HTTP header fields are components of the message header of requests and responses in the Hypertext Transfer Protocol (HTTP). They define the operating parameters of an HTTP transaction.

learn more… | top users | synonyms

0
votes
2answers
36 views

Nginx silently dropping header lines that exceed 1128 bytes

I have Nginx set up as a reverse proxy to a uWSGI application (a Django app). Due to the nature of the content that the Django app is hosting, sometimes the URLs get long. Really long. Because of ...
-1
votes
1answer
32 views

Debug Nginx caching

I want to determine when I am getting cache hits or misses. Preferably, this would be a header, like X-Cache: HIT or X-Cache: MISS How can I do this with Nginx (a reverse proxy for the upstream ...
-1
votes
1answer
19 views

Does Nginx respect maxage from upstream server?

I see the proxy_cache_valid directive, but that confuses me. In HTTP, doesn't the upstream server specify this with Cache-Control and maxage? How do I get Nginx's cache to use maxage ?
0
votes
0answers
10 views

Apache configuration redirect using only redirect, not rewrite

PS: this is the 2nd part of the question originally posted here. I'd like to disable the HSTS header completely for specific virtual hosts. I have (per recommendation) a redirect in the 443 container ...
-1
votes
1answer
33 views

Serve static files from directory depending on http referrer inside of nginx [closed]

My server hosts images, but the content of images have to be different for the same link and have to deepens on http referrer. For example: Website 1 load image website1.jpg from ...
0
votes
1answer
15 views

how to find out if mod_xsendfile is handling the transfer?

I just installed and configured mod_xsendfile on my apache2.2.15 web server (on centos6.5). Everything seems to be working fine except that I'm not sure it is. I added XSendFile On and XSendFilePath ...
-1
votes
0answers
18 views

Cookie is not deleted by HTTP header [migrated]

My project is using an external authentication provider that sets a cookie if a user is logged in. To log out, I have to delete that cookie. As far as I can tell, the Set-Cookie header is correct, but ...
2
votes
2answers
99 views

Apache HSTS exception for some virtual hosts

In the global config section for Apache 2.2.15, I have the following (per recommendation) <IfModule mod_headers.c> Header add Strict-Transport-Security "max-age=15768000;includeSubDomains" ...
0
votes
1answer
124 views

Nginx/Apache: set HSTS only if X-Forwarded-Proto is https

I got the following setup: Internet => nginx[public:80 +443, SSL termination) => Varnish[localhost:81] => Apache[localhost:82] Now some sites should only be reachable via HTTPS and a valid ...
1
vote
1answer
52 views

Conditionally serving high resolution and WebP images with nginx

Not sure if I'm trying to pull off the impossible, but I'm wanting to configure Nginx to serve ".webp" files to browsers that support the file format and serve fallback files (i.e. pngs, jpgs, etc.) ...
2
votes
2answers
357 views

The Content-Length header does not exist

I have nginx server installed on Linux. When I send a request with curl, the Content-Length header is missing from the response. The 1.php file is: <?php echo "hello"; ?> The example ...
0
votes
0answers
58 views

handling CORS preflight request in Apache

I have a AngularJS app deployed using Yeoman. Cakephp RESTful backend. The Angular app sends in OPTIONS preflight requests, which the backend responds with forbidden (403), in nginx to solve this ...
0
votes
0answers
52 views

Override PHP Cache-Control Header from Apache config?

PHP is setting the Cache-Control header in multiple places. I don't want to break my code upgrade path, but I'd like to change the Cache-Control header in Apache config instead. However, it looks like ...
0
votes
1answer
32 views

Measuring HTTP traffic basic on URIs and custom headers

I'm currently working on an API service and one of the requirements is that we measure the amount of data used by each user of the system, and track how many times they use the API. So bandwidth usage ...
0
votes
1answer
17 views

Is it possible to path protect by header values in apache?

Is there a mod / way to get this pseudo code working in apache? <Location /somepath/> if not value of request header 'x-token' is 'secret' deny </Location>
1
vote
1answer
61 views

Under what scenarios would Apache allow a mismatched HTTP_HOST to pass through?

