HTTP header fields are components of the message header of requests and responses in the Hypertext Transfer Protocol (HTTP). They define the operating parameters of an HTTP transaction.

learn more… | top users | synonyms

2
votes
2answers
9k views

IIS 7.5 Server response headers (UrlScan does not work)

In the past you could use UrlScan by Microsoft to modify the headers and remove the one's displaying IIS version for example. This does not work for IIS 7.5 and IIS 7.0 is the latest version ...
0
votes
2answers
883 views

Does HSTS HTTP Strict-Transport-Security has to be sent with any response file?

I have to add security measures to a website running a Tomcat 6 application server. One of it is adding the HTTP Strict-Transport-Policy Header. I did this by adding a filter which is in turn adding ...
1
vote
1answer
35 views

“Connection” HTTP header in load balancers

Do load balancers remove the HTTP header indicated in the "Connection" header? As far as I know, headers indicated in the "Connection" header are not supposed to be populated further than the first ...
0
votes
1answer
772 views

Cache header for dynamically created url

I have a PHP script that generates a thumbnail based on an existing path (more info). The basic idea is this: Given the document root /web/, an image lives in /web/images/foo.jpg. When a predefined ...
2
votes
1answer
417 views

Apache returns 206 for some MP3's

We're trying to serve MP3 files from web1.cowbird.com. Most of the time everything works fine. However, sometimes there's a file that the browser is unable to play, and I have no idea why. Here is an ...
2
votes
2answers
501 views

Rejecting traffic where ACCEPT header is empty on favicon.ico requests

As part of filtering out potential harmful traffic, I currently reject traffic where $_SERVER["HTTP_ACCEPT"] is empty. I notice from my logs that a fair number of requests have been rejected due to ...
1
vote
1answer
615 views

How to get custom WebDAV server working with MS mini-redirector

I wrote a custom WebDAV server that authenticates users from a database and serves a virtual file system based on records from a database. It is working well with 3rd party WebDAV clients but does ...
2
votes
0answers
43 views

Strange faulty 16000d response timing in gdevtools for specific XHR

We have some XHR on our website, that is reported in Google developer tools' network timeline as Receiving for 16035.5 days. There actually is a response, and for sure it does not take as long as ...
3
votes
3answers
7k views

Apache proxy_http redirect to ip and set hostname

hopefully you guys can help me with a proxy problem I have. What I already have I have set up an apache http reverse proxy, to proxy requests from *.proxy.domain to *.intern.domain. The apache is ...
3
votes
3answers
2k views

Why is SPDY breaking 'Vary: Accept-Encoding' in Nginx 1.4.3?

I've compiled Nginx 1.4.3 from source with the SPDY module. However when SPDY is enabled, it seems to break my 'Vary: Accept-Encoding' header. My Nginx Configuration: ./configure ...
0
votes
1answer
426 views

Tell browsers to cache until last modified date changes? [closed]

My web site consists of static HTML files which are usually republished once per day, and sometimes more. I'm using Apache. In the vhost settings for my site, I'd like to tell browsers to cache HTML ...
0
votes
3answers
3k views

htaccess filesMatch exclusion

I have the following directive in my htaccess <filesMatch "\.(gif|jpe?g|png|js|css|swf|php|ico|txt|pdf|xml|html?)$"> FileETag None <ifModule mod_headers.c> Header unset ...
4
votes
4answers
3k views

Only allow the POST method for a specific file in a directory

I have one file that should only be accessible via the POST method. /var/www/folder/index.php The document root is /var/www/ and index.php is nested inside a folder. Version of Apache is: 2.4.4. ...
2
votes
1answer
1k views

Remove “X-Page-Speed” version from headers in ngx_pagespeed

I have compiled ngx_pagespeed, but forgot to remove the version number. Is there any way to overwrite/delete/hide them? Apache has feature to 'unset' them, but I couldn't find anything similar for ...
0
votes
1answer
255 views

How to print out all request headers of HTTP requests on the server side?

I have a HAProxy configuration which balances requests to many servers. I want to compare the outgoing request headers when requests go thru HAProxy to the ones I would make directly to my servers. ...
0
votes
1answer
161 views

Can I set a content type if the origin doesn't send one in mod_proxy?

