HTTP header fields are components of the message header of requests and responses in the Hypertext Transfer Protocol (HTTP). They define the operating parameters of an HTTP transaction.

learn more… | top users | synonyms

0
votes
1answer
26 views

Content-Type not being set for jpg, but is being sent for png. How do I check Apache config?

This is weird. I have an image resizing script on my Apache server. It's outputting PNG files and JPG files. They display images fine in the browser. However, the Content-Type isn't being set for ...
0
votes
2answers
40 views

Programmatically set HTTP response header

I have some web pages that will respond differently based on the request from the client. Anything from a 200 to a 301 to a 404 and so on. I used to do this with Apache and CGI by just sending it in ...
2
votes
1answer
1k views

How to remove “Client-Peer” (etc) header in nginx with php-fastcgi

My setup: OS: Ubuntu 11.04 HTTP Server: nginx 1.2.1 compiled with the HttpHeadersMore module processing PHP via php-fastcgi (other irrelevant software - ruby, python, etc) My problem: I'm ...
0
votes
0answers
8 views

Passing Authorization Basic Headers Along in Proxy

I am currently trying to get a reverse/forward proxy to pass along the authorization headers to the target server. How would I go abou this? I have already looked at the below sources, and one of the ...
14
votes
4answers
26k views

How can I make nginx support @font-face formats and allow access-control-allow-origin?

I've added these rules to mime.types: application/x-font-ttf ttf; font/opentype otf; application/vnd.ms-fontobject eot; font/x-woff ...
2
votes
0answers
28 views

HAProxy, why would a replaced HTTP header have a number at the end?

Can someone explain what the "X-Forwarded-Proto2" header is in this HAProxy frontend stanza?: frontend main *:443 ... reqirep ^(X-Forwarded-Proto:)(.*) X-Forwarded-Proto2:\2 ... I understand ...
6
votes
1answer
1k views

How can the x-frame-options HTTP header of ADFS 3 be manipulated?

By default, ADFS 3 responses contain the "X-Frame-Options: DENY" HTTP header. This prevents ADFS from being run in an iframe, because this presents an opportunity for clickjacking attacks. At the ...
1
vote
1answer
32 views

Inconsistent cache and expires headers (pragma:nocache)

I was trying to get my Apache Server (v2.4.7) to respond to an If-Modified-Since header sent by browsers and spiders like Google. I found this on a recommendation on Google Webmaster. I never knew ...
2
votes
1answer
1k views

Apache: Force HTTP 1.1 or Persistent/KeepAlive connections for HTTP 1.0 requests

I want to force Keep Alive or Persistent connections for all HTTP requests on my Apache 2.2.3 server running on RHEL 5.8. A lot of web crawlers are using HTTP 1.0 for some reason, and I would like to ...
0
votes
1answer
2k views

Update Cache-Control max-age when srcache returns response from cache

I have configured Nginx to use srcache (along with the redis and redis2 modules). Server-side caching works great. My application responds with the appropriate Expires and Cache-Control headers, and ...
0
votes
2answers
39 views

How do i configure nginx to use part of a URL as a header?

I am trying to get a server application running which supports multiple customers. They should each access the app with their own URL, e.g. http://localhost:8082/customer1/config, but the application ...
0
votes
0answers
11 views

Apache Revese Proxy is not cached

I have the below config so all requests to /j/* will be proxied, however why not being cached as told ? Its on windows 2012 and apache 2.4.20 . Thanks ProxyPassMatch "^/j/(.*)$" "http://192.168.1.121/...
1
vote
1answer
31 views

How is Cache-Control: max-age affected by intermediate caching?

I am currently serving an HTML page to users with a Cache-Control: max-age=600 header. I believe this allows the users' browsers to cache the page for a maximum of 10 minutes. I am considering adding ...
0
votes
1answer
444 views

Remove server header from IIS 8.5

I have IIS 8.5 installed on my Windows server 2012 R2. I am trying to remove the Server: Microsoft-IIS/8.5 header from my responses. I tried installed URLScan but it fails to install with the ...
1
vote
1answer
91 views

Nginx - Wrong Response Header

when installing joomla I face an issue realated to response header. During the installation process, an ajax post request send to server which in response status is 303 instead of 200 ! so ajax ...
0
votes
1answer
15 views

<RequireAll> / Require expr equivalent in Apache 2.2.22 to check for headers?

