What is an HTTP Header?

Short answer

An HTTP header is additional information in Name: value form carried with the request and the response; for example, Host reports which site the request is made to, User-Agent the client, Cookie the session information, and Content-Type the type of the body. Headers come after the first line and before the body; their names are case-insensitive. In TR7, headers are both read and modified: the HTTP Header condition decides based on the presence or value of a header in the request or the response; the Add HTTP Header, Set HTTP Header, Replace HTTP Header Content and Delete HTTP Header actions add, change or delete headers without touching the Backend Service; the Request HTTP header content smart variable carries the value of a header to another field; the Header tab of the WAF rule inspects the number, size and names of headers.

Where It Is Used in TR7

Where	Field / label	What for
Load Balancer → Conditions (Policy Match) → Criteria	HTTP Header → Header Name (Request / Response selector; the form opens with Request and Host)	A decision based on the presence or value of a request or response header
Load Balancer → Actions (Policy Actions)	Add HTTP Header, Set HTTP Header, Replace HTTP Header Content, Delete HTTP Header	Adding, changing, deleting a request or response header
Load Balancer → Actions (Policy Actions)	Keep Header Names	Forwarding the upper/lower-case spelling of header names to the Backend Service as is (disables HTTP/2 and HTTP/3 on the vService)
Action value fields → Smart Variables	Request HTTP header content, Response HTTP Header Content	Writing the value of a header to another header, to the path or to a log line
Load Balancer → Profiles (L4-L7 Behavior Sets) → Health Checks → HTTP / HTTPS profile	HTTP Headers	Adding headers to the health check request
Left Monitor Panel → WAF-Protected vServices → vService → WAF Management → N page types → rule → Header	Header Key Count, Allowed Headers, Required Headers, Total Header Size and header value checks	Inspecting the names, number and size of headers

Common Misconceptions

• "Headers come only from the browser." The response also has headers (Set-Cookie, Content-Type, Server); TR7 actions can edit request and response headers separately.
• "Header values can be trusted." The client writes headers freely; a security decision should not be based solely on a header sent by the client.
• "In WAF, header names are entered into the Allowed headers and Required headers lists as they are written." WAF compares header names by converting them to lowercase; the names are written to the list in lowercase (Can I require a specific header to be present?).

How it is done in the documentation

• HTTP Header
• Add HTTP Header
• Variables · HTTP header info
• WAF Rules · Header

Related questions

• Can I add, remove or change HTTP Headers in a request or response?
• Can I route based on an HTTP Header, cookie or query parameter?
• Can I change a header value with a regex?
• Can I require a specific header to be present?