HTTP header fields are components of the message header of requests and responses in the Hypertext Transfer Protocol (HTTP). They define the operating parameters of an HTTP transaction.

learn more… | top users | synonyms

0
votes
1answer
30 views

mod_expires doesn't set expiry for images (png,jpeg,gif)

I am using this below configuration in my apache2.conf <IfModule mod_expires.c> ExpiresActive On ExpiresByType image/gif "access plus 6 month" ExpiresByType image/jpg "access plus 6 ...
0
votes
1answer
56 views

Update Cache-Control max-age when srcache returns response from cache

I have configured Nginx to use srcache (along with the redis and redis2 modules). Server-side caching works great. My application responds with the appropriate Expires and Cache-Control headers, and ...
0
votes
2answers
2k views

how do I setup Apache's Content-Encoding Header?

When attempting to validate my site with the W3C validator, it returns the error, "Don't know how to decode Content-Encoding 'none'". Firebug confirms that my server is sending the header, ...
0
votes
1answer
12 views

What is expected behaviour from Server returning Http 416

I have a server and sometimes when client ask for a file and if its request header Range may get over the length of file, so the server returns 416 status code. But I'm wondering should it write file ...
0
votes
1answer
56 views

Inconsistent behavior with Nginx's auth_request_set and more_set_input_headers

I'm trying to use the auth_request module in conjunction with the more_set_input_headers to automatically login my users into web apps. Basically, it works like this: Users have some session cookie ...
0
votes
2answers
56 views

nginx - Change error_page based on proxy_pass response

Is it possible to change the fallback error_page based on the response of the upstream proxy? upstream serverA { server servera.com; } upstream serverB { server serverb.com; } location / { ...
0
votes
0answers
31 views

Apache not return allow header in OPTIONS method

I try to get allow header form apache server. I sended request with curl. The server return headers but not "header allow" header: $ curl -v -X OPTIONS 10.0.0.1 * Rebuilt URL to: 10.0.0.1/ * Hostname ...
0
votes
0answers
22 views

How to change http header using nginx

We have a problem that a backend system requires the parameters of the Content-Type http header to be in a certain order. For example (note the position of the type="text/xml"): Content-Type: ...
1
vote
3answers
5k views

Remove X-Forwarded-For header in Squid 3.0

Some months ago I was working with Squid 3.0 and managed to get rid of the X-Forwarded-For header completely. Now I am trying to do the same thing but I do not seem to hit the nail. I have tried ...
7
votes
3answers
178 views

What's wrong with this HTTP POST request?

I'm trying to fuzz a server using the Sulley fuzzing framework. I observe the following stream in Wireshark. The error talks about a problem with JSON parsing, however, when I try the same HTTP POST ...
0
votes
1answer
635 views

Web server serves up PDF file as wrong mime type

Following an upgrade to the latest version of Joomla, downloads from a website I am working on are being served incorrectly. Example page: ...
0
votes
1answer
85 views

How to configure nginx so it works with Express?

I'm trying to configure nginx so it proxy_pass requests to my node apps. Question on StackOverflow got many upvotes: http://stackoverflow.com/questions/5009324/node-js-nginx-and-now and I'm using ...
0
votes
0answers
24 views

google webmaster soft 404 on 301

I'm looking through google webmaster that my page is generating soft 404 errors (https://support.google.com/webmasters/answer/181708?hl=en) google says: We recommend that you always return a 404 (Not ...
0
votes
0answers
19 views

How to set header for non-self-referencing URI in Apache?

I have to cache web pages with URL path teacher and student like so: <LocationMatch "^/(teacher|student)/"> Header set Cache-Control "private, max-age=60" </LocationMatch> However, ...
-1
votes
2answers
60 views

Apache - force set 304 status for all images

Is it possible to force set HTTP 304 status for all images? I wrote code below in my vhost, but now instead 404/304 status I get 500 <filesMatch "\.(ico|gif|jpg|png|jpeg)$"> Header set 304 ...
-2
votes
1answer
99 views

How to run a website domain without redirecting if IP is already used for another website? [duplicate]

I bought a VPS Host that gave me only 1 IP Address which I used on my first domain name and it works without any problems. Now my second domain name I can't use the same ip address as it points to ...
1
vote
1answer
524 views

