Request headers in Postman - Deep Dive

Overview - Request headers

What is it?

Request headers are pieces of information sent from a client to a server as part of an HTTP request. They tell the server details about the request, like what type of data the client can accept or what language it prefers. These headers help the server understand how to respond properly. Without them, communication between client and server would be unclear and less efficient.

Why it matters

Request headers exist to make web communication clear and efficient. Without them, servers wouldn't know how to format responses or handle requests correctly, leading to errors or slow loading. For example, without headers, a server might send data in a format the client can't read, causing frustration and broken websites or APIs.

Where it fits

Before learning request headers, you should understand basic HTTP requests and responses. After mastering headers, you can explore advanced API testing, authentication methods, and performance optimization in tools like Postman.

Mental Model

Core Idea

Request headers are like labels on a package that tell the receiver how to handle the contents inside.

Think of it like...

Imagine sending a letter with a label that says 'Fragile' or 'Handle with care.' This label guides the postal worker on how to treat your letter. Similarly, request headers guide the server on how to process your request.

┌─────────────────────┐
│ HTTP Request        │
│ ┌───────────────┐   │
│ │ Request Line  │   │
│ ├───────────────┤   │
│ │ Headers       │───┼──▶ Server uses headers to decide
│ └───────────────┘   │    how to respond
│ │ Body (optional)│   │
└─────────────────────┘

Build-Up - 6 Steps

1

Foundation

What are HTTP request headers

Concept: Introduce the basic idea of request headers as key-value pairs sent with HTTP requests.

When your browser or tool like Postman sends a request to a server, it includes extra information called headers. These headers are pairs like 'Content-Type: application/json' that tell the server what kind of data you are sending or expecting. They are part of the request but separate from the main data (body).

Result

You understand that headers are extra details sent with every HTTP request to help the server understand the request better.

Knowing that headers are separate from the main data helps you see how requests carry both content and instructions.

2

Foundation

Common types of request headers

Concept: Learn the most frequently used headers and their purposes.

Some common headers include: - Content-Type: tells the server the format of the data sent (like JSON or XML). - Accept: tells the server what response formats the client can handle. - Authorization: carries credentials for access control. - User-Agent: identifies the client software. These headers shape how the server processes and responds to requests.

Result

You can recognize and explain common headers and why they matter in requests.

Understanding common headers lets you control and customize requests effectively during testing.

3

Intermediate

Setting headers in Postman

🤔Before reading on: Do you think headers in Postman are set automatically, manually, or both? Commit to your answer.

Concept: Learn how to add, edit, and manage request headers in Postman.

In Postman, you can set headers manually by going to the 'Headers' tab and adding key-value pairs. Some headers like 'Content-Type' may be added automatically when you set the body type, but you can override or add new ones. This control helps you test how servers react to different headers.

Result

You know how to customize request headers in Postman to test various scenarios.

Knowing how to manipulate headers in Postman empowers you to simulate real-world requests and catch server issues.

4

Intermediate

Headers impact on server response

🤔Before reading on: Do you think changing request headers can change the server's response? Commit to yes or no.

Concept: Explore how different headers affect what the server sends back.

Headers like 'Accept' tell the server what format you want the response in. For example, if you set 'Accept: application/json', the server tries to send JSON. If you omit or change headers, the server might send HTML or XML instead. Authorization headers control access, so missing or wrong headers can cause errors.

Result

You see that headers directly influence server behavior and response content.

Understanding this helps you test APIs more thoroughly by varying headers to check server flexibility and security.

5

Advanced

Headers and authentication methods

🤔Before reading on: Do you think all authentication uses the same header format? Commit to yes or no.

Concept: Learn how headers carry different authentication tokens or credentials.

Many authentication methods use headers, especially the 'Authorization' header. For example: - Basic Auth sends a base64 encoded username and password. - Bearer tokens send a token string. - API keys might be sent in custom headers. Knowing how to set these correctly is crucial for secure API testing.

Result

You understand how to use headers for different authentication schemes in testing.

Knowing the variety of authentication headers prevents common access errors and security issues during testing.

6

Expert

Hidden headers and proxy effects

🤔Before reading on: Do you think all headers you set in Postman always reach the server unchanged? Commit to yes or no.

Concept: Discover how some headers can be added, removed, or modified by proxies, browsers, or servers.

Sometimes, intermediaries like proxies or browsers add or strip headers for security or routing. For example, 'User-Agent' or 'Referer' headers might be changed. Also, some headers are restricted and cannot be set manually in certain environments. Understanding this helps debug why a server sees different headers than you sent.

Result

You realize that headers seen by the server may differ from those you set, affecting testing accuracy.

Knowing about hidden or altered headers helps you troubleshoot mysterious bugs and understand real-world network behavior.

