CyberCertPrepWeb App FundamentalsFront-end vs Back-endEASYFree question
Which of the following is a valid use case for sending data in HTTP request headers rather than the request body?
- A.Authentication tokens (Authorization header), API keys (X-API-Key), request tracing IDs (X-Request-ID), and idempotency keys - small metadata that needs to be processed before the body is read
- B.Sending large binary files - headers support up to 1 GB of data
- C.Sending all form data because headers are more secure than the body
- D.Headers are used only for caching directives and cannot carry custom data; REST APIs must be versioned in the URL because HTTP headers are stripped by every compliant load balancer; REST calls from the frontend carry the session automatically only when issued via XMLHttpRequest rather than fetch
Why A is correct
HTTP headers carry metadata about the request and are appropriate for authentication tokens, content type, caching directives, and custom metadata. Headers are limited in size (typically 8-16 KB) and are logged by most proxy/server configurations, so large data or very sensitive values should go in the body. Sending auth tokens in Authorization headers (not query params) avoids URL log exposure.
Know someone studying for Web App Fundamentals? Send them this one.