PHP and custom HTTP headers, bad practice?

Question

I have a custom implementation of a RESTful API for a PHP application that returns json data, and in order to communicate the status of the operation, ie whether there were failures in the request, I'm setting a custom HTTP Header with a (very tiny) json object as a string. This works well since I can send responses and easily retrieve them client side without messing with the actual data sent.

The question is, are there any drawbacks I may not have realized of using this method? It doesn't seem to be very common for applications to set custom http headers, so I'm wondering whether it is a bad practice or bad "taste" somehow.

You mean in the status code? Like "200 {error:true}" ? Or a real header as "X-Something: whatever"? — Savageman
– Savageman, Commented Jun 29, 2012 at 15:02
The HTTP spec already addresses this. If there was a failure, you should return the proper HTTP status code and a description of the error in the body, not a custom header. — netcoder
– netcoder, Commented Jun 29, 2012 at 15:06
What if there is no proper HTTP code for the error in question? — Artefact2
– Artefact2, Commented Jun 29, 2012 at 15:11
@Artefact2 Then send a valid HTTP code that indicates a generic error (e.g. 500) and embed a specific error code in the returned JSON data. — Polynomial
– Polynomial, Commented Jun 29, 2012 at 15:12
Not necessarily malformed, imagine you are asking for two icecreams and I return you one; it's not what you expected, but you can still do something with it (provided you handle it properly) — Mahn
– Mahn, Commented Jun 29, 2012 at 18:23

Polynomial · Accepted Answer · 2012-06-29 15:15:10Z

16

Answer recommended by PHP Collective

This is an interesting question. There shouldn't be any reason for it to be a problem, but you should take a few things into account:

The headers need to be unique to your application. Not just now, but forever. You should ensure you're prefixing them, e.g. X-MyApplication-Foo: Bar. Not doing this might cause conflicts in future.
Firewalls are sometimes (rarely) a little overzealous with filtering unknown HTTP headers. This shouldn't be a problem, but it's something to keep in mind.
Older browsers have smaller limitations on header field sizes than modern browsers, so you need to test across as many as you can get hold of.

Is there are reason you can't use the standard HTTP error codes? I understand that you might want to provide stack traces or other useful debugging information, but in the case of an error, wouldn't you just return a JSON blob that contains the error information, rather than the normal "result" JSON data? You could easily detect the difference based on the HTTP error code and handle the two cases differently.

The reason I'm concerned by your suggested approach is that headers are used to alter or cause browser behaviour - they're not intended to be a data storage mechanism.

Pseudo-code example:

switch(httpResponseCode)
{
    case 200:
        parseResult(json);
        break;
    case 403:
        parseForbidden(json);
        break;
    case 500:
        parseServerError(json);
        break;
    default:
        // bad response code, handle appropriately
}

edited Jun 29, 2012 at 15:15

answered Jun 29, 2012 at 15:08

Polynomial

28.4k13 gold badges86 silver badges110 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Mahn Over a year ago

The thing with headers is that, as opposed to a JSON reply, they can be set anywhere from the application, which makes it ideal to replace for instance throw exception statements across the application when the call is made through AJAX. Otherwise, if a class that depends on another class which depends on another class fails, the JSON reply data has to be sent back and forth in order to get the error response back, so the choice of the headers seemed natural to save time. But maybe I'm just being lazy.

Mahn Over a year ago

Great points either way. Somehow it already felt natural to prefix the header with the application name.

Polynomial Over a year ago

Why not just have a global array variable to store such headers? You can serialize the array down into JSON when you write the result back to the client.

Collectives™ on Stack Overflow

PHP and custom HTTP headers, bad practice?

1 Answer 1

3 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related