CyberCertPrepWeb App FundamentalsFront-end vs Back-endEASYFree question
Which of the following is a valid use case for sending data in HTTP request headers rather than the request body?
- A.Sending large binary files - headers support up to 1 GB of data
- B.Headers are used only for caching directives and cannot carry custom data
- C.Sending all form data because headers are more secure than the body
- D.Authentication tokens (Authorization header), API keys (X-API-Key), request tracing IDs (X-Request-ID), and idempotency keys - small metadata that needs to be processed before the body is read
Why D is correct
HTTP headers carry metadata about the request and are appropriate for authentication tokens, content type, caching directives, and custom metadata. Headers are limited in size (typically 8-16 KB) and are logged by most proxy/server configurations, so large data or very sensitive values should go in the body. Sending auth tokens in Authorization headers (not query params) avoids URL log exposure.
Know someone studying for Web App Fundamentals? Send them this one.