HTTP header fields are components of the message header of requests and responses in the Hypertext Transfer Protocol (HTTP). They define the operating parameters of an HTTP transaction.

learn more… | top users | synonyms

0
votes
0answers
9 views

Apache Revese Proxy is not cached

I have the below config so all requests to /j/* will be proxied, however why not being cached as told ? Its on windows 2012 and apache 2.4.20 . Thanks ProxyPassMatch "^/j/(.*)$" ...
2
votes
1answer
1k views

How to remove “Client-Peer” (etc) header in nginx with php-fastcgi

My setup: OS: Ubuntu 11.04 HTTP Server: nginx 1.2.1 compiled with the HttpHeadersMore module processing PHP via php-fastcgi (other irrelevant software - ruby, python, etc) My problem: I'm ...
1
vote
1answer
23 views

How is Cache-Control: max-age affected by intermediate caching?

I am currently serving an HTML page to users with a Cache-Control: max-age=600 header. I believe this allows the users' browsers to cache the page for a maximum of 10 minutes. I am considering adding ...
0
votes
1answer
341 views

Remove server header from IIS 8.5

I have IIS 8.5 installed on my Windows server 2012 R2. I am trying to remove the Server: Microsoft-IIS/8.5 header from my responses. I tried installed URLScan but it fails to install with the ...
1
vote
1answer
80 views

Nginx - Wrong Response Header

when installing joomla I face an issue realated to response header. During the installation process, an ajax post request send to server which in response status is 303 instead of 200 ! so ajax ...
0
votes
1answer
12 views

<RequireAll> / Require expr equivalent in Apache 2.2.22 to check for headers?

I use the following Apache config to to check for certain headers in my requests: <LocationMatch /test-headers/> <RequireAll> Require expr %{HTTP:header1} == 'abc' ...
0
votes
1answer
11 views

Non proxy aware client, (mitm)proxy modification of headers

What I am trying to achive Pulling data, using a SaaS service, from a remote site with a simple GET request to mitmproxy. The SaaS service is not proxy aware. I want the SaaS web client to do a GET ...
0
votes
0answers
41 views

no apache http headers with php5-fpm

I've migrated from standard fastCGI to php5-fpm. Now all headers that are set via Apache (mod_expires, mod_header, and so on) are being discarded (or not set, resp.). For example, I need to parse ...
2
votes
1answer
1k views

Apache: Force HTTP 1.1 or Persistent/KeepAlive connections for HTTP 1.0 requests

I want to force Keep Alive or Persistent connections for all HTTP requests on my Apache 2.2.3 server running on RHEL 5.8. A lot of web crawlers are using HTTP 1.0 for some reason, and I would like to ...
6
votes
1answer
1k views

How can the x-frame-options HTTP header of ADFS 3 be manipulated?

By default, ADFS 3 responses contain the "X-Frame-Options: DENY" HTTP header. This prevents ADFS from being run in an iframe, because this presents an opportunity for clickjacking attacks. At the ...
0
votes
1answer
2k views

Update Cache-Control max-age when srcache returns response from cache

I have configured Nginx to use srcache (along with the redis and redis2 modules). Server-side caching works great. My application responds with the appropriate Expires and Cache-Control headers, and ...
0
votes
0answers
11 views

Apache Doesn't Unset Headers

We have apache 2.4 with the headers mod enabled. We have two identical VirtualHosts, but the X-Frame-Options header gets set for one site and not the other when unconfigured (tested on both Chrome and ...
1
vote
0answers
13 views

Cookie Secure Flag not persistent

I'm trying to implement a Secure flag for all cookies. I'm doing this via Headers. Here's how I did it: Header edit Set-Cookie (?i)^(.*)(;\s*secure)??((\s*;)?(.*)) "$1; Secure$3$4" It ...
3
votes
2answers
7k views

How do I set proper Headers for JSON in Apache?

