HTTP header fields are components of the message header of requests and responses in the Hypertext Transfer Protocol (HTTP). They define the operating parameters of an HTTP transaction.

learn more… | top users | synonyms

0
votes
2answers
434 views

nginx : add_header directive not working

My Issue: nginx add_header directive doesn't appear to be working What I have tried: In my nginx conf I have this: location ~* \.(ttf|woff|eot|otf|woff2|svg|svgz)$ { access_log ...
0
votes
1answer
65 views

Truncate Basic authentication username and password in Apache proxy

We need to proxy a request to a server. The sender has an autogenerated username and password, and will use basic authentication. We can't change these how these are generated by the sender. The ...
0
votes
1answer
746 views

How do I capture unique id in haproxy logs?

I'm trying to capture the unique id for each request in my logs. I thought I could use capture request header X-Unique-ID len 16 on the header but its not working. Any suggestions? global log ...
0
votes
0answers
77 views

How to troubleshoot an invalid cached response

I've a Google Cloud Engine instance with Suse Linux 13.2 with original network config and without any configured proxy. And I've a problem with an invalid CACHED response I receive from a server. ...
1
vote
2answers
377 views

How to replace the host variable in a header in nginx

I am trying to replace the host variable in the header in nginx configuration, such that some.random.sub.example.net becomes net-some.random.sub.example.com. i have tried the following : if ($host ~* ...
2
votes
1answer
217 views

Can I compare a variable set by auth_request_set after the auth_request has returned in nginx?

I've got a location block with an auth_request like this location /somepath { auth_request /authorize; auth_request_set $header_variable $upstream_http_custom_header; proxy_path ...
1
vote
1answer
146 views

Apache 2.4.16 Response Header value clipped

Problem: The value of a Response Header is greater than 8K and always clipped. Server Config: Apache 2.4.16-x64 with mod_proxy and mod_proxy_http / Running on Windows Server 2012 Httpd.conf: ...
3
votes
0answers
284 views

Apache Header Module Loaded but can't set headers in htaccess

I have Apache 2.2.29 (unix) setup and running on my new dev machine (mac). I am trying to set CORS headers for an API project - something that I have done many times. The htaccess file for the ...
0
votes
0answers
182 views

font-awesome not displaying on Nginx, Rails 4, mina/puma

I made some changes to the nginx config file and I now cannot see any of the font-awesome fonts on FF and Chrome. The fonts are precompiled and in this directory: ...
0
votes
3answers
2k views

Setting Access-Control-Allow-Origin in .htaccess for Https protocol

I have a site with http and https. I set in the .htaccess the following line which runs for http. Header set Access-Control-Allow-Origin "*" But with https I get this error. No ...
0
votes
1answer
1k views

Why does my apache refuse the “Content-Security-Policy” headers?

I'm currently in the process of implementing Content-Security-Policies. But my apache refused to accept the config settings. The apache2 versions I am currently using are: 2.2.22 and 2.4.7. Neither ...
2
votes
1answer
954 views

is there a standard for chaining x-forwarded-for headers?

IETF RFC 2616 Section 4.2 allows a request to contain multiple headers with the same field-name as long as chronological order of insertion is preserved and their values can be converted into single ...
0
votes
1answer
60 views

Protocol-relative URL in CSS file is being overwritten

I have this code: <?php header('Content-Type: text/css; charset=utf-8'); ?> a.logo{background:url(//webzina.net/img/logo.png) no-repeat 100% 0} Locally (PHP Version 5.3.5), I get: ...
1
vote
1answer
47 views

Calculate HTTP Digest

I am just trying to calculate the response for an HTTP Digest Authentication. Imagine the example from RFC2617. I extracted the folling variables: USER="Mufasa" REALM="testrealm@host.com" ...
0
votes
0answers
5 views

What cache control headers will prevent revalidation? [duplicate]

I'm trying to set cache control headers on a /static/ directory such that browsers will use a cached copy of the file without revalidating it. Links to files in this directory include the timestamp ...
0
votes
1answer
1k views

max-age=0 sent by browsers despite headers modified everywhere

I have a headers/cache issue in my lamp [centos] website. Config: [root@localhost httpd]# httpd -v Server version: Apache/2.2.23 (Unix) Server built: Nov 25 2012 15:03:00 [root@localhost httpd]# ...
6
votes
1answer
1k views

How can the x-frame-options HTTP header of ADFS 3 be manipulated?

