Headers, Content Negotiation & CORS

Headers vs. Body

Headers carry metadata (Content-Type, Authorization, Cache-Control) as key-value pairs; the body carries the actual payload (JSON, an uploaded file). GET requests typically have no body — that's why query parameters (?page=2&limit=20) carry GET's extra structured input instead.

Content-Type vs. Accept

Content-Type: application/json    # what format IS being sent
Accept: application/json           # what format the sender WANTS back
Authorization: Bearer <token>       # credentials, stateless auth

This directional distinction (describing outgoing vs. desired-incoming format) is a common early point of confusion — content negotiation is the server using Accept to decide which representation to return.

Caching

Cache-Control tells clients/CDNs how long a response can be reused before re-fetching. ETag is a version identifier — the client can ask "has this changed since I last fetched it?" without re-downloading the full content if it hasn't.

HTTP/1.1 vs. HTTP/2

HTTP/1.1 serializes requests on limited connections (head-of-line blocking); HTTP/2 multiplexes many requests/responses over a single connection concurrently — a significant real performance improvement for pages loading many resources.

CORS

Browsers enforce a same-origin policy by default, blocking cross-origin requests. Access-Control-Allow-Origin and related headers let a server explicitly permit specific other origins — protecting against a malicious site silently making authenticated requests on a victim's behalf.