (clickjacking protection)
• • X-Content-Type-Options: nosniff — prevents MIME-type sniffing on script and stylesheet responses
• • Permissions-Policy — controls access to browser APIs (camera, geolocation, clipboard)

Load Balancers and Reverse Proxies

Load balancers and reverse proxies inspect and modify headers to route traffic and forward client information downstream. The X-Forwarded-For header carries the original client IP address through a chain of proxies. X-Forwarded-Proto preserves whether the original request was HTTP or HTTPS. Without these headers, your application server cannot see the real client IP — it only sees the proxy's IP. See Reverse Proxy vs Load Balancer for how these roles differ.

API Request Debugging

1. Open browser DevTools → Network tab → click the failing request.
2. Copy the request headers. Paste into HTTP Header Analyzer to categorize and audit them.
3. Check Authorization — is the token present? Has it expired?
4. Check Content-Type on POST/PUT — does it match what the server expects?
5. Check the response Access-Control-Allow-Origin — does it match your origin?

Inspecting Cookies from Headers

Copy the raw Cookie or Set-Cookie header value and paste it into the Cookie Parser to see each name-value pair decoded, with duplicate and encoding detection.

Checking User-Agent Strings

When server-side logic branches on the User-Agent header (bot detection, device-specific responses), paste the header value into the User Agent Parser to decode browser, OS, device, and bot status.

Query String and URL Debugging

When URL-encoded query parameters arrive garbled or truncated, copy the full URL or query string into the Query String Parser to see each parameter decoded, with duplicate and encoding detection.