HTTP header fields are components of the message header of requests and responses in the Hypertext Transfer Protocol (HTTP). They define the operating parameters of an HTTP transaction.

learn more… | top users | synonyms

0
votes
0answers
11 views

Why does NGinx send content in a HTTP 304 response when If-None-Match / If-Modified-Since is a match?

My default NGinx installation is returning a 304 Not Modified response to a request which has a matching If-None-Match header and a non-expired If-Modified-Since header which is correct behaviour but ...
2
votes
1answer
273 views

Access-Control-Allow-Origin header missing from a response

I'm trying to debug an issue. On one of my sites, the font files are not loading correctly. Someone has reported this error in the inspector log: Font from origin 'http://d1h0r2f9g9fk4d.cloudfront....
-1
votes
0answers
17 views

Finding location of data centers [on hold]

I have a list of applications for which i need to find their actual data center location, we can check it manually through checkhost.net but I want to check after load blancer from where the actual ...
2
votes
1answer
1k views

How to remove “Client-Peer” (etc) header in nginx with php-fastcgi

My setup: OS: Ubuntu 11.04 HTTP Server: nginx 1.2.1 compiled with the HttpHeadersMore module processing PHP via php-fastcgi (other irrelevant software - ruby, python, etc) My problem: I'm ...
1
vote
1answer
48 views

Varnish not working with last-modified

I'm new to Varnish and to reverse proxies in general. I'm testing Varnish in an application that works like a blog where I have a page with an "updated_at" that changes once the page is updated. As a ...
1
vote
1answer
236 views

How to pass GeoIP HTTP request headers to backend with Apache?

I am using nginx to proxy HTTP requests to a PHP application running in the scope of Apache 2.4 (mod_php5) within a Docker container (cbeer/piwik). +------------------------------...
2
votes
2answers
26 views

Nginx reverse proxy pass through client certificate

I'm trying to set up a load balancer via an Nginx reverse proxy. My application uses client certificates to authenticate clients. I would like my reverse proxy to forward the client certificate to my ...
0
votes
2answers
580 views

Remove server header from IIS 8.5

I have IIS 8.5 installed on my Windows server 2012 R2. I am trying to remove the Server: Microsoft-IIS/8.5 header from my responses. I tried installed URLScan but it fails to install with the ...
0
votes
2answers
18 views

Can I use Public-Key-Pins with LetsEncrypt?

Can I setup Public-Key-Pins when I setup a cronjob to renew the LetsEncrypt certificate every 30 days? If the certificate is renewed then the Public-Key-Pin is also renewed right?
2
votes
1answer
1k views

Apache: Force HTTP 1.1 or Persistent/KeepAlive connections for HTTP 1.0 requests

I want to force Keep Alive or Persistent connections for all HTTP requests on my Apache 2.2.3 server running on RHEL 5.8. A lot of web crawlers are using HTTP 1.0 for some reason, and I would like to ...
-2
votes
0answers
14 views

Cahce a page in Apache

I need help with how to cache a page that have the string "Cache-Control: public" in the header. I do not see any specific directive in the documentation on how to do this. I am thinking I have to ...
3
votes
4answers
2k views

nginx is cutting the end of dynamic pages and caching them

I moved one of my old sites from an Apache to an nginx server. Everything is working fine but the site has some long content (a +100k generated HTML file). My first trial was to disable chunked ...
6
votes
1answer
1k views

How can the x-frame-options HTTP header of ADFS 3 be manipulated?

By default, ADFS 3 responses contain the "X-Frame-Options: DENY" HTTP header. This prevents ADFS from being run in an iframe, because this presents an opportunity for clickjacking attacks. At the ...
0
votes
1answer
3k views

Update Cache-Control max-age when srcache returns response from cache

I have configured Nginx to use srcache (along with the redis and redis2 modules). Server-side caching works great. My application responds with the appropriate Expires and Cache-Control headers, and ...
0
votes
1answer
39 views

Passing Authorization Basic Headers Along in Proxy

I am currently trying to get a reverse/forward proxy to pass along the authorization headers to the target server. How would I go abou this? I have already looked at the below sources, and one of the ...
14
votes
4answers
26k views

How can I make nginx support @font-face formats and allow access-control-allow-origin?

I've added these rules to mime.types: application/x-font-ttf ttf; font/opentype otf; application/vnd.ms-fontobject eot; font/x-woff ...
2
votes
0answers
31 views

HAProxy, why would a replaced HTTP header have a number at the end?