Someone has managed to pass an undefined HTTP_HOST server variable to my application script, triggering a series of errors. I am quite perturbed but am unable to replicate this behaviour. My httpd ...
0
votes
1answer
129 views

mod_expires doesn't set expiry for images (png,jpeg,gif)

I am using this below configuration in my apache2.conf <IfModule mod_expires.c> ExpiresActive On ExpiresByType image/gif "access plus 6 month" ExpiresByType image/jpg "access plus 6 ...
1
vote
1answer
45 views

What is expected behaviour from Server returning Http 416

I have a server and sometimes when client ask for a file and if its request header Range may get over the length of file, so the server returns 416 status code. But I'm wondering should it write file ...
0
votes
1answer
202 views

Update Cache-Control max-age when srcache returns response from cache

I have configured Nginx to use srcache (along with the redis and redis2 modules). Server-side caching works great. My application responds with the appropriate Expires and Cache-Control headers, and ...
0
votes
1answer
129 views

Inconsistent behavior with Nginx's auth_request_set and more_set_input_headers

I'm trying to use the auth_request module in conjunction with the more_set_input_headers to automatically login my users into web apps. Basically, it works like this: Users have some session cookie ...
0
votes
2answers
133 views

nginx - Change error_page based on proxy_pass response

Is it possible to change the fallback error_page based on the response of the upstream proxy? upstream serverA { server servera.com; } upstream serverB { server serverb.com; } location / { ...
0
votes
0answers
61 views

Apache not return allow header in OPTIONS method

I try to get allow header form apache server. I sended request with curl. The server return headers but not "header allow" header: $ curl -v -X OPTIONS 10.0.0.1 * Rebuilt URL to: 10.0.0.1/ * Hostname ...
0
votes
0answers
66 views

How to change http header using nginx

We have a problem that a backend system requires the parameters of the Content-Type http header to be in a certain order. For example (note the position of the type="text/xml"): Content-Type: ...
7
votes
3answers
512 views

What's wrong with this HTTP POST request?

I'm trying to fuzz a server using the Sulley fuzzing framework. I observe the following stream in Wireshark. The error talks about a problem with JSON parsing, however, when I try the same HTTP POST ...
0
votes
1answer
796 views

How to configure nginx so it works with Express?

I'm trying to configure nginx so it proxy_pass requests to my node apps. Question on StackOverflow got many upvotes: http://stackoverflow.com/questions/5009324/node-js-nginx-and-now and I'm using ...
0
votes
0answers
50 views

google webmaster soft 404 on 301

I'm looking through google webmaster that my page is generating soft 404 errors (https://support.google.com/webmasters/answer/181708?hl=en) google says: We recommend that you always return a 404 (Not ...
0
votes
0answers
25 views

How to set header for non-self-referencing URI in Apache?

I have to cache web pages with URL path teacher and student like so: <LocationMatch "^/(teacher|student)/"> Header set Cache-Control "private, max-age=60" </LocationMatch> However, ...
-1
votes
2answers
120 views

Apache - force set 304 status for all images

Is it possible to force set HTTP 304 status for all images? I wrote code below in my vhost, but now instead 404/304 status I get 500 <filesMatch "\.(ico|gif|jpg|png|jpeg)$"> Header set 304 ...
-2
votes
1answer
157 views

How to run a website domain without redirecting if IP is already used for another website? [duplicate]

I bought a VPS Host that gave me only 1 IP Address which I used on my first domain name and it works without any problems. Now my second domain name I can't use the same ip address as it points to ...
2
votes
1answer
898 views

Add a custom header to ProxyPass requests

I have a simple apache vhost: <VirtualHost *:80> ServerName hello.local ProxyPass / http://localhost:8810/ ProxyPassReverse / http://localhost:8810/ </VirtualHost> All request to ...
0
votes
1answer
127 views

Using Apache variable

I'm trying to use Apache's OpenID authentication module. According to this page, I should be able to use the REMOTE_USER Apache variable to identify the user. I'd like to pass this as a header to an ...
0
votes
2answers
830 views

NGINX is not forwarding a header value when using proxy_pass

I have the following setup and configured to send all /api requests to a different server: location /api { proxy_pass https://myapp.herokuapp.com; rewrite ...
1
vote
1answer
405 views

