HTTP header fields are components of the message header of requests and responses in the Hypertext Transfer Protocol (HTTP). They define the operating parameters of an HTTP transaction.

learn more… | top users | synonyms

32
votes
5answers
38k views

How to remove IIS/ASP.NET Response Headers

I have a couple IIS/6.0 servers that security is asking me to remove a couple of response headers that are sent to client browsers on requests. They are concerned about divulging platform information ...
11
votes
3answers
10k views

nginx real_ip_header and X-Forwarded-For seems wrong

The wikipedia description of the HTTP header X-Forwarded-For is: X-Forwarded-For: client1, proxy1, proxy2, ... The nginx documentation for the directive real_ip_header reads, in part: This ...
2
votes
2answers
168 views

Apache HSTS exception for some virtual hosts

In the global config section for Apache 2.2.15, I have the following (per recommendation) <IfModule mod_headers.c> Header add Strict-Transport-Security "max-age=15768000;includeSubDomains" ...
5
votes
1answer
1k views

add_header directives in location overwriting add_header directives in server

Using nginx 1.2.1 I am able to add multiple headers using add_header as follows: server { listen 80; server_name localhost; root /var/www; add_header Name1 Value1; <=== ...
3
votes
2answers
3k views

How to filter Varnish logs based on XID?

I'm running into infrequent 503 errors which appear hard to pinpoint. Varnishlog is driving me mad, since I can't seem to get the information I want out of it. I'd like to see both the client- and ...
6
votes
1answer
3k views

Nginx : strip header on HTTP, add header on HTTPS

I'm configuring an Nginx server so as to serve as a reverse proxy to serve a Django app (run on Gunicorn). My problem is that I want my site secured with HTTPS, and so I want my Django app to be able ...
3
votes
3answers
1k views

Is it possible to route requests to different applications via Content-Type?

I'm designing a JSON API, and I'd like to version the API using content negotiation of some kind. I'm currently planning on using Vendor MIME Types to do this. While I can definitely do this at the ...
2
votes
1answer
1k views

LiteSpeed enable Access-Control-Allow-Origin (no response header on CORS request)

Seriously, I can't find a single page discussing this for litespeed. Using this format in the htaccess "Header set Access-Control-Allow-Origin http://aSite.com" (and https) sends the setting in the ...
2
votes
1answer
2k views

Set Server response header in IIS7

Is it possible in IIS7, without using URL Scan to remove the Server in the response header? I have tried the following: HttpModule I've installed a signed one into the GAC and also tried the ...
1
vote
3answers
631 views

Use apache to strip off a URL param and add it as a custom HTTP header on a redirect

Let's say my browser issues a request to http://localhost/accounts?memberUuid=<some uuid> I'd like apache2 to pickup that request, add a custom HTTP header with the uuid in it, strip the uuid ...
0
votes
0answers
32 views

Apache configuration redirect using only redirect, not rewrite

PS: this is the 2nd part of the question originally posted here. I'd like to disable the HSTS header completely for specific virtual hosts. I have (per recommendation) a redirect in the 443 container ...
-1
votes
1answer
57 views

Debug Nginx caching

I want to determine when I am getting cache hits or misses. Preferably, this would be a header, like X-Cache: HIT or X-Cache: MISS How can I do this with Nginx (a reverse proxy for the upstream ...