Stop 01 · Internet & Backend BasicsTopics · 12/15

Headers & Cookies

In short

Every request and response carries a small label section called headers, and cookies ride inside them. A surprising number of auth, caching and security bugs come down to one wrong header.

Headers carry metadata about a request/response (content type, auth tokens, caching rules); cookies are a specific header-based mechanism for the server to store small data on the client.

The mascot sticks a label on a courier box, with a visitor pass hanging from its hand.

Think of it like this

The courier label and the visitor pass

A parcel's label says who it's for, what's inside and 'fragile', all without opening the box. That's headers. A cookie is like the visitor pass the gate gives you on day one: you show it every time you walk in, without being asked.

Watch it happen

How a login cookie travels

Browser

API server

POST /login

1/5The browser sends email and password in the body, with the header Content-Type: application/json.

The big ideas

What you need to know

Request headers

Content-Type says the body's format, Authorization carries tokens, User-Agent names the client, Accept says what it wants back.

Response headers

Content-Type, Cache-Control and Set-Cookie tell the client how to read, cache and store what you sent.

Cookie flags matter

HttpOnly hides it from page JavaScript, Secure sends it only over HTTPS, SameSite limits cross-site sending, Max-Age sets expiry.

Names ignore case

Header names are case-insensitive. Node lowercases them, so read req.headers["user-agent"].

See it in code

Walk through the code

1import express from "express";2import cookieParser from "cookie-parser";3const app = express();4app.use(cookieParser());5 6app.post("/login", (req, res) => {7  res.cookie("sid", "abc123", {8    httpOnly: true, secure: true, sameSite: "lax", maxAge: 7 * 24 * 60 * 60 * 1000,9  });10  res.sendStatus(204);11});12 13app.get("/me", (req, res) => {14  console.log(req.headers["user-agent"], req.cookies.sid);15  res.json({ sid: req.cookies.sid ?? null });16});

1/3cookie-parser reads the Cookie header and fills req.cookies for you.

Express's maxAge is in milliseconds, here 7 days. A real app stores a long random session ID, never abc123. Most browsers allow Secure cookies on localhost for testing.

Save yourself the pain

Common mistakes

Oops

Storing a login token in a cookie without HttpOnly.

Do this instead

Set HttpOnly so page JavaScript can't read it. That limits the damage if an XSS bug sneaks in.

Oops

Testing with curl and forgetting the Content-Type header.

Do this instead

Without -H "Content-Type: application/json", express.json() skips the body and req.body is empty.

Your mission

Watch a cookie live

~20 min

Quick check

Why set HttpOnly on a session cookie?

Go deeper

1Inspect real request/response headers using your browser's DevTools Network tab.
2Set a cookie from a Node.js server and read it back on the next request.
3Learn the security-relevant cookie flags: HttpOnly, Secure, SameSite.