HTTP header

As explained in Spring Security in Action, Second Edition

An HTTP header is a field in an HTTP request or response that conveys metadata or control information.

An HTTP header carries metadata or control information between a client and server. CORS uses response headers to control which cross-origin requests a browser may accept. section 10.1

CORS commonly uses these headers:

• Access-Control-Allow-Origin specifies which foreign origins may access resources. section 10.1
• Access-Control-Allow-Methods limits permitted HTTP methods, such as GET. section 10.1
• Access-Control-Allow-Headers limits which headers a request may contain. section 10.1

Diagnosing a blocked cross-origin request

A page served from http://localhost:8080 sends a POST request to http://127.0.0.1:8080/test. The server can process the request, but the browser rejects the response when it lacks Access-Control-Allow-Origin. Spring Security adds none of these CORS headers by default. section 10.1

Figure 10.4 For simple requests, the browser sends the original request directly to the server. The browser rejects the response if the server doesn’t allow the origin. In some cases, the browser sends a preflight request to test whether the server accepts the origin. If the preflight request succeeds, the browser sends the original request.

Trace the browser’s handling of simple and preflighted requests, including when it sends the original request and when it checks permission first. section 10.1

How Spring Security in Action, Second Edition covers it

How deep it goes

Defines three important CORS headers and demonstrates browser rejection, while deferring detailed header syntax and configuration.

Examples

Uses XMLHttpRequest, localhost and 127.0.0.1 origins, a POST endpoint, and a missing-header browser error.

What it assumes

Assumes basic HTTP requests and responses while explaining cross-origin restrictions from the beginning.

What you can do after

Diagnose browser CORS failures by checking whether the response includes an appropriate Access-Control-Allow-Origin header.

How it connects

Connects HTTP headers with CORS, HTTP methods, origins, browsers, and preflight requests.

liveBookmanning.com

Read Spring Security in Action, Second Edition on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  Kafka for ArchitectsA message header is auxiliary metadata attached to a Kafka record independently of its key and value.
• 

  liveBookmanning.com
  The Design of Web APIs, Second EditionA response header is a metadata field returned in an HTTP response that conveys protocol, representation, or application information.
• 

  liveBookmanning.com
  Spring in Action, Sixth EditionA response header is an HTTP field carrying metadata from a server response separately from its payload body.

Compare how 4 books explain HTTP header →

Related concepts

• HTTP responsepart of · An HTTP response is a protocol message sent by a server to a client after an HTTP request, containing status information, headers, and optionally a body.
• CORSused by · Cross-Origin Resource Sharing (CORS) is a web standard that uses HTTP headers to let servers specify which origins may access their resources through browsers.
• Accept-Languageincludes · Accept-Language is an HTTP request header that communicates the natural languages or language variants preferred or accepted by a client.
• Accept headerincludes · An Accept header is an HTTP request header that specifies the media types a client can process in the response, optionally indicating preferences.
• cachingused by · Caching is the practice of storing reusable data or computation results so later access can avoid repeating retrieval or computation.

This explainer was generated by Manning's knowledge graph from the text of Spring Security in Action, Second Edition. The section links point to the parts of the book it draws on.