Even cookies aren't required (see https://tools.ietf.org/html/rfc2616 https://tools.ietf.org/html/rfc2616 and https://serverfault.com/questions/163511/what-is-t

Even cookies aren't required (see https://tools.ietf.org/html/rfc2616 https://tools.ietf.org/html/rfc2616 and https://serverfault.com/questions/163511/what-is-the-mandatory-information-a-http-request-header-must-contain https://serverfault.com/questions/163511/what-is-the-mandato... for an explanation). It entirely depends on the client and convention. That said, browsers typically send headers such as ACCEPT, REFERER and USER_AGENT (see https://www.whatismybrowser.com/detect/what-http-headers-is-my-browser-sending https://www.whatismybrowser.com/detect/what-http-headers-is-... for a complete list of headers for your browser).