HTTP: The Definitive Guide

HTTP Headers

Table 11-1shows the seven HTTP request headers that most commonly carry information about the user. We’ll discuss the first three now; the last four headers are used for more advanced identification techniques that we’ll discuss later.

Table 11-1. HTTP headers carry clues about users

Header name	Header type	Description
From	Request	User’s email address
User-Agent	Request	User’s browser software
Referer	Request	Page user came from by following link
Authorization	Request	Username and password (discussed later)
Client-ip	Extension (Request)	Client’s IP address (discussed later)
X-Forwarded-For	Extension (Request)	Client’s IP address (discussed later)
Cookie	Extension (Request)	Server-generated ID label (discussed later)

The From header contains the user’s email address. Ideally, this would be a viable source of user identification, because each user would have a different email address. However, few browsers send From headers, due to worries of unscrupulous servers collecting email addresses and using them for junk mail distribution. In practice, From headers are sent by automated robots or spiders so that if something goes astray, a webmaster has someplace to send angry email complaints.

The User-Agent header tells the server information about the browser the user is using, including the name and version of the program, and often information about the operating system. This sometimes is useful for customizing content to interoperate well with ...