I use the following Apache config to to check for certain headers in my requests: <LocationMatch /test-headers/> <RequireAll> Require expr %{HTTP:header1} == 'abc' ...
0
votes
1answer
23 views

Non proxy aware client, (mitm)proxy modification of headers

What I am trying to achive Pulling data, using a SaaS service, from a remote site with a simple GET request to mitmproxy. The SaaS service is not proxy aware. I want the SaaS web client to do a GET ...
0
votes
0answers
66 views

no apache http headers with php5-fpm

I've migrated from standard fastCGI to php5-fpm. Now all headers that are set via Apache (mod_expires, mod_header, and so on) are being discarded (or not set, resp.). For example, I need to parse ...
0
votes
0answers
27 views

Apache Doesn't Unset Headers

We have apache 2.4 with the headers mod enabled. We have two identical VirtualHosts, but the X-Frame-Options header gets set for one site and not the other when unconfigured (tested on both Chrome and ...
1
vote
0answers
24 views

Cookie Secure Flag not persistent

I'm trying to implement a Secure flag for all cookies. I'm doing this via Headers. Here's how I did it: Header edit Set-Cookie (?i)^(.*)(;\s*secure)??((\s*;)?(.*)) "$1; Secure$3$4" It ...
3
votes
2answers
7k views

How do I set proper Headers for JSON in Apache?

I have an Apache server which is serving out static JSON files. The Content Type is correctly being represented in the header with an Content-Type: application/json header. How do I add the correct ...
2
votes
1answer
55 views

Custom headers (mod_headers) not showing in combination with mod_rewrite

I have a vhost with multiple domainnames linked to it. I'm trying to send additional headers when a request is made to one particular domainname. Here's what I'm doing (tried both in the vhost as in ....
1
vote
0answers
49 views

nginx is ignoring root location header (location /)

I have self-compiled nginx 1.9.14 with http2 support: nginx version: nginx/1.9.14 built by gcc 4.9.2 (Debian 4.9.2-10) built with OpenSSL 1.0.1k 8 Jan 2015 TLS SNI support enabled So I have a ...
2
votes
0answers
98 views

HSTS exclude specific subdomain with “includeSubdomains”

I'm using HSTS with this header on my website: Strict-Transport-Security: max-age=15768000; includeSubDomains This works as intended and forces the browser to redirect all http connections to ...
1
vote
1answer
32 views

500 Error: “End of script output before headers” - Simple script within Wordpress theme

I have a multi-site install of Wordpress running fine on a unmanaged CentOS server, however for a certain feature I need to do my own thing on certain pages and manually interact with some non-...
0
votes
1answer
18 views

Apache 'always set' headers removed if mod_expires ExpiresActive On

I have a following directives in my virtual host: Header always set Strict-Transport-Security "max-age=157700000;" Header always set ThisIsATestHeader "This is removed when ever ExpiresActive is on" ...
0
votes
1answer
22 views

Proxy to add CORS headers with netcat

I'm looking for a little script using nc which will be used to add CORS headers (at least Access-Control-Allow-Origin: *) in order for my local ionic dev application to access a remote webservice.
1
vote
0answers
62 views

Very long useragent

We have requests in our server log with a very long useragent: HEADER: user-agent=Mozilla/5.0 (Windows NT 6.1; WOW64; rv:32.0; WUID=4bddaa48430e60af6132822cd6fab6c4; WTB=2873; WUID=...
1
vote
0answers
197 views

How do I allow users to override X-Frame-Options when using Apache + PHP-FPM?

I have an Ubuntu 14.04 server running Apache + PHP-FPM + FastCGI, serving user home pages. For security, I have enabled in Apache's configuration: Header set X-Content-Type-Options: "nosniff" Header ...
1
vote
0answers
15 views

Negative impact of setting Apache's LimitRequestFieldSize very high?

On apache httpd 2.2, I would like to increase the value of LimitRequestFieldSize to 48k or maybe even 65k. Has anyone experience with setting the value of LimitRequestFieldSize to such high values? ...
0
votes
0answers
101 views

Configure Apache DirectorySlash to honor X-Forwarded-Host set by load balancer

Is there a way to configure the DirectorySlash behavior of Apache to honor the X-Forwarded-Host header set by a load balancer? For example, assume my load balancer host is example.com but it forwards ...
12
votes
5answers
11k views

Referer is passed from HTTPS to HTTP in some cases… How?

