Nexios

Appearance

Headers ​

Headers are a fundamental part of HTTP requests and responses, carrying metadata about the message body, client capabilities, server information, and more. Nexios provides comprehensive tools for working with headers in both requests and responses.

Request Headers ​

Access incoming request headers through the request.headers property, which provides a case-insensitive dictionary-like interface:

python
from nexios import NexiosApp
app = NexiosApp()
@app.get("/")
async def show_headers(request, response):
    user_agent = request.headers.get("user-agent")
    accept_language = request.headers.get("accept-language")
    return {
        "user_agent": user_agent,
        "accept_language": accept_language
    }

Common Request Headers ​

HeaderDescriptionExample
AcceptContent types the client can processapplication/json, text/html
AuthorizationCredentials for authenticationBearer xyz123
Content-TypeMedia type of the request bodyapplication/json
CookieCookies sent by the clientsession_id=abc123
User-AgentClient application informationMozilla/5.0
X-Requested-WithIndicates AJAX requestXMLHttpRequest

💡 Tip

Nexios normalizes header names to lowercase, so request.headers.get("User-Agent") and request.headers.get("user-agent") are equivalent.

Response Headers ​

Set response headers using the response.set_header() method or by passing a headers dictionary:

python
from nexios import NexiosApp
app = NexiosApp()
@app.get("/")
async def set_headers(request, response):
    response.set_header("X-Custom-Header", "Custom Value")
    response.set_header("Cache-Control", "no-store")
    return response.text("Hello, World!")

Common Response Headers ​

HeaderDescriptionExample
Content-TypeMedia type of the responsetext/html; charset=utf-8
Cache-ControlCaching directivesmax-age=3600
Set-CookieSets cookies on clientsession_id=abc123; Path=/
LocationURL for redirectshttps://example.com/new
X-Frame-OptionsClickjacking protectionDENY
Content-Security-PolicySecurity policydefault-src 'self'

Setting Headers In Middleware ​

Middleware is an ideal place to set headers that should be applied to multiple routes:

python
from nexios import NexiosApp
app = NexiosApp()

async def security_headers_middleware(request, response, next):
    # Set security headers before processing
    response.set_header("X-Content-Type-Options", "nosniff")
    response.set_header("X-Frame-Options", "DENY")
    response.set_header("Content-Security-Policy", "default-src 'self'")
    
    await next()
    
    # Can also modify headers after processing
    response.remove_header("Server")  # Remove server identification

app.add_middleware(security_headers_middleware)

Header Manipulation Methods ​

Nexios provides several methods for working with headers:

Request Header Methods ​

  • request.headers.get(key, default=None) - Get a header value
  • request.headers.items() - Get all headers as key-value pairs
  • request.headers.keys() - Get all header names
  • request.headers.values() - Get all header values

Response Header Methods ​

  • response.set_header(key, value, override=False) - Set a header
  • response.remove_header(key) - Remove a header
  • response.has_header(key) - Check if header exists
  • response.set_headers(headers_dict, override_all=False) - Set multiple headers

Security Headers Best Practices ​

For enhanced security, consider these recommended headers:

python
@app.middleware
async def add_security_headers(request, response, next):
    response.set_headers({
        "X-Content-Type-Options": "nosniff",
        "X-Frame-Options": "DENY",
        "X-XSS-Protection": "1; mode=block",
        "Referrer-Policy": "strict-origin-when-cross-origin",
        "Content-Security-Policy": "default-src 'self'; script-src 'self'",
        "Strict-Transport-Security": "max-age=63072000; includeSubDomains; preload"
    })
    await next()

Performance Headers ​

Optimize client-side caching and resource loading:

python
@app.middleware
async def add_performance_headers(request, response, next):
    if request.path.endswith(('.js', '.css', '.png', '.jpg')):
        response.set_header("Cache-Control", "public, max-age=31536000, immutable")
    await next()

Cookies are set via special Set-Cookie headers:

python
@app.get("/login")
async def login(request, response):
    response.set_cookie(
        key="session_id",
        value="abc123",
        max_age=3600,
        secure=True,
        httponly=True,
        samesite="strict"
    )
    return response.redirect("/dashboard")

Conditional Headers ​

Handle conditional requests with these headers:

HeaderPurposeExample
If-Modified-SinceCheck if resource changedSat, 01 Jan 2022 00:00:00 GMT
If-None-MatchCheck ETag match"abc123"
ETagResource version identifierW/"xyz456"
Last-ModifiedResource modification timeSat, 01 Jan 2022 00:00:00 GMT

Restricted Headers ​

Some headers are restricted and cannot be modified:

  • Content-Length (automatically calculated)
  • Connection
  • Transfer-Encoding
  • Host

⚠️ Warning

Always set headers after the request is processed in middleware when modifying responses. Setting headers too early may result in them being overwritten.

Further Reading ​