A modern HTTP request
摘要
作者搭建了一个简单的 HTTP 服务器，拦截并记录了 Chrome 发送的全部请求头，展示了现代浏览器请求的完整内容。原文逐条解析：Host 头从 HTTP/0.91 开始；sec-ch-ua 替代了 User-Agent；DNT、sec-gpc、permissions-policy 用于隐私保护；Sec-Fetch 头表明请求意图，用于 CSRF、CORS 等决策；Upgrade-Insecure-Requests 指示服务器优先返回 HTTPS；sec - 开头头部只能由浏览器设置；最后提及 HTTP Trailers（1997 年 HTTP/1.1 标准），可于请求末尾追加头部，通过分块编码实现。
荐读理由
通过 sec-ch-ua 头能获取浏览器设备信息，应用到你的 AI 项目后端请求头设置或用户画像构建
原文
I got curious about what HTTP headers Chrome is requesting so I stood up a trivial HTTP server and this is what is on the wire.
$ while true; do echo -e "HTTP/1.1 200 OK\nContent-Length: 3\n\nOK\n" | nc -l -p 8081; done
GET / HTTP/1.1
Host: localhost:8081
Connection: keep-alive
sec-ch-ua: "Not;A=Brand";v="8", "Chromium";v="150", "Google Chrome";v="150"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"
DNT: 1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br, zstd
Accept-Language: en-US,en;q=0.9
sec-gpc: 1
permissions-policy: browsing-topics=()
Goodness that’s a lot of stuff! I still remember when even the Host header was optional (in HTTP/0.91). And my knowledge taps out around HTTP/1.1, the Connection: keep-alive and the Accept headers.. Anyway, what else is there?
The sec-ch-ua stuff is a modern replacement for User-Agent
DNT, sec-gpc, and permissions-policy are various requests to preserve my privacy. I just installed OptMeOwt, it is adding some of these. I think permissions-policy is a Google thing.
The Sec-Fetch stuff is about the intent of the request and is apparently used to make decisions related to CSRF, CORS, etc.
Upgrade-Insecure-Requests is telling the webserver to redirect me to https if it can.
In general sec- is a “forbidden request header“: only the browser is allowed to set these headers, not Javascript on the page. (Extensions can set them though.)
One other trivia I learned about: HTTP Trailers. This lets you set more headers at the end of an HTTP request instead of the start. Say data you only know about after a long POST or something. These date all the way back to 1997 and HTTP/1.1 apparently but I’ve never encountered them. They don’t work with the simplest request format since there’s no way to identify the end of the HTTP body. Chunked encoding allows for them and I imagine later encodings have something similar.
这条对你有帮助吗？