Headerbaseret

Headerbaseret is a term used in information technology to describe systems, mechanisms, or design approaches that base decisions on HTTP request headers. The concept is language-agnostic and is commonly encountered in web services, API gateways, and reverse proxies.

In authentication and authorization, headerbaseret methods rely on headers such as Authorization, X-Api-Key, or custom headers to convey credentials and access tokens. Common patterns include bearer tokens (JWT) in the Authorization header and API keys sent in a header, which enables stateless request validation.

In routing and content handling, headerbaseret techniques can influence request flow or responses. Web servers and gateways may route to different backend services based on headers (for example Host or X-Requested-Service), or determine content negotiation using Accept, Accept-Language, or Vary headers to cache responses correctly.

Security and privacy considerations include using TLS to protect header data in transit, avoiding logging sensitive header values, validating and sanitizing headers to prevent injection, and applying rate limiting and header-size controls to mitigate abuse.

Compared with cookie-based or query-string-based approaches, headerbaseret methods are often stateless and scalable, but they require consistent header handling across services and careful attention to header exposure in logs and analytics.

The term is primarily used in Danish IT contexts and is not a formal standard; it describes a broad family of practices rather than a single protocol.