Can someone explain what the "X-Forwarded-Proto2" header is in this HAProxy frontend stanza?: frontend main *:443 ... reqirep ^(X-Forwarded-Proto:)(.*) X-Forwarded-Proto2:\2 ... I understand ...
1
vote
1answer
47 views

Inconsistent cache and expires headers (pragma:nocache)

I was trying to get my Apache Server (v2.4.7) to respond to an If-Modified-Since header sent by browsers and spiders like Google. I found this on a recommendation on Google Webmaster. I never knew ...
0
votes
2answers
40 views

How do i configure nginx to use part of a URL as a header?

I am trying to get a server application running which supports multiple customers. They should each access the app with their own URL, e.g. http://localhost:8082/customer1/config, but the application ...
0
votes
0answers
11 views

Apache Revese Proxy is not cached

I have the below config so all requests to /j/* will be proxied, however why not being cached as told ? Its on windows 2012 and apache 2.4.20 . Thanks ProxyPassMatch "^/j/(.*)$" "http://192.168.1.121/...
1
vote
1answer
36 views

How is Cache-Control: max-age affected by intermediate caching?

I am currently serving an HTML page to users with a Cache-Control: max-age=600 header. I believe this allows the users' browsers to cache the page for a maximum of 10 minutes. I am considering adding ...
1
vote
1answer
114 views

Nginx - Wrong Response Header

when installing joomla I face an issue realated to response header. During the installation process, an ajax post request send to server which in response status is 303 instead of 200 ! so ajax ...
0
votes
1answer
26 views

<RequireAll> / Require expr equivalent in Apache 2.2.22 to check for headers?

I use the following Apache config to to check for certain headers in my requests: <LocationMatch /test-headers/> <RequireAll> Require expr %{HTTP:header1} == 'abc' ...
0
votes
1answer
26 views

Non proxy aware client, (mitm)proxy modification of headers

What I am trying to achive Pulling data, using a SaaS service, from a remote site with a simple GET request to mitmproxy. The SaaS service is not proxy aware. I want the SaaS web client to do a GET ...
0
votes
0answers
82 views

no apache http headers with php5-fpm

I've migrated from standard fastCGI to php5-fpm. Now all headers that are set via Apache (mod_expires, mod_header, and so on) are being discarded (or not set, resp.). For example, I need to parse ...
0
votes
0answers
75 views

Apache Doesn't Unset Headers

We have apache 2.4 with the headers mod enabled. We have two identical VirtualHosts, but the X-Frame-Options header gets set for one site and not the other when unconfigured (tested on both Chrome and ...
1
vote
0answers
32 views

Cookie Secure Flag not persistent

I'm trying to implement a Secure flag for all cookies. I'm doing this via Headers. Here's how I did it: Header edit Set-Cookie (?i)^(.*)(;\s*secure)??((\s*;)?(.*)) "$1; Secure$3$4" It ...
3
votes
2answers
7k views

How do I set proper Headers for JSON in Apache?

I have an Apache server which is serving out static JSON files. The Content Type is correctly being represented in the header with an Content-Type: application/json header. How do I add the correct ...
2
votes
1answer
69 views

Custom headers (mod_headers) not showing in combination with mod_rewrite

I have a vhost with multiple domainnames linked to it. I'm trying to send additional headers when a request is made to one particular domainname. Here's what I'm doing (tried both in the vhost as in ....
1
vote
0answers
56 views

nginx is ignoring root location header (location /)

I have self-compiled nginx 1.9.14 with http2 support: nginx version: nginx/1.9.14 built by gcc 4.9.2 (Debian 4.9.2-10) built with OpenSSL 1.0.1k 8 Jan 2015 TLS SNI support enabled So I have a ...
2
votes
0answers
141 views

HSTS exclude specific subdomain with “includeSubdomains”

I'm using HSTS with this header on my website: Strict-Transport-Security: max-age=15768000; includeSubDomains This works as intended and forces the browser to redirect all http connections to ...
1
vote
1answer
43 views

500 Error: “End of script output before headers” - Simple script within Wordpress theme

I have a multi-site install of Wordpress running fine on a unmanaged CentOS server, however for a certain feature I need to do my own thing on certain pages and manually interact with some non-...
0
votes
1answer
21 views

