The Post-it Notes on the Envelope
If the HTTP body is the letter inside the envelope, HTTP headers are the information written on the outside. They are key-value pairs sent in both requests and responses that provide metadata — information about the data being exchanged, rather than the data itself.
Headers follow a simple format: Header-Name: value. Multiple headers are sent one per line. Here are the most important categories:
Content Negotiation — Client and server agreeing on format
Accept: application/json, text/html;q=0.9
Content-Type: application/json
The client's Accept header says "I prefer JSON; I'll also accept HTML if you have nothing else." The q=0.9 is a quality factor (preference weight, from 0 to 1). The server's Content-Type header tells the client exactly what format the response body is in. Without Content-Type, the client would have to guess — and guessing wrong causes parsing errors.
Authentication
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
The client presents a credential — in this case, a Bearer token (typically a JWT). The server validates this token on every request. Because HTTP is stateless, the client must re-send this credential with every request that requires authentication.
Caching
Cache-Control: max-age=3600, public
ETag: "33a64df551425fcc55e4d42a148795d9f25f89d"
Cache-Control: max-age=3600 tells browsers and intermediate caches: "This response is valid for 3600 seconds (one hour). Don't fetch it again until then." The ETag is a fingerprint of the response content. On the next request, the client can send If-None-Match: "33a64df..." and the server will return a 304 Not Modified if the content hasn't changed — saving bandwidth by not re-sending the full body.
Connection Management
Connection: keep-alive
In early HTTP/1.0, a new TCP connection was opened for every single request — expensive. keep-alive tells the server to hold the connection open for reuse. HTTP/1.1 made this the default. HTTP/2 went further by multiplexing many requests over a single connection simultaneously.
Key Point: Headers are the control plane of HTTP. They govern authentication, caching, content format, security policy, and connection behavior. A misconfigured header — like a missing Content-Type or an overly permissive Cache-Control — can cause subtle bugs that are difficult to diagnose because the body looks correct.