I want to ask if the following headers are always present in a request:
HTTP_ACCEPT_LANGUAGE,HTTP_USER_AGENT,REMOTE_ADDR
I plan on using them to modify sensitive information, but I need to be sure that they will always be present in a non-threat-intended request. In other words it will be ok if someone purposely removes any of them, but in order for ordinary users to be able to use my application they will need all 3 of them. Is there any type of standard that requires certain headers to be sent?
Clients SHOULD include a user-agent header but it is not required by the HTTP spec. The Accept-lang header is completely optional. Remote addr is not even a HTTP header. I believe it is obtained from the underlying TCP/IP request so I would guess that your framework will always provide that.