阅读中文版本

Hop-by-Hop Versus End-to-End Headers

Hop-by-hop headers such as Connection and Transfer-Encoding apply only to a single link, so intermediaries must consume them rather than forward them unchanged.

Definition

HTTP headers are classified as end-to-end, meaningful across every hop, or hop-by-hop, meaningful only for one connection and consumed by each intermediary that processes the message.

The distinction governs what a proxy may copy when it relays a message and which headers a server must strip before forwarding. Compared to simpler alternatives, this concept fits best when the trade-off it represents is the one the system actually cares about.

When to use it

A common use case is applying it at the boundary where the cost of getting it wrong is highest, and the scenario usually involves a concrete guarantee the system must uphold. Unlike an ad hoc approach, it makes that guarantee explicit, reviewable, and testable.

How it works

The Connection header lists field names that are themselves hop-by-hop, so a proxy must remove both Connection and each name it lists before passing the message along.

Standard hop-by-hop fields include Keep-Alive, Transfer-Encoding, TE, Trailer, Upgrade, and the PROXY-related fields, none of which should survive past the hop that interpreted them.

Trade-offs and alternatives

Failing to strip them can smuggle headers past security checks or create framing ambiguity between a front proxy and its backend, which is a known path to request smuggling. The main drawback is the extra complexity it introduces, so the benefit should clearly outweigh that cost before a team adopts it.

Common misconceptions

A persistent misconception is that all headers can be forwarded verbatim by any proxy. Another is that the Connection header only signals connection close behaviour. For example, an engineer who assumes otherwise may design around a guarantee that does not actually exist, which only becomes obvious under load or failure.

Anti-patterns to avoid

Two recurring anti-patterns are to blindly copying every request header through an application proxy and to treating Transfer-Encoding and Content-Length as interchangeable. Both tend to surface as hard-to-debug production issues rather than obvious test failures. Related concepts include HTTP Trailer Fields, CAA Records Constraining Certificates, Equal-Cost Multipath Routing.