By default, ADFS 3 responses contain the "X-Frame-Options: DENY" HTTP header. This prevents ADFS from being run in an iframe, because this presents an opportunity for clickjacking attacks. At the ...
0
votes
0answers
32 views

How to make this pound config work

I'm trying to have pound match on the Host header, and then modify the header before making the request. Something like: Service HeadRequire "Host: company.something.com" HeadRemove "Host" ...
1
vote
1answer
687 views

Included rewrite rules not matched

With Apache, I'm trying to set up a rewrite rule which will be included in several virtual hosts. Actually, this rule file is included in 2 vhost. The first vhost contains only this rewrite rule (and ...
5
votes
2answers
208 views

apache: Send request URI within HTTP header for static files

To fulfil the requirements of the PubSubHubbub 0.4 spec, I have to send a rel=self header for each file. I'm now trying to do that with Apache's mod_headers and environment variables: Header append ...
1
vote
1answer
72 views

Is Strict-Transport-Security HTTP header name case-sensitive?

I'm digging into the HTTP Strict-Transport-Security specification, https://tools.ietf.org/html/rfc6797 It specifies the syntax of the header like this: Strict-Transport-Security: max-age=15768000 ; ...
2
votes
1answer
590 views

How can the HSTS header be added to WebLogic?

Is there an implementation for using the Strict-Transport-Security header to WebLogic? I figure it would be using something in web.xml under <security-constraint> I know how to do this for an ...
0
votes
0answers
102 views

Apache header order

I am working on a private server application for a web based mobile game that uses php to generate responses. In order to do this I am trying to replicate the behavior of the main server as closely as ...
0
votes
0answers
123 views

apache2 ubuntu 14.04. Expire date has been set, but it is not cached anyway

As shown in screenshot, the expire date is 11 May 2016 (a year from now), but the resource is always downloaded everytime I access the website. I set expire date by using htaccess: <IfModule ...
1
vote
0answers
29 views

HEAD request leads to file name too long

I have a website which frequently posts data from client to server of about 3200 characters. I notice that some users of the site when visiting one page in particular will make a HEAD request with the ...
2
votes
3answers
2k views

How do I add no-cache headers to all 404 pages served by apache and nginx?

I have recently run into an issue after switching to Cloudflare, and the solution is to basically stop Cloudflare from caching 404 responses. In our load-balanced multi-server setup, occasional 404s ...
-1
votes
1answer
477 views

The server committed a protocol violation. Section=ResponseHeader Detail=CR must be followed by LF [closed]

I've tested my website with mxtoolbox.com and got this message: Result: The server committed a protocol violation. Section=ResponseHeader Detail=CR must be followed by LF I've googled around ...
1
vote
1answer
497 views

Is there a way to make GoogleImageProxy honor Cache-Control / expiration headers?

I am suddenly getting flooded with requests from Google's image proxy servers that look like the following: 66.249.81.250 - - [04/May/2015:06:55:54 +0000] "GET /images/image_1.jpg HTTP/1.1" 200 93394 ...
0
votes
1answer
1k views

multiple post requests using wget and same base-url

wget has nice option that lets you allow downloading multiple files from same location (I mean combination of --base and --input-file) Advantage of this, is that if possible wget tries to reuse ...
6
votes
2answers
972 views

Does Nginx `if_modified_since` only work on static resources?

I can't seem to find enough documentation. I have an app that generates some dynamic responses, but could still benefit from the Last-Modified header -- so I send it. However, turning on ...
1
vote
1answer
129 views

Unable to combine RewriteRule and Header set [duplicate]

Trying to implement the following: RewriteRule \.ttf$ - [E=cors:1] Header set Access-Control-Allow-Origin "*.example.com" env=cors:1 Header set Access-Control-Allow-Origin "*.sadface.com" env=!cors:1 ...
0
votes
0answers
191 views

HTTP response returns valid content-length header but no message body

I've recently found a very strange problem which I can't explain. After posting a HTTP request to our server occasionally the following response will occur: HTTP/1.1 200 OK Date: Mon, 13 Apr 2015 ...
2
votes
2answers
43 views

What's the purpose of spammy HTTP referers?

