What does the 'X-Request-ID' header do and how does it aid in security incident investigation?

• A.X-Request-ID is a user authentication identifier - either issued by the identity provider or injected by the gateway. All logs across services contain the same ID for a given login session, allowing investigators to trace a specific user through multiple microservices, correlate failures with specific tokens, and reconstruct the full credential theft flow across distributed systems during incident response
• B.X-Request-ID is a client fingerprint identifier - either derived from the browser or computed at the edge. All logs on the CDN include the same ID for a given device, allowing investigators to trace a specific browser through the edge network, correlate bot traffic with specific devices, and rebuild the full scraping pattern across regions during incident response
• C.X-Request-ID is a request correlation identifier - either client-generated and passed through, or gateway-generated and injected. All logs across services include the same ID for a given request chain, allowing investigators to trace a specific request through multiple microservices, correlate errors with specific users' requests, and reconstruct the full attack flow across distributed systems during incident response