@RequestHeader, @CookieValue and @RequestAttribute

#Introduction

These three annotations are widely used in enterprise Spring Boot applications — especially for JWT authentication, API versioning, microservices, correlation IDs, logging, API gateways, security filters and request tracking.

Interviewers commonly ask: How do you read HTTP headers? How do JWT tokens reach the controller? What's the difference between a header, a cookie and a request attribute? How do filters pass data to controllers? Which Spring classes resolve these annotations?

#HTTP Request Structure

GET /users/101?page=1 HTTP/1.1
Host: localhost:8080
Authorization: Bearer eyJhbGciOiJIUzI1NiJ9...
Accept: application/json
X-Request-Id: 7e4b3a
Cookie: SESSION=ABC123

#Part 1 — @RequestHeader

@RequestHeader binds an HTTP request header to a controller parameter.

// Authorization: Bearer abc.xyz.123
@GetMapping("/profile")
public User profile(@RequestHeader("Authorization") String token) {
    return service.getProfile(token);
}

Spring injects the Authorization header into String token.

Reading Standard Headers

@GetMapping
public String language(@RequestHeader("Accept-Language") String language) {
    return language;   // Accept-Language: en-US → "en-US"
}

@GetMapping("/device")
public String device(@RequestHeader("User-Agent") String agent) {
    return agent;      // browser detection, mobile detection, analytics
}

@GetMapping
public String host(@RequestHeader("Host") String host) {
    // Host: localhost:8080
}

Required, Optional and Default Values

@RequestHeader String version means required = true — a missing header gives 400 Bad Request.

@RequestHeader(required = false) String version       // null when absent
@RequestHeader(defaultValue = "1.0") String version   // "1.0" when absent

Reading All Headers

@GetMapping
public void headers(@RequestHeader Map<String, String> headers) {
}

Authorization=Bearer xxx
Host=localhost
Accept=application/json

(Use HttpHeaders or MultiValueMap<String, String> if a header can appear more than once.)

JWT Authentication Example

// Authorization: Bearer eyJhbGc...
@GetMapping("/profile")
public User profile(@RequestHeader("Authorization") String token) {
}

Usually the controller doesn't validate the token directly. Instead:

API Versioning

// X-API-Version: 2
@GetMapping
public User users(@RequestHeader("X-API-Version") Integer version) {
}

#Part 2 — @CookieValue

Cookies are small pieces of data stored by the browser.

// Cookie: SESSION=ABC123
@GetMapping("/dashboard")
public String dashboard(@CookieValue("SESSION") String session) {
}

Spring extracts SESSION → ABC123.

Multiple Cookies

// Cookie: SESSION=ABC123; theme=dark; language=en
@GetMapping
public void cookies(@CookieValue("theme") String theme,
                    @CookieValue("language") String language) {
}

Optional and Default Cookies

@CookieValue(required = false) String theme         // null when absent
@CookieValue(defaultValue = "light") String theme   // "light" when absent

Cookie vs Header

Cookies are often used by browsers for stateful sessions; headers are commonly used for authentication and API metadata.

Session Example

Spring resolves @CookieValue with ServletCookieValueMethodArgumentResolver.

#Part 3 — @RequestAttribute

Less common, but extremely important in enterprise projects — an interview favourite.

What is a Request Attribute?

A request attribute is data stored inside the current HTTP request on the server. Unlike headers and cookies, the client never sees it.

Why Do We Need It?

Suppose a JWT filter validates the token. Instead of validating again in the controller:

Example

// Filter
request.setAttribute("userId", 101L);

// Controller
@GetMapping("/profile")
public User profile(@RequestAttribute Long userId) {
}

Authentication Example

// JWT filter
request.setAttribute("loggedInUser", user);

// Controller
@GetMapping("/me")
public User me(@RequestAttribute User loggedInUser) {
}

No need to decode the JWT again.

Header vs Request Attribute

Spring resolves @RequestAttribute with RequestAttributeMethodArgumentResolver.

#Comparison Table

#Enterprise Architecture

#Internal Spring Flow

#Summary

#Key Takeaways

• @RequestHeader reads HTTP headers such as Authorization, Accept-Language and custom headers.
• @CookieValue reads cookies sent by the client — session IDs and user preferences.
• @RequestAttribute reads server-side attributes created while processing the current request.
• Each is resolved by a dedicated HandlerMethodArgumentResolver.
• Authentication usually happens in filters or Spring Security; controllers receive the already-authenticated user.
• Choose the annotation based on where the data originates.