I have an Apache server which is serving out static JSON files. The Content Type is correctly being represented in the header with an Content-Type: application/json header. How do I add the correct ...
2
votes
1answer
45 views

Custom headers (mod_headers) not showing in combination with mod_rewrite

I have a vhost with multiple domainnames linked to it. I'm trying to send additional headers when a request is made to one particular domainname. Here's what I'm doing (tried both in the vhost as in ...
1
vote
0answers
36 views

nginx is ignoring root location header (location /)

I have self-compiled nginx 1.9.14 with http2 support: nginx version: nginx/1.9.14 built by gcc 4.9.2 (Debian 4.9.2-10) built with OpenSSL 1.0.1k 8 Jan 2015 TLS SNI support enabled So I have a ...
2
votes
0answers
64 views

HSTS exclude specific subdomain with “includeSubdomains”

I'm using HSTS with this header on my website: Strict-Transport-Security: max-age=15768000; includeSubDomains This works as intended and forces the browser to redirect all http connections to ...
1
vote
1answer
23 views

500 Error: “End of script output before headers” - Simple script within Wordpress theme

I have a multi-site install of Wordpress running fine on a unmanaged CentOS server, however for a certain feature I need to do my own thing on certain pages and manually interact with some ...
0
votes
1answer
16 views

Apache 'always set' headers removed if mod_expires ExpiresActive On

I have a following directives in my virtual host: Header always set Strict-Transport-Security "max-age=157700000;" Header always set ThisIsATestHeader "This is removed when ever ExpiresActive is on" ...
0
votes
1answer
19 views

Proxy to add CORS headers with netcat

I'm looking for a little script using nc which will be used to add CORS headers (at least Access-Control-Allow-Origin: *) in order for my local ionic dev application to access a remote webservice.
14
votes
3answers
25k views

How can I make nginx support @font-face formats and allow access-control-allow-origin?

I've added these rules to mime.types: application/x-font-ttf ttf; font/opentype otf; application/vnd.ms-fontobject eot; font/x-woff ...
1
vote
0answers
57 views

Very long useragent

We have requests in our server log with a very long useragent: HEADER: user-agent=Mozilla/5.0 (Windows NT 6.1; WOW64; rv:32.0; WUID=4bddaa48430e60af6132822cd6fab6c4; WTB=2873; ...
1
vote
0answers
83 views

How do I allow users to override X-Frame-Options when using Apache + PHP-FPM?

I have an Ubuntu 14.04 server running Apache + PHP-FPM + FastCGI, serving user home pages. For security, I have enabled in Apache's configuration: Header set X-Content-Type-Options: "nosniff" Header ...
1
vote
0answers
10 views

Negative impact of setting Apache's LimitRequestFieldSize very high?

On apache httpd 2.2, I would like to increase the value of LimitRequestFieldSize to 48k or maybe even 65k. Has anyone experience with setting the value of LimitRequestFieldSize to such high values? ...
0
votes
0answers
65 views

Configure Apache DirectorySlash to honor X-Forwarded-Host set by load balancer

Is there a way to configure the DirectorySlash behavior of Apache to honor the X-Forwarded-Host header set by a load balancer? For example, assume my load balancer host is example.com but it forwards ...
11
votes
5answers
11k views

Referer is passed from HTTPS to HTTP in some cases… How?

In theory browsers do not pass on referer information from HTTPS to HTTP sites. And in my experience this has always been true. But I just found an exception, and I want to understand why it works so ...
0
votes
1answer
21 views

Content security policy: blocked uri “about”

I am implementing Content security policy to my website headers. I currently have it on report-only setting for testing. My server is Apache 2.4.7. After setting up some policies I keep seeing ...
3
votes
3answers
2k views

nginx is cutting the end of dynamic pages and caching them

I moved one of my old sites from an Apache to an nginx server. Everything is working fine but the site has some long content (a +100k generated HTML file). My first trial was to disable chunked ...
0
votes
1answer
43 views

Haproxy rules(set-header) not working and it's not changing base url of request

I am trying to integrate cloud foundry adminui application. Url which I access is https://myexample.com/adminui/ It works as follows: Request https://myexample.com/adminui/ Response ...
1
vote
0answers
44 views

ColdFusion fails to include custom HTTP response header set in IIS 8.5

I have a Windows 2012 R2 server running IIS 8.5 and ColdFusion 11. Under a specific directory ("mydirectory") I added an HTTP Response Header (Name: X-ResponseHeader, Value: Test). The resulting ...
2
votes
1answer
143 views

php file downloads instead of being processed with ajax on apache

I have a small website where some content is displayed within a HTML tag using AJAX. The content is simply taken from another page on the same web site. However, sometimes instead of loading the ...
-1
votes
2answers
983 views

Apache doesn't send me an MP3 header even when I use a direct address to the file

