HTTP header fields are components of the message header of requests and responses in the Hypertext Transfer Protocol (HTTP). They define the operating parameters of an HTTP transaction.

learn more… | top users | synonyms

31
votes
4answers
31k views

How to remove IIS/ASP.NET Response Headers

I have a couple IIS/6.0 servers that security is asking me to remove a couple of response headers that are sent to client browsers on requests. They are concerned about divulging platform information ...
6
votes
3answers
6k views

nginx real_ip_header and X-Forwarded-For seems wrong

The wikipedia description of the HTTP header X-Forwarded-For is: X-Forwarded-For: client1, proxy1, proxy2, ... The nginx documentation for the directive real_ip_header reads, in part: This ...
5
votes
1answer
544 views

add_header directives in location overwriting add_header directives in server

Using nginx 1.2.1 I am able to add multiple headers using add_header as follows: server { listen 80; server_name localhost; root /var/www; add_header Name1 Value1; <=== ...
3
votes
2answers
2k views

How to filter Varnish logs based on XID?

I'm running into infrequent 503 errors which appear hard to pinpoint. Varnishlog is driving me mad, since I can't seem to get the information I want out of it. I'd like to see both the client- and ...
6
votes
1answer
2k views

Nginx : strip header on HTTP, add header on HTTPS

I'm configuring an Nginx server so as to serve as a reverse proxy to serve a Django app (run on Gunicorn). My problem is that I want my site secured with HTTPS, and so I want my Django app to be able ...
3
votes
3answers
887 views

Is it possible to route requests to different applications via Content-Type?

I'm designing a JSON API, and I'd like to version the API using content negotiation of some kind. I'm currently planning on using Vendor MIME Types to do this. While I can definitely do this at the ...
2
votes
1answer
854 views

LiteSpeed enable Access-Control-Allow-Origin (no response header on CORS request)

Seriously, I can't find a single page discussing this for litespeed. Using this format in the htaccess "Header set Access-Control-Allow-Origin http://aSite.com" (and https) sends the setting in the ...
2
votes
1answer
2k views

Set Server response header in IIS7

Is it possible in IIS7, without using URL Scan to remove the Server in the response header? I have tried the following: HttpModule I've installed a signed one into the GAC and also tried the ...
1
vote
3answers
449 views

Use apache to strip off a URL param and add it as a custom HTTP header on a redirect

Let's say my browser issues a request to http://localhost/accounts?memberUuid=<some uuid> I'd like apache2 to pickup that request, add a custom HTTP header with the uuid in it, strip the uuid ...