HTTP Headers

On this page 20

Part III — Networking & protocols · Interview reference

Headers carry caching policy, auth credentials, content negotiation, tracing, and security directives. Seniors should know which headers are hop-by-hop vs end-to-end, how caches interpret them, and security-sensitive cases.

Mental model

Request headers  →  who am I, what I accept, conditional validators, routing hints
Response headers →  what I returned, how to cache, security policy, correlation

HTTP/1.1 headers are case-insensitive names; values are often comma-lists. HTTP/2/3 use lowercase header names on the wire (HPACK/QPACK).

Categories that matter in interviews

1) Content & negotiation

Header	Role
`Content-Type`	Representation media type (body)
`Accept`	Client preferred response types
`Accept-Encoding`	gzip, br, …
`Accept-Language`	i18n
`Content-Encoding`	Actual encoding applied
`Content-Length` / chunked `Transfer-Encoding`	Framing (HTTP/1.1)

Pitfall: sending JSON with wrong Content-Type; security filters and clients behave differently.

2) Caching (high value)

Header	Role
`Cache-Control`	`max-age`, `no-store`, `private`, `public`, `must-revalidate`
`ETag` / `If-None-Match`	Conditional GET → 304
`Last-Modified` / `If-Modified-Since`	Validator (weaker than ETag in many cases)
`Vary`	Cache key includes listed request headers (e.g. `Accept-Encoding`, `Authorization` care!)
`Expires`	Legacy; superseded by `Cache-Control`
`Age`	Heuristic age from shared caches

Senior probe: Why Vary: Authorization can destroy cache hit rates; why Cache-Control: private for user-specific data.

Production case study (high volume)

Context: Global e-commerce CDN (CloudFront/Fastly) in front of product pages and a personalized “recommended for you” API (~hundreds of M hits/day at edge). Why seniors care: Caching personalized responses as public leaks PII across users; wrong Vary destroys hit ratio → origin melt; seniors treat cache headers as correctness + cost. Failure / symptom: User A sees User B’s recommendations; or origin QPS 10× after a header change; CDN hit ratio cliff. Resolution: Cache-Control: private / no-store for auth responses; surrogate keys / soft purge; separate anonymous vs personalized URLs; canary watch hit ratio + error rate. Seen at / similar to: Shopify/Fastly storefront caching; Netflix Open Connect vs origin; Cloudflare cache rules incidents.

3) Authentication & cookies

Header	Role
`Authorization`	`Bearer`, `Basic`, …
`Cookie` / `Set-Cookie`	Session; flags: `HttpOnly`, `Secure`, `SameSite`
`WWW-Authenticate`	Challenge

Pitfalls: logging Authorization; CSRF with cookies (SameSite + tokens); putting tokens in query strings.

Production case study (high volume)

Context: Retail web + mobile sharing a session cookie API; cookie jar grew to 8KB+ with tracking cruft on every /api/* call. Why seniors care: Huge Cookie headers tax bandwidth and p99 at millions RPS; missing Secure/HttpOnly/SameSite is an account-takeover class bug. Failure / symptom: Elevated egress cost; gateway header-size 431s; security findings on cookie flags. Resolution: Scope cookies by path; move tokens to Authorization for APIs; strip unused cookies at edge; enforce flags in integration tests. Seen at / similar to: Large e-commerce/media sites; Google/Apple cookie partitioning industry pressure; Stripe Elements vs raw card cookie mistakes (anti-pattern).

4) Security response headers

Header	Intent
`Strict-Transport-Security`	HSTS
`Content-Security-Policy`	Mitigate XSS/injection of script
`X-Content-Type-Options: nosniff`	Reduce MIME sniffing
`X-Frame-Options` / `frame-ancestors`	Clickjacking
`Referrer-Policy`	Leakage control
`Permissions-Policy`	Feature gating

5) CORS (browser-only model)

Header	Role
`Origin`	Browser-supplied
`Access-Control-Allow-Origin`	Who may read response
`Access-Control-Allow-Credentials`	Cookies/auth
Preflight	`OPTIONS` + `Access-Control-Request-*`

Interview clarity: CORS is enforced by browsers, not a server authZ mechanism for non-browser clients.

6) Proxy / forwarding

Header	Role
`Host`	Target host (virtual hosting)
`X-Forwarded-For` / `Forwarded`	Client IP chain — spoofable unless trusted proxy strips/overwrites
`X-Forwarded-Proto`	Original https
`Via`	Intermediaries

Senior rule: only trust forwarding headers from known LB/gateway hops.

