headers

Overview

HTTP headers are the key/value metadata carried on every request and response. They control caching, content handling, session state, and a growing set of security behaviors. This lesson focuses on headers that matter most, especially for security.

Learning objectives

• Explain the role of HTTP headers.
• Identify important request and response headers.
• Recognize key security headers and what they do.

Core concept

Headers convey information about the message, separate from its body. They fall into rough groups:

• Request headers — Host (target site), User-Agent (client), Cookie (state sent to server), Authorization (credentials), Accept (formats wanted).
• Response headers — Content-Type (how to interpret the body), Set-Cookie (state to store), Location (redirect target), Cache-Control (caching rules).
• Security headers — instruct the browser to behave more safely (below).

How it works

The browser and server read headers to decide how to handle the exchange: which site is requested, what content is returned, what to cache, and what cookies to store or send. Security headers are response headers that harden the client's behavior:

• Strict-Transport-Security (HSTS) — force HTTPS for future visits.
• Content-Security-Policy (CSP) — restrict what scripts/resources may load, mitigating XSS.
• X-Content-Type-Options: nosniff — stop content-type guessing.
• X-Frame-Options / frame-ancestors — prevent clickjacking via framing.
• Cookie attributes HttpOnly, Secure, SameSite — protect session cookies.

Practical example

A hardened response might include:

Content-Type: text/html; charset=utf-8
Strict-Transport-Security: max-age=63072000
Content-Security-Policy: default-src 'self'
X-Content-Type-Options: nosniff
Set-Cookie: session=...; HttpOnly; Secure; SameSite=Lax

Together these force HTTPS, restrict resource loading, block MIME sniffing, and protect the session cookie from script access and cross-site sending.

Cybersecurity relevance

Headers are one of the most common areas of web security assessment. Missing or weak security headers (no CSP, no HSTS, cookies without HttpOnly/Secure/SameSite) are frequent findings that increase exposure to XSS, session theft, downgrade, and clickjacking. Attackers also manipulate request headers (e.g. Host, Cookie, Authorization) to probe for flaws. Reading and setting headers correctly is central to both offense and defense.

Common mistakes

• Shipping without security headers, leaving easy, high-impact gaps.
• Setting cookies without HttpOnly/Secure/SameSite, weakening session protection.
• Trusting client-supplied headers (like Host or User-Agent) without validation.

Key takeaways

• Headers are metadata on requests and responses controlling content handling, state, caching, and security.
• Key security response headers include HSTS, CSP, X-Content-Type-Options, and framing protections; cookie flags HttpOnly/Secure/SameSite protect sessions.
• Missing or weak headers are common, high-impact findings, and request headers are frequent targets for manipulation.

Check your understanding

• What does the Content-Security-Policy header help mitigate, and what do the HttpOnly and Secure cookie flags protect against?
• Why should server code never blindly trust client-supplied headers like Host?