Load Balancing with haproxy and http-send-name-header Host

I ran into the following problem: tldr; When dynamically rewriting the HTTP Host header with http-send-name-header Host haproxy seems to mess up HTTP Response headers. Doing so works fine when using ...
1
vote
1answer
201 views

Add a custom header to ProxyPass requests

I have a simple apache vhost: <VirtualHost *:80> ServerName hello.local ProxyPass / http://localhost:8810/ ProxyPassReverse / http://localhost:8810/ </VirtualHost> All request to ...
1
vote
2answers
5k views

why i cannot download jdk from oracle web site directly without AuthParam?

that is download with the following command, why it fails to download that file? wget http://download.oracle.com/otn-pub/java/jdk/6u35-b10/jdk-6u35-linux-i586.bin the following command works, but ...
0
votes
1answer
165 views

Apache: Force HTTP 1.1 or Persistent/KeepAlive connections for HTTP 1.0 requests

I want to force Keep Alive or Persistent connections for all HTTP requests on my Apache 2.2.3 server running on RHEL 5.8. A lot of web crawlers are using HTTP 1.0 for some reason, and I would like to ...
0
votes
1answer
64 views

Using Apache variable

I'm trying to use Apache's OpenID authentication module. According to this page, I should be able to use the REMOTE_USER Apache variable to identify the user. I'd like to pass this as a header to an ...
2
votes
2answers
2k views

IIS 7.5 Server response headers (UrlScan does not work)

In the past you could use UrlScan by Microsoft to modify the headers and remove the one's displaying IIS version for example. This does not work for IIS 7.5 and IIS 7.0 is the latest version ...
0
votes
2answers
132 views

NGINX is not forwarding a header value when using proxy_pass

I have the following setup and configured to send all /api requests to a different server: location /api { proxy_pass https://myapp.herokuapp.com; rewrite ...
0
votes
1answer
142 views

nginx proxy_pass receive content/status headers when http 4xx

Was having some trouble as chronicled here - http://stackoverflow.com/questions/22570550/play-2-2-1-simpleresult-4xx-response-body-possible-via-cors-xhr But I didn't focus on nginx since the 200 OK ...
0
votes
1answer
59 views

Nginx using mysql result as variable to be used in headers more module

Without going into too much detail we have a requirement for the following: a) Query a simple single column, single row result from mysql. b) Use this variable as part of a more headers module, ...
1
vote
0answers
48 views

Can not I properly configure expires headers for apache

I am trying to configure caching for static js/css/img on apache2 (I am using ubuntu). I do not want to use .htaccess due to this answer. So I tried the following: enabled modexpires modified ...
0
votes
1answer
288 views

How do I set proper Headers for JSON in Apache?

I have an Apache server which is serving out static JSON files. The Content Type is correctly being represented in the header with an Content-Type: application/json header. How do I add the correct ...
1
vote
1answer
155 views

Nginx: How to set expiration for 404 responses?

My nginx server acts as a proxy for another server, which sometimes returns 404s. I want the 404 responses to be cacheable, just like 200 responses. However, I cannot use expires, because the ...
0
votes
1answer
126 views

Add custom headers to HTTP 401 responses from Kerberos mod_auth_kerb

I'm using Apache with mod_auth_kerb to perform HTTP authentication. How do I add custom headers to the 401 Authorization Required response generated by the auth module? The relevant sections of my ...
16
votes
3answers
762 views

Is there any reason to keep the “Server” response header in Apache

My server responds with Server: Apache/2.2.15 (CentOS) to all requests. I guess that this gives away my server architecture making it easier to hack attempts. Is this ever useful to a web browser? ...
0
votes
1answer
399 views

Nginx $http_x_forwarded_for not always being set

I've noticed in our access logs that sometimes, the $http_x_forwarded_for variable has not been set, and instead, the correct IP is the one set to $remote_addr. Is it possible to set ...
31
votes
4answers
33k views

How to remove IIS/ASP.NET Response Headers

I have a couple IIS/6.0 servers that security is asking me to remove a couple of response headers that are sent to client browsers on requests. They are concerned about divulging platform information ...
0
votes
0answers
55 views

MS TMG - forward original user ip in request

How can we configure our TMG to pass original user's IP in HTTP request? We need it for additional security in application, but we see only TMG's IP. How can we setup X-Forwarded-For or another field? ...
0
votes
1answer
86 views