Apache 'always set' headers removed if mod_expires ExpiresActive On

I have a following directives in my virtual host: Header always set Strict-Transport-Security "max-age=157700000;" Header always set ThisIsATestHeader "This is removed when ever ExpiresActive is on" ...
0
votes
1answer
23 views

Proxy to add CORS headers with netcat

I'm looking for a little script using nc which will be used to add CORS headers (at least Access-Control-Allow-Origin: *) in order for my local ionic dev application to access a remote webservice.
1
vote
0answers
64 views

Very long useragent

We have requests in our server log with a very long useragent: HEADER: user-agent=Mozilla/5.0 (Windows NT 6.1; WOW64; rv:32.0; WUID=4bddaa48430e60af6132822cd6fab6c4; WTB=2873; WUID=...
1
vote
0answers
274 views

How do I allow users to override X-Frame-Options when using Apache + PHP-FPM?

I have an Ubuntu 14.04 server running Apache + PHP-FPM + FastCGI, serving user home pages. For security, I have enabled in Apache's configuration: Header set X-Content-Type-Options: "nosniff" Header ...
1
vote
0answers
19 views

Negative impact of setting Apache's LimitRequestFieldSize very high?

On apache httpd 2.2, I would like to increase the value of LimitRequestFieldSize to 48k or maybe even 65k. Has anyone experience with setting the value of LimitRequestFieldSize to such high values? ...
0
votes
0answers
131 views

Configure Apache DirectorySlash to honor X-Forwarded-Host set by load balancer

Is there a way to configure the DirectorySlash behavior of Apache to honor the X-Forwarded-Host header set by a load balancer? For example, assume my load balancer host is example.com but it forwards ...
12
votes
5answers
12k views

Referer is passed from HTTPS to HTTP in some cases… How?

In theory browsers do not pass on referer information from HTTPS to HTTP sites. And in my experience this has always been true. But I just found an exception, and I want to understand why it works so ...
0
votes
1answer
37 views

Content security policy: blocked uri “about”

I am implementing Content security policy to my website headers. I currently have it on report-only setting for testing. My server is Apache 2.4.7. After setting up some policies I keep seeing ...
0
votes
1answer
67 views

Haproxy rules(set-header) not working and it's not changing base url of request

I am trying to integrate cloud foundry adminui application. Url which I access is https://myexample.com/adminui/ It works as follows: Request https://myexample.com/adminui/ Response ...
1
vote
0answers
64 views

ColdFusion fails to include custom HTTP response header set in IIS 8.5

I have a Windows 2012 R2 server running IIS 8.5 and ColdFusion 11. Under a specific directory ("mydirectory") I added an HTTP Response Header (Name: X-ResponseHeader, Value: Test). The resulting web....
2
votes
1answer
144 views

php file downloads instead of being processed with ajax on apache

I have a small website where some content is displayed within a HTML tag using AJAX. The content is simply taken from another page on the same web site. However, sometimes instead of loading the ...
-1
votes
2answers
1k views

Apache doesn't send me an MP3 header even when I use a direct address to the file

Apache doesn't send me an MP3 header even when using a direct address to the file. It means I can play it with Flash audio players on my web pages, but when I tried to download from the direct address ...
0
votes
1answer
327 views

Suppress PHP Headers running cgi PHP from Ruby

I originally posted this on StackOverflow and it was suggested that I try posting this here because, "It might be something like the configuration in CGI is different than the configuration for your ...
0
votes
1answer
172 views

re-direct SSL pages using header statement based on port

I found this in the header.php file of a e-commerce site. Is this better done in a .htaccess file. Also what would happen to any post parameters that get caught in the header statement. // flip ...
2
votes
1answer
141 views

My Apache 2.2 local test server with php none cgi automaticly removes logged in ipad users

My Local httpd Apache 2.2 test server with php installed is having problems with a ipad user. I have scripted a loggin script that uses php sessions to keep them loggedin, the page has a javascript ...
0
votes
2answers
350 views

Remove X-Powered-By: PHP on IIS7

We have a Win2008 server running IIS7 and php 5.3.17 installed. For pentesting & other security purposes we would like to remove the header response: "X-Powered-By: PHP/5.3.17", so we've tried ...
23
votes
5answers
28k views

How to dump entire HTTP requests with apache

Is it possible to dump entire HTTP requests by apache? I need to track all HTTP headers of incomming requests. How to do that?