HTTPService Base Headers

I’ve been looking for information on this in a lot of places, but I can’t seem to find anything. Does anyone know if HTTPService Requests have their own predefined headers that are sent along in addition to any that we might add? I wouldn’t assume so, but I had an idea for a project and this is helpful information to be perfectly sure about.

Can you provide me with some more information that you are looking to get from the headers?

I’m not looking for anything in specific, I just want to know if there are headers that Roblox adds to their outgoing requests without you explicitly defining them, aside from the standard stuff like response code, etc.

The headers HttpService sets are the following:

  • User-Agent - always set to RobloxGameCloud/1.0 (+http://www.roblox.com)
  • Roblox-Id - the PlaceId of the place the request was made from

and yeah… that’s about it. They apply to all http functions (GetAsync, PostAsync and RequestAsync).

Keep in mind if you’re using PHP you have to format the header names like HTTP_ROBLOX_ID when getting their values from $_SERVER.

Do you have any idea if those headers can be spoofed/replaced by the client?

No they can’t, since you make the request on the server. The client isn’t involved in this process at all.

Though if somebody obtains your url they can make a normal request to it outside of roblox with any data they want, so obviously keep it a secret.

1 Like