I have a misbehaving origin that when it has an error page it is not setting a content-type header. This is then a problem as we're sitting behind Edgecast and they default to ...
0
votes
1answer
581 views

How do I set up a conditional redirect in Tomcat

I have Tomcat running Jira. I have two DNS names that are attached to this site - mysite.myorg.com and mysite.myorg.net. I want the mysite.myorg.com to redirect all users to mysite.myorg.net since I ...
4
votes
1answer
5k views

Disabling 206 partial content responses on nginx

I have an HTML5 web app that uses a video tag. Depending on the user actions, different parts of the video will be played in response. This video does not exceed 5MB. I need this video to be entirely ...
0
votes
1answer
322 views

Sending two Content-Security-Policy headers

I current have an nginx server that is sending the Content-Security-Policy header, however I've read that apparently IE only supports "X-Content-Security-Policy". Would it be a good idea to send both ...
0
votes
2answers
536 views

Can't get nginx to reply to ab with compressed content

ab -n 1 -H 'Accept-Encoding: gzip, deflate' http://mywebsite.com/ This always returns the uncompressed content (I can see that both from its size and because I'm sniffing the traffic with ngrep). ...
9
votes
2answers
6k views

How do I get Apache2 to parse (without error) Header directives in a .htaccess?

I am getting pages loading with a 500 internal server error, due I believe to a directive that Apache has not been configured to allow. I have AllowOverride set to all, and a .htaccess file, ...
1
vote
1answer
249 views

How to store value of a non-standard HTTP request header to be used in an Apache If conditional

My server will be receiving a non-standard HTTP request named EmployeeID that I want to use to determine access rights to certain directories on the server. How can I store the value of the incoming ...
0
votes
2answers
310 views

Remove X-Powered-By: PHP on IIS7

We have a Win2008 server running IIS7 and php 5.3.17 installed. For pentesting & other security purposes we would like to remove the header response: "X-Powered-By: PHP/5.3.17", so we've tried ...
6
votes
3answers
4k views

Set header in apache if it doesn't already exist

I have a proxy that is injecting some headers but I want to modify it so it only sets the headers if they are not already present: <Location /api> RequestHeader set MY_HEADER "value" ...
11
votes
5answers
11k views

Referer is passed from HTTPS to HTTP in some cases… How?

In theory browsers do not pass on referer information from HTTPS to HTTP sites. And in my experience this has always been true. But I just found an exception, and I want to understand why it works so ...
1
vote
1answer
3k views

nginx and HTTP Referer

I'm using nginx together with php5-fpm and with the following fastcgi_params file: fastcgi_param CONTENT_LENGTH $content_length; fastcgi_param CONTENT_TYPE $content_type; ...
1
vote
1answer
2k views

How can I use SSL behind a load balancer and still get the client IP?

Note, I can't use SSL termination at the load balancer, due to network security related issues. The client IP I get is of course that of the load balancer. I know that the load balancer can't modify ...
3
votes
3answers
2k views

nginx is cutting the end of dynamic pages and caching them

I moved one of my old sites from an Apache to an nginx server. Everything is working fine but the site has some long content (a +100k generated HTML file). My first trial was to disable chunked ...
1
vote
2answers
1k views

Can Squid 2.7 proxy gzipped content

We have a forward proxy for our network which is Squid 2.7. This is managed for us by a third party. We noticed recently that http requests going from our network to the web were having the ...
0
votes
1answer
127 views

Can we configure HTTP response code headers?

We're stumped. We're getting a new header in our Apache httpd + Passenger web server we didn't expect. We have a sensitive web client reading this we cannot modify at this time. Can we modify this ...
0
votes
1answer
380 views

GoAccess analytics and HTTP Referer

This is a high-level question regarding using goaccess as a tool for website analytics. I have it set up on an nginx server and parsing the logs just fine, but it seems that many requests to my own ...
24
votes
3answers
33k views

Human readable format for http headers with tcpdump

I would like to view the HTTP headers sent from Apache (listening on port 80) to Tomcat (on port 4080) in a Linux machine. According to Wikipedia, Header fields are colon-separated name-value ...
2
votes
1answer
349 views

Why does this HTTP header configuration cause browsers to always perform If-Modified-Since requests?

On our server, we have configured http response headers as follows: Cache-Control:max-age=28800, must-revalidate # (8 hours) Connection:Keep-Alive Date:Wed, 24 Apr 2013 21:36:19 GMT ...
1
vote
1answer
2k views

Amazon ELB not Passing “X-Forwarded-For” to IIS

ELB is setup to accept public HTTPS (443) connections and send them on as HTTP (80) to the EC2 instances. The EC2 instances run an IIS app that needs to know the user's IP address. According to ...
2
votes
1answer
1k views

Why does nginx not send the Content-Length header when the request is HEAD?