Apache doesn't send me an MP3 header even when using a direct address to the file. It means I can play it with Flash audio players on my web pages, but when I tried to download from the direct address ...
0
votes
1answer
324 views

Suppress PHP Headers running cgi PHP from Ruby

I originally posted this on StackOverflow and it was suggested that I try posting this here because, "It might be something like the configuration in CGI is different than the configuration for your ...
0
votes
1answer
171 views

re-direct SSL pages using header statement based on port

I found this in the header.php file of a e-commerce site. Is this better done in a .htaccess file. Also what would happen to any post parameters that get caught in the header statement. // flip ...
2
votes
1answer
140 views

My Apache 2.2 local test server with php none cgi automaticly removes logged in ipad users

My Local httpd Apache 2.2 test server with php installed is having problems with a ipad user. I have scripted a loggin script that uses php sessions to keep them loggedin, the page has a javascript ...
0
votes
2answers
321 views

Remove X-Powered-By: PHP on IIS7

We have a Win2008 server running IIS7 and php 5.3.17 installed. For pentesting & other security purposes we would like to remove the header response: "X-Powered-By: PHP/5.3.17", so we've tried ...
22
votes
5answers
27k views

How to dump entire HTTP requests with apache

Is it possible to dump entire HTTP requests by apache? I need to track all HTTP headers of incomming requests. How to do that?
3
votes
2answers
3k views

File Specific cache http header for IIS 6

Is there a way to set cache related header for a specific file type in II6? We want to turn off cache on all our *.js and *.css file here, but IIS6 is forcing us to do a all or nothing approach.
3
votes
2answers
3k views

Sending machine hostname as a header in Apache

I have a group of linux apache 1.3 servers behind a load balancer, and I want to be able to, at a glance, determine which server I'm hitting. The load balancer is severely limited in its monitoring ...
2
votes
1answer
2k views

Disable User-Agent based Vary header response in nginx?

It seems that nginx includes a Vary: Accept-Encoding header in some cases regardless of the file types I specify via "gzip_types". I do not have much experience with nginx. Does it in fact send Vary: ...
1
vote
1answer
2k views

Should I use Expires headers, Cache-Control headers, or both?

Just trying to do a bit of performance tuning on a client's site. I don't want to set far future expiries yet, because we are still changing a lot of stuff regularly, but I'd like to give everything ...
1
vote
1answer
9k views

How to dynamically set HTTP Header in Apache 2.2?

Seems like this should be easy, but I cannot figure out the syntax. In Apache, I want to use the value of an existing request header to set a new request header. Some simple non-working code that ...
4
votes
1answer
3k views

Is this a proper Content-Type header?

I have a pretty good understanding of the Content-Type header for most cases. I understand that for the following four examples, you would normally follow the MIME-type with charset=your-charset-here. ...
1
vote
3answers
12k views

Remove X-Forwarded-For header in Squid 3.0

Some months ago I was working with Squid 3.0 and managed to get rid of the X-Forwarded-For header completely. Now I am trying to do the same thing but I do not seem to hit the nail. I have tried ...
2
votes
1answer
1k views

ngrep - possible to hide payloads?

I use ngrep a lot to inspect HTTP headers to see what's going on. I use the -q flag for quiet output, but I really don't want to see the payloads, only the headers. Is there a way to do this? My ...
5
votes
3answers
225 views

What is the best way to move site to new domain without losing google page rank

Hello I just bought new domain for my web page. Is it good to use php redirection to the new domain and what are the exact headers that I must send to google bot to just renew the address and keep the ...
5
votes
3answers
2k views

Incorrect gzipping of http requests, can't find who's doing it

We're seeing some very strange mangling of HTTP responses, and we can't figure out what is doing it. We have an app server handling JSON requests. Occasionally, the response is returned gzipped, but ...
0
votes
2answers
148 views

Apache Prepending Header Information to ALL FILES

We're in the middle of setting up new servers, and have been having some odd problems with Apache. Apache is prepending text that looks like this: $15plðI‚‚�E�ðA™@�@��yeÔ|~Ÿ²�PγZ" zS€�8i³�� ...
0
votes
1answer
2k views

retrieve file size from HTTP headers without downloading the file with CURL (no HEAD)

What i want to do is knowa file size and not download it. I've tried it with HEAD but the server doesn't respond curl_setopt($curl, CURLOPT_NOBODY, true); if i quit this , it will , but it will ...