Constructeur d'en-tête de requête HTTP

Authorization: carries credentials (Bearer token, Basic, API key). Content-Type: tells the server the format of the request body (application/json, multipart/form-data). Accept: tells the server what response format the client expects. Cache-Control: controls caching behaviour. User-Agent: identifies the client application. Correlation-Id / X-Request-Id: for distributed tracing. CORS preflight headers (Origin, Access-Control-Request-Method) are added automatically by browsers.

Basic authentication sends credentials as Base64-encoded username:password in the Authorization header. It is simple but must always be used over HTTPS since Base64 is trivially decodable. Bearer token authentication sends an opaque token (typically a JWT) issued by an identity provider. Bearer tokens can be scoped, time-limited, and revoked independently. OAuth 2.0 and OpenID Connect use Bearer tokens as the standard for API authentication.

application/json indicates the request body is a JSON-encoded string and the server should parse it as JSON. multipart/form-data is used for file uploads or form submissions containing binary data, where the body is divided into named parts separated by a boundary string. application/x-www-form-urlencoded is used for simple HTML form submissions where data is URL-encoded as key=value pairs.

CORS (Cross-Origin Resource Sharing) is a browser security policy that restricts cross-origin requests. When a JavaScript application makes a cross-origin request with custom headers or non-simple methods, the browser automatically sends an OPTIONS preflight request with Origin and Access-Control-Request-Method/Headers. The server must respond with appropriate Access-Control-Allow-* headers for the browser to permit the actual request. Server-side applications and curl are not subject to CORS.