Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.esperr.com/llms.txt

Use this file to discover all available pages before exploring further.

​
What are HTTP Headers?

Headers are key-value pairs sent with every HTTP request and response. They carry important metadata about the request, like authentication tokens, content types, and client information.
MDN Web DocsRead more on HTTP headers.

​
Common Headers You’ll Encounter

​
Authentication & Security

  • Authorization: Bearer tokens, API keys
  • Cookie: Session identifiers
  • X-API-Key: Custom API authentication
  • X-CSRF-Token: Cross-site request forgery protection

​
Content & Format

  • Content-Type: Format of request body (application/json, text/html)
  • Accept: What formats the client can handle
  • Content-Length: Size of the request body

​
Client Information

  • User-Agent: Browser or application identifier
  • Referer: Previous page URL
  • X-Forwarded-For: Original IP behind proxies
  • Host: Target domain

​
Custom Headers

  • X-Request-ID: Request tracking
  • X-Customer-ID: Business identifiers
  • X-Feature-Flag: Feature toggles

​
How Headers Work on the Web

Headers flow through every web interaction:
  1. Browser adds headers automatically (User-Agent, Accept, etc.)
  2. JavaScript adds headers for API calls (Authorization, Custom headers)
  3. Proxies add headers (X-Forwarded-For, X-Real-IP)
  4. Your app reads headers for authentication and routing

​
Using Headers in Policies

​
Basic Examples

Block requests missing authentication: 
Field Type: Header
Field Reference: Authorization
Operator: is not present
AND
Field Type: Request Path
Operator: starts with
Value: /api
Action: Block
Detect suspicious User-Agents: 
Field Type: Header
Field Reference: User-Agent
Operator: contains
Value: bot
Action: Challenge

​
Advanced Patterns

Rate limit by API key: 
Field Type: Header
Field Reference: X-API-Key
Operator: equals
Value: xyz123
Window: 1 minute
Threshold: 100
Action: Challenge
Verify content type for uploads: 
Field Type: Request Path
Operator: equals
Value: /upload
AND
Field Type: Header
Field Reference: Content-Type
Operator: not equals
Value: multipart/form-data
Action: Block
ExampleUnusual header combinations can identify requests that should be monitored or blocked by policy.

​
Header Operators

OperatorUse CaseExample
equalsExact matchAuthorization: Bearer abc123
containsPartial matchUser-Agent contains “Python”
starts withPrefix matchAuthorization starts with “Bearer”
is presentHeader existsX-Custom-Header is present
is not presentHeader missingAuthorization is not present

​
Security-Critical Headers

​
Headers to Monitor Closely

HeaderWhy It’s ImportantWhat to Look For
AuthorizationContains credentialsMissing, malformed tokens
X-Forwarded-ForReal client IPIP spoofing attempts
OriginRequest sourceCross-origin attacks
Content-TypeData formatUnexpected types for endpoints
HostTarget domainHost header injection

​
Headers That Reveal Attacks

# Detect command injection attempts
Field Type: Header
Field Reference: User-Agent
Operator: contains
Value: curl
OR
Value: wget
OR
Value: python
Action: Monitor

​
Best Practices

​
DO:

  • Validate authentication headers - Ensure they’re present and properly formatted
  • Check Content-Type - Match expected formats for each endpoint
  • Monitor custom headers - Track your application-specific headers
  • Look for header anomalies - Unusual combinations can reveal attacks
  • Use header presence checks - Sometimes missing headers are suspicious

​
DON’T:

  • Trust client headers blindly - They can be spoofed
  • Block common User-Agents carelessly - You might block legitimate users
  • Forget about case sensitivity - HTTP headers are case-insensitive
  • Expose sensitive data - Never put passwords or secrets in headers
  • Ignore header injection - Validate header values for malicious content

​
Common Attack Patterns

​
Header Injection

Field Type: Header
Field Reference: Host
Operator: contains
Value: evil.com
Action: Block

​
Authentication Bypass Attempts

Field Type: Header
Field Reference: X-Admin
Operator: is present
Action: Block # If your app doesn't use this header

​
Traffic Protection

Field Type: Header
Field Reference: User-Agent
Operator: matches regex
Value: (bot|crawl|spider|scrape)
Action: Challenge

​
Working with Multiple Headers

Sometimes you need to check multiple headers together: 
# Suspicious: Claims to be Chrome but wrong header combination
Field Type: Header
Field Reference: User-Agent
Operator: contains
Value: Chrome
AND
Field Type: Header
Field Reference: Accept-Language
Operator: is not present
Action: Challenge
Header FingerprintingLegitimate browsers send consistent header sets. Missing expected headers or unusual combinations often indicate bots or attack tools.

​
Custom Headers for Your Application

Many applications use custom headers: 
# Your app's feature flag header
Field Type: Header
Field Reference: X-Feature-Beta
Operator: equals
Value: enabled

# Tenant identification
Field Type: Header
Field Reference: X-Tenant-ID
Operator: is present

​
Troubleshooting

“My header policy isn’t matching”
  • Headers are case-insensitive but values might not be
  • Check for spaces and special characters
  • Verify the exact header name in browser DevTools
  • Some proxies modify headers
“I’m seeing unexpected header values”
  • Proxies and load balancers add headers
  • Browsers send different headers than mobile apps
  • Some security tools modify User-Agent