HTTP Request Headers

An HTTP request header is a key-value pair sent by the client with an HTTP request.

Example:

Content-Type: application/json

Here, Content-Type is the header name and application/json is its value.

Request headers provide additional information that helps the server understand how to process a request.

They can be used to:

• Specify the request data format.
• Specify the response format.
• Send authentication information.
• Identify client preferences.
• Provide other request metadata.

REST APIs commonly use HTTP headers to communicate additional information between the mobile application and the server.

React Native
      ↓
HTTP Request
      ↓
Request Headers
      ↓
PHP REST API

The server reads the relevant headers while processing the request.

A request header consists of a name and a value separated by a colon.

Content-Type: application/json

The header name is Content-Type and its value is application/json.

Many headers can be included in the same HTTP request.

Some commonly encountered HTTP request headers include:

• Content-Type
• Accept
• Authorization
• User-Agent
• Host
• Cache-Control

The exact headers used depend on the API and the type of request.

The Content-Type header tells the server what type of data is contained in the request body.

Content-Type: application/json

This is commonly used when React Native sends JSON data to a REST API.

application/json indicates that the request body contains JSON data.

Content-Type: application/json

For example, a POST request can send:

{
    "name": "Rahul",
    "email": "rahul@example.com"
}

The Accept header tells the server which response media types the client can understand.

Accept: application/json

A mobile application can use this header when it expects a JSON response from the API.

The Authorization header is commonly used to send authentication credentials or an access token.

Example:

Authorization: Bearer YOUR_TOKEN

The server can use the token to determine whether the request is authenticated.

A bearer token is commonly sent through the Authorization header.

Authorization: Bearer eyJhbGciOi...

The actual token is generated by the authentication system. The mobile application sends it when accessing protected API endpoints.

Request headers can be included in a GET request.

const response = await fetch(
    "https://example.com/api/students",
    {
        method: "GET",
        headers: {
            "Accept": "application/json"
        }
    }
);

Headers can provide information even when the GET request has no request body.

POST requests commonly use headers to describe the request body.

const response = await fetch(
    "https://example.com/api/students",
    {
        method: "POST",
        headers: {
            "Content-Type": "application/json",
            "Accept": "application/json"
        },
        body: JSON.stringify({
            name: "Rahul",
            email: "rahul@example.com"
        })
    }
);

PUT requests can use Content-Type and Authorization headers when sending protected JSON data.

const response = await fetch(
    "https://example.com/api/students/10",
    {
        method: "PUT",
        headers: {
            "Content-Type": "application/json",
            "Authorization": "Bearer YOUR_TOKEN"
        },
        body: JSON.stringify({
            name: "Rahul Kumar"
        })
    }
);

PATCH requests can also use headers when partially updating protected resources.

const response = await fetch(
    "https://example.com/api/students/10",
    {
        method: "PATCH",
        headers: {
            "Content-Type": "application/json",
            "Authorization": "Bearer YOUR_TOKEN"
        },
        body: JSON.stringify({
            email: "new@example.com"
        })
    }
);

A DELETE request can also contain headers, especially when the endpoint requires authentication.

const response = await fetch(
    "https://example.com/api/students/10",
    {
        method: "DELETE",
        headers: {
            "Authorization": "Bearer YOUR_TOKEN",
            "Accept": "application/json"
        }
    }
);

A request can contain multiple headers.

headers: {
    "Content-Type": "application/json",
    "Accept": "application/json",
    "Authorization": "Bearer YOUR_TOKEN"
}

Each header provides different information to the server.

PHP can access HTTP request information provided by the web server through server variables.

For example, the Content-Type value can be available through:

$_SERVER['CONTENT_TYPE']

The exact availability of headers can depend on the web server and PHP environment.

A PHP API can read the Authorization header using the appropriate server environment information.

$authorization =
    $_SERVER['HTTP_AUTHORIZATION'] ?? '';

The API can then process the authentication information according to its authentication system.

React Native
      ↓
HTTP Request
      ↓
Request Headers
      ↓
PHP REST API
      ↓
Read Headers
      ↓
Authenticate / Validate
      ↓
Process Request
      ↓
JSON Response

Headers can provide information needed before the API processes the request.

Axios allows request headers to be specified through the request configuration.

import axios from "axios";

const response = await axios.get(
    "https://example.com/api/students",
    {
        headers: {
            "Accept": "application/json"
        }
    }
);

console.log(response.data);

Axios can also send JSON data together with custom request headers.

const response = await axios.post(
    "https://example.com/api/students",
    {
        name: "Rahul",
        email: "rahul@example.com"
    },
    {
        headers: {
            "Content-Type": "application/json"
        }
    }
);

An authentication token can be included in Axios request headers.

const response = await axios.get(
    "https://example.com/api/profile",
    {
        headers: {
            "Authorization":
                "Bearer YOUR_TOKEN"
        }
    }
);

This is commonly used when accessing protected REST API endpoints.

Postman provides a Headers section where request headers can be added and tested.

For example:

This is useful when testing protected APIs.

Applications can sometimes use custom headers for application-specific metadata.

headers: {
    "X-App-Version": "1.0.0"
}

Custom headers should be used only when they are actually required by the API design.

Some request headers can affect how browsers handle cross-origin requests through CORS.

This becomes especially important when a web application communicates with an API on a different origin.

React Native applications do not use browser CORS in the same way as web browsers, but CORS is important when the same API is consumed from a web application.

User Login
    ↓
API Returns Token
    ↓
React Native Stores Token
    ↓
Request Headers
    ↓
Authorization: Bearer TOKEN
    ↓
Protected API
    ↓
JSON Response

This pattern will be used later when building authentication for the mobile application.

• Using the wrong header name.
• Using the wrong Content-Type.
• Forgetting Content-Type when sending JSON.
• Sending an invalid Authorization header.
• Forgetting the Bearer prefix when required by the API.
• Using an expired or invalid token.
• Sending unnecessary custom headers.
• Assuming every API requires the same headers.

const response = await fetch(
    "https://example.com/api/profile",
    {
        method: "GET",
        headers: {
            "Accept": "application/json",
            "Authorization": "Bearer YOUR_TOKEN"
        }
    }
);

const data = await response.json();

console.log(data);

In this example, the client tells the server that it expects JSON and sends an authentication token.

HTTP request headers provide additional information about an HTTP request. They are very important when building REST APIs for mobile applications.

React Native
      ↓
HTTP Request
      ↓
Headers
      ├── Content-Type
      ├── Accept
      └── Authorization
      ↓
PHP REST API
      ↓
Validate / Authenticate
      ↓
Process Request
      ↓
JSON Response

Understanding request headers is essential before working with authentication, JSON APIs, Axios, JWT, and protected REST API endpoints.