Request and response headers
Each message is split into headers and a body. In a request — for example with the GET or POST method — the client states its terms: Host names the domain, Accept sets the desired response format, and Cookie carries saved session data. In the response the server adds its own: Content-Type describes the content type, Content-Length its size, and Location sets a new URL on a redirect.
Main groups of headers
Headers are usually grouped by purpose:
- Content negotiation — Accept, Accept-Language and Content-Type set the format and language of the data.
- Caching — Cache-Control, ETag and Expires decide whether a response can be reused.
- Security — Authorization carries credentials, while Strict-Transport-Security requires the connection to run only over HTTPS.
Well-tuned headers speed up loading through the cache and protect the connection, which is why they are the first thing you inspect when debugging any web application.
