@RequestHeader and @CookieValue in Spring MVC — Header and Cookie Extraction

Direct Answer

@RequestHeader binds one header value, a collection, or the full header map to a controller argument. @CookieValue binds a named HTTP cookie value. required=false, Optional, or defaultValue can represent absence, but a default should be used only when it has real domain meaning. Authentication is normally handled by Spring Security filters and SecurityContext rather than manually parsing credentials in every controller.

Code Example

@RestController
@RequestMapping("/api/users")
public class UserController {

    @GetMapping("/profile")
    public ResponseEntity<UserProfile> getProfile(
        @RequestHeader("Authorization") String authHeader,
        @RequestHeader(value = "X-Request-ID", required = false, defaultValue = "unknown") String requestId,
        @CookieValue(value = "session-id", required = false) String sessionId
    ) {
        var token = authHeader.replace("Bearer ", ""); // extract JWT token
        var profile = userService.getProfile(token);
        return ResponseEntity.ok(profile);
    }

    @GetMapping("/debug")
    public Map<String, String> debugHeaders(@RequestHeader Map<String, String> headers) {
        return headers; // returns all request headers as JSON
    }
}

record UserProfile(String username, String email) {}

Common Mistakes & Pitfalls

• Manually parsing HttpServletRequest: Freshers inject HttpServletRequest and call request.getHeader("Authorization") instead of using at-RequestHeader. This is verbose, harder to test, and not idiomatic Spring. Use the annotation.
• Not handling missing headers: Freshers don't set required=false when a header is optional. If the client doesn't send it, Spring throws an exception and returns a 400 error. For optional metadata, always add required=false and a defaultValue.
• Case sensitivity confusion: HTTP headers are case-insensitive per the spec, but freshers sometimes worry about exact casing. Spring normalizes header names, so "Authorization", "authorization", and "AUTHORIZATION" all work. Focus on consistency in your code, not exact casing.
• Reading cookies manually: Freshers parse the Cookie header as a String and split it. Use at-CookieValue instead — Spring extracts and decodes the cookie automatically.