Under the Hood

When a client sends an HTTP request, the headers are sent as plain text lines before the body. Each header is a key-value pair separated by a colon and a space. The server reads these lines to understand the request context before processing the body. Headers are part of the HTTP protocol specification and are parsed by the server's HTTP engine to decide routing, authentication, content negotiation, and more.

Why designed this way?

Headers were designed to separate metadata from the main content, making HTTP flexible and extensible. This design allows new headers to be added without changing the core protocol. It also enables intermediaries like proxies and caches to read or modify headers without touching the body, improving performance and security.

Client Request ──────────────▶ Server
┌─────────────────────────────┐
│ Request Line (GET /path HTTP/1.1) │
│ Header1: value1              │
│ Header2: value2              │
│ ...                         │
│                             │
│ [Optional Body]             │
└─────────────────────────────┘
Server reads headers first to decide how to handle the request body and response.

Myth Busters - 4 Common Misconceptions

Quick: Do you think the 'Content-Type' header tells the server what format you want in response? Commit to yes or no.

Common Belief: Many believe 'Content-Type' controls the response format from the server.

Reality: 'Content-Type' actually tells the server the format of the data you are sending, not what you want back. The 'Accept' header controls the desired response format.

Why it matters: Confusing these headers can cause tests to fail or servers to send unexpected data formats, leading to wasted debugging time.

Quick: Do you think all headers you add in Postman are always sent exactly as you typed? Commit to yes or no.

Common Belief: People often think headers set in Postman reach the server unchanged.

Reality: Some headers are automatically added, modified, or removed by Postman, browsers, or network proxies for security or protocol reasons.

Why it matters: Assuming headers are unchanged can cause confusion when the server behaves differently than expected during testing.

Quick: Do you think missing a header always causes the server to reject the request? Commit to yes or no.

Common Belief: Many believe that if a header is missing, the server will always return an error.

Reality: Some headers are optional, and servers have default behaviors when headers are missing. Others are mandatory and cause errors if absent.

Why it matters: Not knowing which headers are required can lead to incorrect test assumptions and missed bugs.

Quick: Do you think the 'Authorization' header is always sent in the same format? Commit to yes or no.

Common Belief: People often think 'Authorization' header format is standard and unchanging.

Reality: The 'Authorization' header format varies widely depending on the authentication scheme (Basic, Bearer, Digest, etc.).

Why it matters: Using the wrong format causes authentication failures and security risks during testing.

Expert Zone

1

Some headers like 'Host' and 'Content-Length' are managed by HTTP clients and should rarely be set manually to avoid protocol errors.

2

Headers can be case-insensitive, but some servers treat them case-sensitively, causing subtle bugs.

3

Custom headers often start with 'X-' but this is deprecated; modern practice is to use meaningful names without 'X-'.

When NOT to use

Request headers are not a solution for sending large amounts of data; use the request body instead. Also, sensitive data should not be sent in headers unless encrypted, as headers can be logged or exposed. For authentication, consider using secure tokens or OAuth flows rather than basic headers.

Production Patterns

In production, headers are used for content negotiation, caching control, security policies (like CORS), and authentication. Automated tests often manipulate headers to simulate different clients or user roles. Monitoring headers helps detect attacks or misconfigurations.

Connections

HTTP Response Headers

Complementary concept

Understanding request headers helps you predict and interpret response headers, completing the client-server communication picture.

Network Protocols

Builds-on

Request headers are part of the HTTP protocol, which itself runs over TCP/IP. Knowing this helps understand how data travels and where headers fit in the network stack.

Human Communication

Analogous pattern

Request headers are like the tone and context in human conversations, guiding how messages are understood and responded to.

Common Pitfalls

#1 Sending incorrect Content-Type header for JSON data

Wrong approach:

Content-Type: text/plain
{
"name": "Alice"
}

Correct approach:

Content-Type: application/json
{
"name": "Alice"
}

Root cause:

Not matching the Content-Type header to the actual data format causes the server to misinterpret the data.

#2 Forgetting to include Authorization header for protected endpoints

Wrong approach:

GET /api/data HTTP/1.1
Host: example.com

Correct approach:

GET /api/data HTTP/1.1
Host: example.com
Authorization: Bearer abc123token

Root cause:

Missing authentication headers leads to access denied errors.

#3 Manually setting Content-Length header incorrectly

Wrong approach:

Content-Length: 10
{"key":"value"}

Correct approach:

Content-Length header omitted or correctly calculated by client
{"key":"value"}

Root cause:

Incorrect Content-Length causes the server to wait for more data or truncate the request.

Key Takeaways

Request headers are key-value pairs sent with HTTP requests that provide important context to the server.

Common headers like Content-Type and Accept control data formats sent and received, shaping server behavior.

In Postman, you can set headers manually or rely on automatic headers, but understanding them helps customize tests.

Headers affect authentication, content negotiation, and security, making them critical for thorough API testing.

Some headers can be changed by intermediaries, so always verify what the server actually receives during testing.