Content-Type

Content-Type: application/json; charset=utf-8

What it does

What the body IS. Wrong or missing, and browsers guess, APIs 415, and JSON arrives as text.

In practice

The most consequential boring header. Browsers historically sniffed content when it was missing — which became a security hole (see X-Content-Type-Options). For APIs, a POST body without Content-Type: application/json is the most common cause of an empty req.body: the framework never ran its JSON parser because nothing told it to.

← All headers