Headers, Cookies, and the Client IP
Access request.headers, cookies, and remote_addr.
Headers, Cookies, and the Client IP is a free Flask Academy lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Flask Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
Requests Carry Metadata
Beyond the body, every request ships metadata like headers, cookies, and the client address that your views can inspect.
Read Headers With request.headers
The request.headers object is a case-insensitive mapping of all HTTP headers the client sent along with the call.
agent = request.headers["User-Agent"]Headers Are Case-Insensitive
You can read a header as content-type or Content-Type and get the same value, since header names ignore case by design.
ct = request.headers.get("Content-Type")Get the Authorization Header
API clients often send credentials in the Authorization header, which you read like any other header value.
auth = request.headers.get("Authorization")Cookies Live in request.cookies
Values your server set earlier come back in request.cookies, a dict-like object keyed by each cookie name.
theme = request.cookies.get("theme")Always Default Your Cookies
A first-time visitor has no cookies, so use .get with a sensible default to avoid surprises on their initial request.
theme = request.cookies.get("theme", "light")The Client IP via remote_addr
Flask exposes the connecting address as request.remote_addr, handy for logging or simple rate-limit bookkeeping.
ip = request.remote_addrProxies Hide the Real IP
Behind a proxy, remote_addr is the proxy address. The true client IP often sits in the X-Forwarded-For header instead.
ip = request.headers.get("X-Forwarded-For")Know the Requested URL
Inspect request.url for the full address, or request.path for just the route portion the client asked for.
where = request.pathIdentify the HTTP Method
Check request.method to see whether this call is a GET, POST, or another verb, then branch your logic accordingly.
if request.method == "POST":
passA Diagnostic whoami View
Combine these and a whoami route can report the caller IP and browser, perfect for debugging real traffic.
@app.route("/whoami")
def whoami():
return f"{request.remote_addr}"Quick Check
Test what you learned about request metadata.
Recap: Headers and Cookies
You read headers and cookies safely, found the client IP via remote_addr, and learned proxies hide the real address. 🚀
Frequently asked questions
Is the “Headers, Cookies, and the Client IP” lesson free?
Yes — the full text of “Headers, Cookies, and the Client IP” is free to read here on the web, and the Flask Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Flask Academy course, upgrade to CoddyKit PRO.
What will I learn in “Headers, Cookies, and the Client IP”?
Access request.headers, cookies, and remote_addr. You practise Flask Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Flask Academy?
No prior experience is required. Flask Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Headers, Cookies, and the Client IP” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Flask Academy lesson?
Yes. Every Flask Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Query Strings via request.args
- Form Fields via request.form
- JSON Bodies via request.get_json
- Headers, Cookies, and the Client IP