HTTP header fields are components of the message header of requests and responses in the Hypertext Transfer Protocol (HTTP). They define the operating parameters of an HTTP transaction.

learn more… | top users | synonyms

22
votes
3answers
23k views

nginx real_ip_header and X-Forwarded-For seems wrong

The wikipedia description of the HTTP header X-Forwarded-For is: X-Forwarded-For: client1, proxy1, proxy2, ... The nginx documentation for the directive real_ip_header reads, in part: This ...
37
votes
5answers
55k views

How to remove IIS/ASP.NET Response Headers

I have a couple IIS/6.0 servers that security is asking me to remove a couple of response headers that are sent to client browsers on requests. They are concerned about divulging platform information ...
2
votes
2answers
904 views

Apache HSTS exception for some virtual hosts

In the global config section for Apache 2.2.15, I have the following (per recommendation) <IfModule mod_headers.c> Header add Strict-Transport-Security "max-age=15768000;includeSubDomains" ...
2
votes
1answer
332 views

Why does this HTTP header configuration cause browsers to always perform If-Modified-Since requests?

On our server, we have configured http response headers as follows: Cache-Control:max-age=28800, must-revalidate # (8 hours) Connection:Keep-Alive Date:Wed, 24 Apr 2013 21:36:19 GMT ...
6
votes
1answer
3k views

add_header directives in location overwriting add_header directives in server

Using nginx 1.2.1 I am able to add multiple headers using add_header as follows: server { listen 80; server_name localhost; root /var/www; add_header Name1 Value1; <=== ...
3
votes
2answers
1k views

In Nginx, block user based on X header value

I have 6 Nginx servers behind load balancer. Of course, if I just try to "deny" based on IP address it does not work as the app servers just see the load balancer IP. However, I learned about the ...
3
votes
2answers
5k views

How to filter Varnish logs based on XID?

I'm running into infrequent 503 errors which appear hard to pinpoint. Varnishlog is driving me mad, since I can't seem to get the information I want out of it. I'd like to see both the client- and ...
6
votes
1answer
4k views

Nginx : strip header on HTTP, add header on HTTPS

I'm configuring an Nginx server so as to serve as a reverse proxy to serve a Django app (run on Gunicorn). My problem is that I want my site secured with HTTPS, and so I want my Django app to be able ...
4
votes
3answers
2k views

Is it possible to route requests to different applications via Content-Type?

I'm designing a JSON API, and I'd like to version the API using content negotiation of some kind. I'm currently planning on using Vendor MIME Types to do this. While I can definitely do this at the ...
2
votes
3answers
2k views

How do I add no-cache headers to all 404 pages served by apache and nginx?

I have recently run into an issue after switching to Cloudflare, and the solution is to basically stop Cloudflare from caching 404 responses. In our load-balanced multi-server setup, occasional 404s ...
1
vote
1answer
114 views

Apache 2.4.16 Response Header value clipped

Problem: The value of a Response Header is greater than 8K and always clipped. Server Config: Apache 2.4.16-x64 with mod_proxy and mod_proxy_http / Running on Windows Server 2012 Httpd.conf: ...
2
votes
1answer
1k views

LiteSpeed enable Access-Control-Allow-Origin (no response header on CORS request)

Seriously, I can't find a single page discussing this for litespeed. Using this format in the htaccess "Header set Access-Control-Allow-Origin http://aSite.com" (and https) sends the setting in the ...
2
votes
1answer
3k views

Set Server response header in IIS7

Is it possible in IIS7, without using URL Scan to remove the Server in the response header? I have tried the following: HttpModule I've installed a signed one into the GAC and also tried the ...
1
vote
3answers
951 views

Use apache to strip off a URL param and add it as a custom HTTP header on a redirect

Let's say my browser issues a request to http://localhost/accounts?memberUuid=<some uuid> I'd like apache2 to pickup that request, add a custom HTTP header with the uuid in it, strip the uuid ...
1
vote
3answers
11k views

Remove X-Forwarded-For header in Squid 3.0

Some months ago I was working with Squid 3.0 and managed to get rid of the X-Forwarded-For header completely. Now I am trying to do the same thing but I do not seem to hit the nail. I have tried ...
-1
votes
1answer
376 views

Debug Nginx caching

I want to determine when I am getting cache hits or misses. Preferably, this would be a header, like X-Cache: HIT or X-Cache: MISS How can I do this with Nginx (a reverse proxy for the upstream ...
-1
votes
1answer
77 views

Apache configuration redirect using only redirect, not rewrite

PS: this is the 2nd part of the question originally posted here. I'd like to disable the HSTS header completely for specific virtual hosts. I have (per recommendation) a redirect in the 443 container ...