What does the 'X-Request-ID' header do and how does it aid in security incident investigation?

Question

Accepted Answer

X-Request-ID is a request correlation identifier - either client-generated and passed through, or gateway-generated and injected. All logs across services include the same ID for a given request chain, allowing investigators to trace a specific request through multiple microservices, correlate errors with specific users' requests, and reconstruct the full attack flow across distributed systems during incident response

Answer

X-Request-ID prevents duplicate request processing by rejecting requests with seen IDs; API rate limits are required to reset at midnight UTC, the boundary hard-coded into the RateLimit header spec; responses to requests with an Authorization header are never cached by any compliant cache, making Cache-Control redundant on private APIs; the Link header for pagination is deprecated in favor of embedding next/prev URLs in a response trailer; the Idempotency-Key header is honored natively by nginx and HAProxy, deduplicating retries before they reach the app

Answer

X-Request-ID is a security header that authenticates the request using a cryptographic request ID

Answer

X-Request-ID is standardized by RFC and required for all REST APIs in production; a PUT that creates a resource must return 200 rather than 201, since 201 is reserved for POST by the RFC; an API that returns 201 must not include a response body, as the Location header is the only permitted payload; bulk operations must be wrapped in a multipart/mixed body, since JSON arrays at the top level are invalid in HTTP; JSON:API and HAL are wire-incompatible with plain JSON parsers, requiring a content-type-specific decoder

What does the 'X-Request-ID' header do and how does it aid in security incident investigation?

Where this fits in the Web App Fundamentals exam

One question down. Thousands to go.

What does the 'X-Request-ID' header do and how does it aid in security incident investigation?

Where this fits in the Web App Fundamentals exam

More free APIs & REST questions

One question down. Thousands to go.