In theory browsers do not pass on referer information from HTTPS to HTTP sites. And in my experience this has always been true. But I just found an exception, and I want to understand why it works so ...
0
votes
1answer
33 views

Content security policy: blocked uri “about”

I am implementing Content security policy to my website headers. I currently have it on report-only setting for testing. My server is Apache 2.4.7. After setting up some policies I keep seeing ...
3
votes
3answers
2k views

nginx is cutting the end of dynamic pages and caching them

I moved one of my old sites from an Apache to an nginx server. Everything is working fine but the site has some long content (a +100k generated HTML file). My first trial was to disable chunked ...
0
votes
1answer
56 views

Haproxy rules(set-header) not working and it's not changing base url of request

I am trying to integrate cloud foundry adminui application. Url which I access is https://myexample.com/adminui/ It works as follows: Request https://myexample.com/adminui/ Response ...
1
vote
0answers
50 views

ColdFusion fails to include custom HTTP response header set in IIS 8.5

I have a Windows 2012 R2 server running IIS 8.5 and ColdFusion 11. Under a specific directory ("mydirectory") I added an HTTP Response Header (Name: X-ResponseHeader, Value: Test). The resulting web....
2
votes
1answer
144 views

php file downloads instead of being processed with ajax on apache

I have a small website where some content is displayed within a HTML tag using AJAX. The content is simply taken from another page on the same web site. However, sometimes instead of loading the ...
-1
votes
2answers
991 views

Apache doesn't send me an MP3 header even when I use a direct address to the file

Apache doesn't send me an MP3 header even when using a direct address to the file. It means I can play it with Flash audio players on my web pages, but when I tried to download from the direct address ...
0
votes
1answer
324 views

Suppress PHP Headers running cgi PHP from Ruby

I originally posted this on StackOverflow and it was suggested that I try posting this here because, "It might be something like the configuration in CGI is different than the configuration for your ...
0
votes
1answer
172 views

re-direct SSL pages using header statement based on port

I found this in the header.php file of a e-commerce site. Is this better done in a .htaccess file. Also what would happen to any post parameters that get caught in the header statement. // flip ...
2
votes
1answer
141 views

My Apache 2.2 local test server with php none cgi automaticly removes logged in ipad users

My Local httpd Apache 2.2 test server with php installed is having problems with a ipad user. I have scripted a loggin script that uses php sessions to keep them loggedin, the page has a javascript ...
0
votes
2answers
335 views

Remove X-Powered-By: PHP on IIS7

We have a Win2008 server running IIS7 and php 5.3.17 installed. For pentesting & other security purposes we would like to remove the header response: "X-Powered-By: PHP/5.3.17", so we've tried ...
23
votes
5answers
27k views

How to dump entire HTTP requests with apache

Is it possible to dump entire HTTP requests by apache? I need to track all HTTP headers of incomming requests. How to do that?
3
votes
2answers
3k views

File Specific cache http header for IIS 6

Is there a way to set cache related header for a specific file type in II6? We want to turn off cache on all our *.js and *.css file here, but IIS6 is forcing us to do a all or nothing approach.
3
votes
2answers
3k views

Sending machine hostname as a header in Apache

I have a group of linux apache 1.3 servers behind a load balancer, and I want to be able to, at a glance, determine which server I'm hitting. The load balancer is severely limited in its monitoring ...
2
votes
1answer
2k views

Disable User-Agent based Vary header response in nginx?

It seems that nginx includes a Vary: Accept-Encoding header in some cases regardless of the file types I specify via "gzip_types". I do not have much experience with nginx. Does it in fact send Vary: ...
1
vote
1answer
2k views

Should I use Expires headers, Cache-Control headers, or both?

Just trying to do a bit of performance tuning on a client's site. I don't want to set far future expiries yet, because we are still changing a lot of stuff regularly, but I'd like to give everything ...
1
vote
1answer
9k views

How to dynamically set HTTP Header in Apache 2.2?

Seems like this should be easy, but I cannot figure out the syntax. In Apache, I want to use the value of an existing request header to set a new request header. Some simple non-working code that ...
4
votes
1answer
3k views

Is this a proper Content-Type header?

I have a pretty good understanding of the Content-Type header for most cases. I understand that for the following four examples, you would normally follow the MIME-type with charset=your-charset-here. ...