153

I have already googled a lot this subject, read various articles about this header, its use in Heroku, and projects based on Django.

However, it's still all confused in my head.

  • What is the purpose of this header?
  • Does it violate user privacy?
  • Can it help tracking a user?
2
  • 1
    @Wrikken I already did that ... and I'm still confused about this header.
    – Stephan
    Aug 21, 2014 at 18:27
  • Then, in order (1) to corrolate an webrequest with the request forwarded to your application (2) No, because the user doesn't send it, the router sets it (3) See (2), but it might help track individual requests while debugging.
    – Wrikken
    Aug 21, 2014 at 18:30

4 Answers 4

254

When you're operating a webservice that is accessed by clients, it might be difficult to correlate requests (that a client can see) with server logs (that the server can see).

The idea of the X-Request-ID is that a client can create some random ID and pass it to the server. The server then include that ID in every log statement that it creates. If a client receives an error it can include the ID in a bug report, allowing the server operator to look up the corresponding log statements (without having to rely on timestamps, IPs, etc).

As this ID is generated (randomly) by the client it does not contain any sensitive information, and should thus not violate the user's privacy. As a unique ID is created per request it does also not help with tracking users.

6
  • 1
    @Wrikken mentions in his/her comment that the ID was set by a router and here its clients. What are clients ?
    – Stephan
    Nov 27, 2014 at 17:44
  • 5
    A client is the software that sends the request to the server, could be a browser or a stress test tool like JMeter. Also the server can generate the Request Id if one is not supplied by the original client, and pass it to other servers down the line, e.g. web server generates the id and forwards it to application server.
    – isapir
    Feb 5, 2015 at 19:57
  • 2
    The Heroku blog declares X-Request-ID helps correlating multiple log entries to individual HTTP(s) requests : blog.heroku.com/…
    – Stephan
    Jan 11, 2017 at 15:15
  • 6
    It also known as CorrelationId and not a standard HTTP header: en.wikipedia.org/wiki/List_of_HTTP_header_fields X-Request-ID, X-Correlation-ID. Correlates HTTP requests between a client and server.
    – Major
    Aug 30, 2017 at 16:39
  • 1
    The session ID will just identify the session. The request ID is used to identify each individual request. So there is an inherent difference in what can be done with each of them. Jan 28, 2019 at 7:56
21

Purpose: Idempotency

With an ID that changes for every request, but stays the same in case of a retry of a request, the receiver can ensure the request won't get processed more than once.

This is a quote from some API provider:

All POST, PUT, and PATCH HTTP requests should contain a unique X-Request-Id header which is used to ensure idempotent message processing in case of a retry

If you make it a random string, unique per request, it won't infringe on your privacy, nor enable tracking.

If you want to know more of what idempotency has to offer, read this insightful article.

N.B. As Stefan Kögl comments, this header is not standardized - hence the (deprecated) "X-" prefix.

3
  • 10
    Please note that while "some API provider" might use the X-Request-Id header in this way, this is not standard behavior. It can not generally be used for this purpose. Oct 16, 2019 at 12:56
  • Another Simple Snippet: restapitutorial.com/lessons/idempotency.html
    – JayRizzo
    Jun 5, 2020 at 18:58
  • 3
    This is a non-standard usage. Idempotency is a general concept and using the X-Request-ID request header as described is one way to implement it. I wouldn't recommend it if only because, for a number of reasons, the server should not trust the client for its implementation. It would be better, for example, to rely on the natural key of the resource to be retrieved/created/replaced and avoid collisions using traditional multi-user database transaction techniques. May 23, 2022 at 15:33
5

Explanation using a story/analogy

You can think of X-Request-ID like some type of ID card.

Imagine visiting the DMV:

  1. You get a "ticket" (with an ID number) from a dispenser, and then you
  2. Stand in line, for 16 hours,
  3. after 16 hours - the DMV tells you to go home. i.e. your request timed out. (The petty tyrants at the DMV don't work a micro-second past 3:59:00 pm).

An entire day wasted - you complain to the congressman - hey: I waited in line for 16 hours etc. The congressman replies:

"Buddy, we get 1000s of people visiting the DMV everyday - When I look through the DMV records, how am I meant to identify you - when you came etc.?

That's where the X-Request-ID comes in. Just show him your number on that ticket.....

Application of story to HTTP

The same applies to http requests - it's an id used to help back end devs find out what went wrong. Clients submit requests with that id - and it's a ID that they create (i.e. some random number etc.). Now servers can keep track of it.

Story given to help you remember. Hopefully you're not confused even further - post a comment if I have and i'll try to clear it up. thx.

2
  • 7
    The "analogy" here adds confusion, rather than clarity, in my opinion. In the case of a phone call there is no way to pass on a random number that gets automatically logged by recipient, and consequently your story is nonsensical.
    – Mark Amery
    Apr 26, 2019 at 15:46
  • That's where that little ticket they give you from that red dispenser comes in... That's your request id. But not as detailed as you would want a real request id. Apr 17 at 22:41
-15

This request header can be used for syncrhonization. Let's say you've built a ToDo list that offers offline capability. Your user creates 3 items and each of them are given a unique UUID on the offline application. When network connectivity is available, the records are POSTed to the server and the corresponding IDs auto-generated from the database are returned. You can then replace the IDs in your app (e.g. "id" attribute of HTML "li" element).

1
  • 7
    The scenario described here doesn't imply the use of a HTTP header for transporting the UUID.
    – Stephan
    Dec 17, 2016 at 12:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.