frontend only passes request headers