Headers, cookies and HTTPS

Headers carry the metadata

The body of a request or response is the content; headers say everything about it — its format, its size, who's asking, how long it can be cached. You've already met a few. Here are the families you'll use constantly.

Content negotiation

A server that can't read the body's format answers 415 Unsupported Media Type; one that can't produce an acceptable format answers 406 Not Acceptable.

Cookies: memory for a stateless protocol

HTTP is stateless — each request stands alone. Cookies let a site recognize you across requests:

HTTP/1.1 200 OK
Set-Cookie: session=7f3a9c…; Path=/; Secure; HttpOnly; SameSite=Lax; Max-Age=86400

From then on, the browser automatically sends it back to the same site:

GET /account HTTP/1.1
Cookie: session=7f3a9c…

The server looks up 7f3a9c… and knows who you are. Cookie attributes matter for security:

You'll compare cookie-based sessions with tokens in Authentication later in this track.

Caching headers

Responses can be reused by browsers, CDNs and proxies — if the server says so:

Cache-Control: public, max-age=3600      ← anyone may cache it for an hour
Cache-Control: private, max-age=60       ← only the user's browser, for a minute
Cache-Control: no-store                  ← never cache (account pages, sensitive data)
ETag: "v42"                              ← a version identifier for the content

When a cached copy goes stale, the browser can revalidate cheaply:

GET /products/42
If-None-Match: "v42"
 
HTTP/1.1 304 Not Modified                 ← "your copy is still good", no body sent

HTTPS and TLS

Plain HTTP travels as readable text: anyone on the same Wi-Fi, or any router in between, could read passwords and cookies or even modify pages. HTTPS is HTTP inside a TLS connection, which provides:

• Confidentiality — traffic is encrypted.
• Integrity — tampering is detected.
• Authentication — the server proves it really is shop.example with a certificate signed by a trusted certificate authority (CA). Your browser and OS ship with a list of trusted CAs.

During the TLS handshake the server presents its certificate, the client verifies the signature chain and the domain name, and both sides derive shared encryption keys. Free, automated certificates (Let's Encrypt) mean every site can — and should — use HTTPS.

Strict-Transport-Security: max-age=31536000; includeSubDomains

This HSTS header tells browsers to only use HTTPS for the site from now on. ASP.NET Core adds it with app.UseHsts() and redirects HTTP to HTTPS with app.UseHttpsRedirection().

Key takeaways

• Content-Type describes the body; Accept asks for a format.
• Cookies (Set-Cookie → Cookie) give stateless HTTP a memory; use Secure, HttpOnly, SameSite.
• Cache-Control and ETag let clients and CDNs reuse responses safely.
• HTTPS encrypts and authenticates traffic using TLS certificates; HSTS enforces it.