HTTP Headers: Working with Request and Response Headers

Request Headers

Request headers are sent by the client with every request to provide metadata.

PHP: Reading Request Headers

<?php
// Method 1: $_SERVER superglobal
$accept = $_SERVER['HTTP_ACCEPT'];
$userAgent = $_SERVER['HTTP_USER_AGENT'];
$authorization = $_SERVER['HTTP_AUTHORIZATION'] ?? null;

// Method 2: getallheaders() function
$headers = getallheaders();
$contentType = $headers['Content-Type'] ?? null;
$accept = $headers['Accept'] ?? null;

// Method 3: Get specific header with custom name
function getHeader(string $name): ?string
{
    $headers = getallheaders();
    
    // Headers can be different cases
    foreach ($headers as $key => $value) {
        if (strtolower($key) === strtolower($name)) {
            return $value;
        }
    }
    return null;
}

// Parse Accept header to check supported formats
$accept = $_SERVER['HTTP_ACCEPT'] ?? '';
$wantsJson = strpos($accept, 'application/json') !== false;
$wantsHtml = strpos($accept, 'text/html') !== false;

if ($wantsJson) {
    header('Content-Type: application/json');
    echo json_encode($data);
} elseif ($wantsHtml) {
    header('Content-Type: text/html');
    echo renderTemplate($data);
}

Authorization Header Patterns

<?php
// Bearer token authentication (Magento REST API style)
$authHeader = $_SERVER['HTTP_AUTHORIZATION'] ?? '';

if (preg_match('/^Bearer\s+(.+)$/i', $authHeader, $matches)) {
    $token = $matches[1];
    $user = validateBearerToken($token);
    
    if (!$user) {
        http_response_code(401);
        echo json_encode(['error' => 'Invalid token']);
        exit;
    }
} else {
    http_response_code(401);
    header('WWW-Authenticate: Bearer realm="api"');
    echo json_encode(['error' => 'Authorization header required']);
    exit;
}

// Basic authentication (admin panel style)
$authHeader = $_SERVER['HTTP_AUTHORIZATION'] ?? '';

if (preg_match('/^Basic\s+(.+)$/i', $authHeader, $matches)) {
    $decoded = base64_decode($matches[1]);
    [$username, $password] = explode(':', $decoded, 2);
    
    $user = authenticateUser($username, $password);
    if (!$user) {
        http_response_code(401);
        header('WWW-Authenticate: Basic realm="Admin"');
        exit;
    }
}

Response Headers

Response headers are sent by the server to control how the client processes the response.

PHP: Setting Response Headers

<?php
// Basic header setting
header('Content-Type: application/json; charset=UTF-8');
header('X-Custom-Header: SomeValue');

// Remove a header
header_remove('X-Powered-By');

// Set status code with headers
header('HTTP/1.1 200 OK');
http_response_code(200); // Alternative

// Content-Type for different formats
header('Content-Type: text/html; charset=UTF-8');
header('Content-Type: application/json; charset=UTF-8');
header('Content-Type: text/xml; charset=UTF-8');
header('Content-Type: image/png');

// Send file download
header('Content-Type: application/octet-stream');
header('Content-Disposition: attachment; filename="export.csv"');
header('Content-Length: ' . filesize($filePath));
readfile($filePath);

Caching Headers

<?php
// No caching - dynamic content
header('Cache-Control: no-cache, no-store, must-revalidate');
header('Pragma: no-cache');
header('Expires: 0');

// Cache for 1 hour
header('Cache-Control: public, max-age=3600');
header('Last-Modified: ' . date('r', $lastModified));

// Cache for 1 week
header('Cache-Control: public, max-age=604800');
header('ETag: "' . md5_file($filePath) . '"');

// Private cache (user-specific, like cart page)
header('Cache-Control: private, max-age=300');

// Validation with ETag
$etag = md5_file($filePath);
header('ETag: "' . $etag . '"');

if (isset($_SERVER['HTTP_IF_NONE_MATCH']) && $_SERVER['HTTP_IF_NONE_MATCH'] === '"' . $etag . '"') {
    http_response_code(304);
    exit;
}

Security Headers

<?php
// Security headers - should be on every response
header('X-Content-Type-Options: nosniff');     // Prevent MIME type sniffing
header('X-Frame-Options: SAMEORIGIN');         // Prevent clickjacking
header('X-XSS-Protection: 1; mode=block');     // Enable XSS filter
header('Referrer-Policy: strict-origin-when-cross-origin');
header('Content-Security-Policy: default-src \'self\'; script-src \'self\' \'unsafe-inline\'');
header('Strict-Transport-Security: max-age=31536000; includeSubDomains'); // HSTS

// Remove server identification headers
header_remove('X-Powered-By');
header_remove('Server');

Magento Security Headers

Magento applies these headers through Magento\Framework\Response\HeaderManager:

• X-Content-Type-Options: nosniff
• X-Frame-Options: SAMEORIGIN
• X-XSS-Protection: 1; mode=block
• X-Download-Options: noopen
• X-Permitted-Cross-Domain-Policies: none

Understanding CORS

CORS (Cross-Origin Resource Sharing) controls how resources can be requested from a different domain.

Same-Origin Policy: Browsers block requests to a different domain by default.

CORS Headers: Tell the browser which domains are allowed to access the resource.

CORS Headers

PHP CORS Implementation

<?php
// CORS middleware - add to every API response
function setCorsHeaders(): void
{
    // Get the requesting origin
    $origin = $_SERVER['HTTP_ORIGIN'] ?? '';
    
    // Define allowed origins
    $allowedOrigins = [
        'https://magento-store.com',
        'https://www.magento-store.com',
        'https://admin.magento-store.com'
    ];
    
    // Check if origin is allowed
    if (in_array($origin, $allowedOrigins)) {
        header('Access-Control-Allow-Origin: ' . $origin);
    }
    
    // Allow credentials (cookies, auth headers)
    header('Access-Control-Allow-Credentials: true');
    
    // Handle preflight OPTIONS request
    if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
        header('Access-Control-Allow-Methods: GET, POST, PUT, DELETE, PATCH, OPTIONS');
        header('Access-Control-Allow-Headers: Content-Type, Authorization, X-Requested-With, X-Custom-Header');
        header('Access-Control-Max-Age: 86400'); // Cache for 24 hours
        http_response_code(204);
        exit;
    }
}

// Call this at the start of every API request
setCorsHeaders();

// Now handle the actual request
$product = getProductById($_GET['id']);
header('Content-Type: application/json');
echo json_encode($product);

Preflight vs Simple Requests

Simple requests (no preflight needed):

• Method: GET, HEAD, POST
• Headers: Accept, Content-Language, Content-Type (with limited values)
• Content-Type: text/plain, multipart/form-data, application/x-www-form-urlencoded

Preflight requests (browser sends OPTIONS first):

• Method: PUT, DELETE, PATCH
• Headers: Authorization, Content-Type: application/json
• Any custom headers

Magento CORS Configuration

<!-- app/code/Vendor/Module/etc/frontend/di.xml -->
<config>
    <type name="Magento\Framework\App\Response\CORS">
        <arguments>
            <argument name="allowedOrigins" xsi:type="array">
                <item name="frontend" xsi:type="string">https://magento-store.com</item>
                <item name="admin" xsi:type="string">https://admin.magento-store.com</item>
            </argument>
        </arguments>
    </type>
</config>

Common CORS Errors and Fixes

Key Takeaway

CORS is a browser security feature that controls cross-origin requests. For Magento REST APIs consumed by frontend JavaScript or mobile apps, proper CORS configuration is essential.