When client (Postman for example) is making the request to server, is the client responsible for including the HTTP security headers in the request?

Or is the server responsible for defining these headers and showing them in response?

I couldn’t really find a comprehensible answer to this.

  • What headers do you mean?
    – mentallurg
    Mar 24, 2023 at 13:50
  • Headers like Strict-Transport-Security, Content-Security-Policy and X-Frame-Options for example.
    – Ewidence
    Mar 24, 2023 at 13:59
  • Please add these details to the question.
    – mentallurg
    Mar 24, 2023 at 15:18
  • You should not trust any HTTP headers on a client request. You can verify integrity of some of them like JWT or authorization headers, but by default don't just any of the information that goes on a client request.
    – camp0
    Mar 24, 2023 at 15:37
  • The client would decide whether to obey those headers (coming from the server). Postman requests don't originate from a page/URL, so they do not read or obey those headers. Mar 24, 2023 at 17:15

1 Answer 1


There exist both client-side headers (like Authorization) and server-side headers (like Content-Security-Policy) which are play a significant role in the context of security. So it is not clear what exactly you refer to.

But a common use of the phrase "security headers" refers to response headers, i.e. headers set on the server side and not the client side. See for example HTTP Security Response Headers Cheat Sheet.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .