An HTTP identity header is a request header that carries a username-like value such as a login name or account ID. By itself, it is only data sent in a request; it is not proof that the sender is really that user. If an application treats a client-controlled header as trusted identity, an attacker can spoof another account and bypass authentication or impersonate a higher-privilege user.
This matters in systems that rely on reverse proxies or web server authentication. In a safe design, the proxy authenticates the user and then sets server-side identity fields such as REMOTE_USER, while stripping any inbound identity headers from the client. Defenders should never accept a username header directly from the network without strict controls, such as proxy allowlists or a shared secret. The rule is simple: identity must be asserted by trusted infrastructure, not claimed by the requester.