Issues with authenticating through HTTP POST

I am currently investigating an issue with our web authentication server not working for a small subset of users. Our method of authentication involves sending a hash through an HTTP POST. My ...
0
votes
1answer
252 views

Cache header for dynamically created url

I have a PHP script that generates a thumbnail based on an existing path (more info). The basic idea is this: Given the document root /web/, an image lives in /web/images/foo.jpg. When a predefined ...
1
vote
1answer
27 views

“Connection” HTTP header in load balancers

Do load balancers remove the HTTP header indicated in the "Connection" header? As far as I know, headers indicated in the "Connection" header are not supposed to be populated further than the first ...
2
votes
1answer
109 views

Apache returns 206 for some MP3's

We're trying to serve MP3 files from web1.cowbird.com. Most of the time everything works fine. However, sometimes there's a file that the browser is unable to play, and I have no idea why. Here is an ...
2
votes
2answers
101 views

Rejecting traffic where ACCEPT header is empty on favicon.ico requests

As part of filtering out potential harmful traffic, I currently reject traffic where $_SERVER["HTTP_ACCEPT"] is empty. I notice from my logs that a fair number of requests have been rejected due to ...
1
vote
1answer
155 views

How to get custom WebDAV server working with MS mini-redirector

I wrote a custom WebDAV server that authenticates users from a database and serves a virtual file system based on records from a database. It is working well with 3rd party WebDAV clients but does ...
1
vote
0answers
24 views

Apache configured for HSTS, but SSLLabs/Chrome not acknowledging

I'm setting up a webserver and I've been checking it against SSLLabs and Chrome 31 to make sure the security is up to snuff. However neither Chrome nor SSLLabs seems to believe that strict transport ...
2
votes
0answers
37 views

Strange faulty 16000d response timing in gdevtools for specific XHR

We have some XHR on our website, that is reported in Google developer tools' network timeline as Receiving for 16035.5 days. There actually is a response, and for sure it does not take as long as ...
1
vote
2answers
695 views

Why would PROPFIND and DAV appear in response headers when WebDAV is disabled?

I've got a bit of a challenge I'm hoping someone has some ideas on. I'm in the process of deploying a web app to a shared environment with a host running IIS7.5. A security scan has shown that WebDAV ...
0
votes
3answers
257 views

Apache proxy_http redirect to ip and set hostname

hopefully you guys can help me with a proxy problem I have. What I already have I have set up an apache http reverse proxy, to proxy requests from *.proxy.domain to *.intern.domain. The apache is ...
1
vote
2answers
4k views

Using curl to request URL that redirects to relative URL with anchor tag

I'm using curl to request a URL that redirects to a different URL using a Location: line like: Location:/path/to/resource#name As I understand it, that line in the redirect response is invalid per ...
1
vote
2answers
260 views

Why is SPDY breaking 'Vary: Accept-Encoding' in Nginx 1.4.3?

I've compiled Nginx 1.4.3 from source with the SPDY module. However when SPDY is enabled, it seems to break my 'Vary: Accept-Encoding' header. My Nginx Configuration: ./configure ...
0
votes
3answers
475 views

htaccess filesMatch exclusion

I have the following directive in my htaccess <filesMatch "\.(gif|jpe?g|png|js|css|swf|php|ico|txt|pdf|xml|html?)$"> FileETag None <ifModule mod_headers.c> Header unset ...
0
votes
1answer
185 views

Tell browsers to cache until last modified date changes? [closed]

My web site consists of static HTML files which are usually republished once per day, and sometimes more. I'm using Apache. In the vhost settings for my site, I'd like to tell browsers to cache HTML ...
0
votes
2answers
309 views

Can Squid 2.7 proxy gzipped content

We have a forward proxy for our network which is Squid 2.7. This is managed for us by a third party. We noticed recently that http requests going from our network to the web were having the ...
3
votes
4answers
304 views

Only allow the POST method for a specific file in a directory

I have one file that should only be accessible via the POST method. /var/www/folder/index.php The document root is /var/www/ and index.php is nested inside a folder. Version of Apache is: 2.4.4. ...
2
votes
1answer
273 views

Remove “X-Page-Speed” version from headers in ngx_pagespeed

I have compiled ngx_pagespeed, but forgot to remove the version number. Is there any way to overwrite/delete/hide them? Apache has feature to 'unset' them, but I couldn't find anything similar for ...