Apache: Force HTTP 1.1 or Persistent/KeepAlive connections for HTTP 1.0 requests

I want to force Keep Alive or Persistent connections for all HTTP requests on my Apache 2.2.3 server running on RHEL 5.8. A lot of web crawlers are using HTTP 1.0 for some reason, and I would like to ...
0
votes
1answer
235 views

nginx proxy_pass receive content/status headers when http 4xx

Was having some trouble as chronicled here - http://stackoverflow.com/questions/22570550/play-2-2-1-simpleresult-4xx-response-body-possible-via-cors-xhr But I didn't focus on nginx since the 200 OK ...
0
votes
1answer
83 views

Nginx using mysql result as variable to be used in headers more module

Without going into too much detail we have a requirement for the following: a) Query a simple single column, single row result from mysql. b) Use this variable as part of a more headers module, ...
1
vote
0answers
100 views

Can not I properly configure expires headers for apache

I am trying to configure caching for static js/css/img on apache2 (I am using ubuntu). I do not want to use .htaccess due to this answer. So I tried the following: enabled modexpires modified ...
0
votes
1answer
894 views

How do I set proper Headers for JSON in Apache?

I have an Apache server which is serving out static JSON files. The Content Type is correctly being represented in the header with an Content-Type: application/json header. How do I add the correct ...
1
vote
1answer
309 views

Nginx: How to set expiration for 404 responses?

My nginx server acts as a proxy for another server, which sometimes returns 404s. I want the 404 responses to be cacheable, just like 200 responses. However, I cannot use expires, because the ...
16
votes
3answers
781 views

Is there any reason to keep the “Server” response header in Apache

My server responds with Server: Apache/2.2.15 (CentOS) to all requests. I guess that this gives away my server architecture making it easier to hack attempts. Is this ever useful to a web browser? ...
0
votes
1answer
895 views

Nginx $http_x_forwarded_for not always being set

I've noticed in our access logs that sometimes, the $http_x_forwarded_for variable has not been set, and instead, the correct IP is the one set to $remote_addr. Is it possible to set ...
0
votes
1answer
230 views

Add custom headers to HTTP 401 responses from Kerberos mod_auth_kerb

I'm using Apache with mod_auth_kerb to perform HTTP authentication. How do I add custom headers to the 401 Authorization Required response generated by the auth module? The relevant sections of my ...
2
votes
2answers
3k views

IIS 7.5 Server response headers (UrlScan does not work)

In the past you could use UrlScan by Microsoft to modify the headers and remove the one's displaying IIS version for example. This does not work for IIS 7.5 and IIS 7.0 is the latest version ...
0
votes
0answers
109 views

MS TMG - forward original user ip in request

How can we configure our TMG to pass original user's IP in HTTP request? We need it for additional security in application, but we see only TMG's IP. How can we setup X-Forwarded-For or another field? ...
0
votes
1answer
143 views

Issues with authenticating through HTTP POST

I am currently investigating an issue with our web authentication server not working for a small subset of users. Our method of authentication involves sending a hash through an HTTP POST. My ...
1
vote
1answer
29 views

“Connection” HTTP header in load balancers

Do load balancers remove the HTTP header indicated in the "Connection" header? As far as I know, headers indicated in the "Connection" header are not supposed to be populated further than the first ...
0
votes
1answer
449 views

Cache header for dynamically created url

I have a PHP script that generates a thumbnail based on an existing path (more info). The basic idea is this: Given the document root /web/, an image lives in /web/images/foo.jpg. When a predefined ...
2
votes
1answer
173 views

Apache returns 206 for some MP3's

We're trying to serve MP3 files from web1.cowbird.com. Most of the time everything works fine. However, sometimes there's a file that the browser is unable to play, and I have no idea why. Here is an ...
2
votes
2answers
132 views

Rejecting traffic where ACCEPT header is empty on favicon.ico requests

As part of filtering out potential harmful traffic, I currently reject traffic where $_SERVER["HTTP_ACCEPT"] is empty. I notice from my logs that a fair number of requests have been rejected due to ...
1
vote
1answer
231 views

How to get custom WebDAV server working with MS mini-redirector

I wrote a custom WebDAV server that authenticates users from a database and serves a virtual file system based on records from a database. It is working well with 3rd party WebDAV clients but does ...
1
vote
0answers
37 views

Apache configured for HSTS, but SSLLabs/Chrome not acknowledging

I'm setting up a webserver and I've been checking it against SSLLabs and Chrome 31 to make sure the security is up to snuff. However neither Chrome nor SSLLabs seems to believe that strict transport ...