Production case study (high volume)

Context: Fintech rate limiter and fraud IP allowlists trusted client-supplied X-Forwarded-For through an misconfigured NGINX. Why seniors care: Spoofed XFF bypasses geo/fraud controls at scale; incorrect proto breaks secure cookies/redirects. Failure / symptom: Fraud spike from “trusted” IPs; HTTPS redirect loops; audit shows attacker-controlled XFF. Resolution: Overwrite XFF at trusted edge only; use Forwarded carefully; derive client IP from connection peer at LB; golden tests for hop counts. Seen at / similar to: AWS ALB X-Forwarded-For append behavior; Cloudflare connecting IP; many PCI DSS findings.

7) Observability

Header	Role
`Traceparent` / `Tracestate` (W3C)	Distributed tracing
`X-Request-ID`	Correlation (legacy/custom)
`User-Agent`	Client identity (rough)

Hop-by-hop vs end-to-end

Hop-by-hop headers (e.g. Connection, Keep-Alive, Transfer-Encoding, TE, Trailer, Upgrade) must not be forwarded blindly by proxies. Mis-proxying causes subtle bugs.

Production case study (high volume)

Context: API gateway blindly forwarded hop-by-hop headers; HTTP request smuggling / desync class bugs under crafted Transfer-Encoding + Content-Length pairs. Why seniors care: Smuggling at the edge is a fleet-wide vulnerability; seniors know hop-by-hop rules, not just “set CSP.” Failure / symptom: Weird cache poisoning / auth bypass reports; WAF bypass; intermittent 400s. Resolution: Normalize at single trusted hop (Envoy/ALB); drop hop-by-hop; HTTP/2 where possible; pen-test desync cases. Seen at / similar to: Cloudflare/Amazon/Google desync research (HTTP desync attacks); Netflix Zuul v1 lessons → Envoy.

Conditional requests & concurrency

ETag + If-Match for optimistic concurrency on updates
If-None-Match: * semantics for create-if-not-exists patterns

Useful in API design discussions.

Production case study (high volume)

Context: Inventory/price update API for marketplace sellers (~millions of updates/day) using If-Match ETags. Why seniors care: Lost updates without validators; naïve Last-Modified second granularity collides under burst writes. Failure / symptom: Silent overwrites of seller price; support tickets; 412 rates ignored. Resolution: Strong ETags; treat 412 as expected concurrency; idempotency keys for creates; metrics on 304/412. Seen at / similar to: Shopify Admin API; AWS S3 ETag/conditional writes; Google Drive API concurrency.

Java under the hood

Stack	Header handling
`java.net.http.HttpHeaders`	Case-insensitive multi-map; first/all values APIs
`HttpRequest.Builder` / `HttpResponse`	Set/read headers; hop-by-hop headers are not blindly forwarded by the JDK client
Servlet / Jakarta	`HttpServletRequest.getHeader` / `getHeaders` (case-insensitive per servlet spec)
Cookies	`HttpCookie` / servlet `Cookie`; flags (`HttpOnly`, `Secure`, `SameSite`) set on `Set-Cookie`
Frameworks	Spring `HttpHeaders`, WebClient — same semantics, richer utilities

Never log Authorization / Cookie. Treat X-Forwarded-* as untrusted unless overwritten by a known proxy hop.

What interviewers probe

Design caching for a public asset vs authenticated API response.
Explain 304 flow with ETag.
CORS misconception: “CORS blocks curl” — no.
Security headers you’d set on a web app; what each mitigates.
Why X-Forwarded-For is dangerous if trusted naively (IP allowlists).
Cookie flags for session tokens vs placing JWT in localStorage tradeoffs.
Idempotency keys (custom header) for payment APIs.
CDN personalization leak vs origin overload from bad Vary/Cache-Control.

Senior-level expectation: Correct cache semantics; trust boundaries on forwarded headers; security header intent without cargo-cult lists.

Pitfalls

Caching personalized responses at CDN (public + missing Vary)
Huge Cookie headers on every API call
Case-sensitive header handling in naive code (depends on stack)
Logging sensitive headers
Relying on Referer for security decisions
Duplicate Content-Length / framing mismatches → smuggling risks with bad proxies
Trusting raw X-Forwarded-For for fraud/rate limits

Cross-references

SSL, TLS, HTTPS
TCP/IP stack
Load balancing vs API gateway
Spec-driven development — API contracts include headers