In the logs of my website, there's a lot of visits with a HTTP referer set to spam-like websites (usually Russian sites, I've noticed). I assume what they're doing is just using a web crawler to visit ...
0
votes
0answers
122 views

X Forwarded For Showing Origin IP

My X-Forwarded-For header is showing my origin IP. I am routing traffic via Cloudflare and I know it's touchy with that header. I changed it to MYNAME-Forwarded-For just to check and it still shows ...
1
vote
0answers
57 views

Date Header always has the same date

I have a server running Windows 2012 with IIS 8.5 that is hosting several sites. For every response that is returned from a client request to any of the sites the Date header has the same value: Key ...
1
vote
0answers
390 views

Error: No 'Access-Control-Allow-Origin' header is present on the requested resource. (NGINX)

I am using NGINX and I am receiving that error in the browser's console. I am so frustrated. According to my boss, I need to set up cors which what I did and still I am getting the same error. This ...
2
votes
1answer
7k views

nginx proxy_pass rewrite of response header location

The aim of this nginx instance is to get GitLab and OpenWRT Luci to redirect through a reverse proxy. It's already working for several other websites, all which have a base url which seems to counter ...
0
votes
0answers
60 views

How to preserve the name of the remoteUser while reverse proxy?

I am using a software which enables me to log my operations and one the things it is loggin is the name of the remote user. Neverthless, I have a little problem since I am working on a secured ...
1
vote
1answer
751 views

Is setting a Content Security Policy incompatible with Joomla's admin page?

I'd like to set a content security policy header for a Joomla website running on Apache 2.4. Using this configuration from h5bp and setting Header set Content-Security-Policy "script-src 'self'; ...
1
vote
0answers
168 views

Amazon ELB + EC2 Header mismatch

Preamble: I have an AWS Elastic Load Balancer in front of a Single Amazon EC2 instance. I have 3 other EC2 instances sending requests via curl to the Load Balancer. Direct requests to the EC2 ip has ...
1
vote
1answer
427 views

Set Access-Control-Allow-Origin Header for specific URL that has a Query String

I'm asking this here as a last resort after trying different things / asking google / reading http://httpd.apache.org/docs/2.2/ I have the following in my apache2.conf # Allow cross domain fonts ...
0
votes
2answers
187 views

Decrypt a Header in Apache (HTTPD)

I've been asked to have a look at whether it's possible to decrypt a header during the processing of the request. The specific use case is to respond to the decrypted contents of the header by ...
0
votes
1answer
116 views

Inject header in HAProxy redirect function

I have HAProxy 1.5.8. I have this basic 301 rule : frontend http_frontend bind *:80 mode http redirect location https://xxxx.com code 301 The response looks like this : HTTP/1.1 301 Moved ...
1
vote
1answer
389 views

How to avoid duplication of add_header directives in nginx?

The documentation says this: These directives are inherited from the previous level if and only if there are no add_header directives defined on the current level. My problem is that I have ...
0
votes
0answers
161 views

Nginx: How to access my reverse proxied sites via separate subdirectories

I have 2 web applications that I want available under http://example.com/demo1 and http://example.com/demo2. My config below correctly reverse proxies to each site, and the site is mostly functional, ...
-1
votes
1answer
469 views

Mikrotik: Add HTTP Header Parameter to Requests [duplicate]

I want to add a parameter of MikroTik to all HTTP header requests using MikroTik. So all client and servers that connected to the MikroTik can trace the parameter in their HTTP header. How can I ...
3
votes
1answer
1k views

What is the meaning of an IIS http status code 404.503?

Microsoft lists the IIS http status codes including the substatus codes here. In the 404 section there are substatus codes between 0 and 20, but in my logs I get a 503 as sc-substatus I can't find ...
2
votes
0answers
111 views

HAProxy: Limmit concurrent connections based on HTTP header field

I try to limit the number of concurrent connections using HAProxy stick-tables based on HTTP header fields. I could find plenty of examples using IP addresses, but this doesn't work in my case. Our ...
1
vote
0answers
36 views

Script to verify/monitior HTTP caching headers [closed]

We'd like to verify that all our websites use the correct HTTP caching headers. Is there a script out there to make a request to a website, check its response headers and report whether it will be ...
3
votes
2answers
593 views

Redirect depending on preferred language (Accept-Language) with .htaccess

When users request /, I want to redirect them to /en or /de, depending on their preference specified in the HTTP request header Accept-Language. I guess this is easy with server-side scripting, but I ...