I am using CURL to test HEAD requests to my nginx server. The file being served is a simple PHP file. If I use GET: $ curl -XGET http://test.com/phpinfo.php -I HTTP/1.1 200 OK Date: Tue, 09 Apr 2013 ...
2
votes
2answers
871 views

Can I get Apache 2.2 to set a particular response header if some other response header is missing

I have an Apache 2.2 server running mod_proxy. We had a scenario where a response came through from the origin corrupted, it didn't have any content-type or cache-control headers. This meant that ...
0
votes
2answers
4k views

Gzip compression with nginx

In my nginx.conf I have: gzip on; gzip_static on; gzip_buffers 16 8k; gzip_comp_level 9; gzip_http_version 1.0; gzip_min_length 1000; gzip_types text/plain text/css ...
-1
votes
1answer
225 views

Do I need to handle chunked HTTP requests if I only work with GET requests? [closed]

I am writing a Netty server that handles HTTP GET requests from the browser to serve scripts or pixels. My understanding is that there is no reason why I would receive chunked requests as all I ...
1
vote
0answers
135 views

nginx: how to serve files in gzip format when client accepts “Accept-Encoding: gzip” and inflated otherwise?

I have a folder full of .gz files and would like to serve them transparently inflated if requested by a client that does not send Accept-Encoding: gzip in the request and as-is (gzip'd) otherwise. I ...
0
votes
1answer
135 views

How respect acept: text/plain with nginx? [duplicate]

In http header there is a field named accept, so client can specify prefered format. How can I configure nginx to return markdown page in case of plain text request and processed via some markdown ...
1
vote
0answers
1k views

IE 10 HTTP 401 Error on AJAX POST

I've been chasing down an issue and decided to make the most basic reproduction of the issue possible in hopes that a simplified question will help me resolve this. I am receiving a 401 error when ...
0
votes
1answer
333 views

nginx ssl proxy for one hostname only

I want nginx to serve as a ssl proxy but for host: "ssl.example.com" at the same time I want nginx to serve "nginx is ok" website for host: "ssl-check.example.com" (this is just example, please don't ...
0
votes
1answer
664 views

Apache reverse proxy forwarding https header

I have successfully installed reverse proxy on Apache. It works like a charm. I'm using it to proxy https request to http. My problem is that I need to forward variable SERVER_HTTPS to my end server, ...
2
votes
1answer
1k views

IIS7 Response header exposes server information when post request is incomplete

IIS reveals "Server: Microsoft-HTTPAPI/2.0" in the response header when a invalid Post request is made. e.g. content-length is not included in the header. The Response returned also says HTTP/1.1 411 ...
0
votes
1answer
2k views

Content disposition header on Nginx

I am doing a setup where Apache runs the web application and NginX serves files that users download. The files should be downloaded with their real names instead of the names their are being stored ...
1
vote
1answer
2k views

Set Access-Control-Allow-Origin in nginx using wildcard domain

With nginx can I specify Access-Control-Allow-Origin using a wildcard like *.mydomain.com? Would it look like: add_header Access-Control-Allow-Origin *.mydomain.com; Thanks.
1
vote
2answers
1k views

nginx redirection cycle with X-Accel-Redirect

Trying to get nginx to work with the X-Accel-Redirect header. I'm getting this error: *24 rewrite or internal redirection cycle while internally redirecting to "/app/index.php", client: 127.0.0.1, ...
0
votes
1answer
1k views

Lowercase headers [closed]

One thing I've noticed about CloudFlare and Google's web servers are that they both use lowercase response headers. Is this just for looks, or does it actually provide a performance increase? I'm ...
-2
votes
1answer
85 views

Why is there a redundancy in HTTP status headers? [closed]

I'd like to learn something from the design of HTTP protocol - why is there, for example, "Not found", following the "404" code? Wouldn't the number itself be sufficient?
1
vote
1answer
4k views

From which Apache version onward is LimitRequestFieldSize no longer hardcoded to 8k max?

Title says it all: from which version onward is the LimitRequestFieldSize no longer hardcoded to a max. of 8k? It seems 2.2.15 is still affected.