Pebellslearn by building
0%
RoadmapsMatrixCoursesSandboxSign in
HTTP in Depth  ›  Lesson

Headers and Cookies

HTTP Headers 12 minHeaders carry information about a message, such as its format, credentials and caching rules, and cookies are headers a browser stores and sends back automatically.

Headers and Cookies

The body of a BookNook response holds the book. Everything about the exchange lives elsewhere: who is asking, what format was sent, how long it may be cached, when to try again. That information travels in headers, and cookies are simply a pair of headers with a special job.

The rule

The body is the letter; headers are the envelope.

A header is one line: a case-insensitive name, a colon, a value. Useful groups:

  • Describing the body: Content-Type, Content-Length, Content-Encoding.
  • Negotiation: Accept, Accept-Language.
  • Identity: Authorization carries credentials, like Bearer eyJhbGci....
  • Caching: Cache-Control, ETag, If-None-Match.
  • Control: Location after a create, Retry-After after a 429 or 503.
  • Tracing: a request id such as X-Request-Id that you can search for in logs. The X- prefix is an old habit; new standard headers no longer use it.

Cookies let a server store a small value in a browser. The server sends Set-Cookie; from then on, the browser automatically attaches it to matching requests in a Cookie header:

HTTP/1.1 200 OK
Set-Cookie: session=a91f3c; Path=/; Secure; HttpOnly; SameSite=Lax; Max-Age=3600

GET /v1/members/me/loans HTTP/1.1
Cookie: session=a91f3c

The attributes are where the safety lives:

  • HttpOnly: page JavaScript cannot read the cookie, so a script injected into the page cannot steal it.
  • Secure: sent only over HTTPS.
  • SameSite: limits sending the cookie on requests started by other sites, which blunts cross-site request forgery.
  • Max-Age or Expires: when the browser should throw it away.

Cookies are a browser feature. A mobile app or a server calling BookNook usually sends an Authorization header instead.

The shortcut

For any piece of information, ask: is it the content, or about the content? Content → body. About the content, the caller or the delivery → header.

Where does each detail of "renew loan 901" go?Step 1 of 4

  1. The new due date requested

    That is the content of the change → body.

The trap is putting secrets such as tokens in the query string, where they end up in server logs and browser history. Credentials belong in a header.

Drills

Answer fast — trust the rule.

quick drill

Which header should carry an API access token?

quick drill

A cookie is set with HttpOnly. What does that prevent?

quick drill

After a server sends Set-Cookie: session=a91f3c, how does it get the value back?

quick drill

A developer puts ?token=abc123 in every URL. What is the main risk?

Remember

  • The body is the letter; headers are the envelope.
  • Shortcut: content → body; about the content, caller or delivery → header.
  • Trap: tokens in URLs, and session cookies without HttpOnly, Secure and SameSite.

Practice — level up

0/1 solved

Write your answer, then compare it with a rubric and a model answer.

ExplainEnvelope or letter?

A BookNook website stores its session in a cookie. List the cookie attributes you would set and what each protects against, and explain why a mobile app would send an Authorization header instead.