HTTP header fields are components of the message header of requests and responses in the Hypertext Transfer Protocol (HTTP). They define the operating parameters of an HTTP transaction.

learn more… | top users | synonyms

25
votes
3answers
26k views

nginx real_ip_header and X-Forwarded-For seems wrong

The wikipedia description of the HTTP header X-Forwarded-For is: X-Forwarded-For: client1, proxy1, proxy2, ... The nginx documentation for the directive real_ip_header reads, in part: This ...
38
votes
5answers
60k views

How to remove IIS/ASP.NET Response Headers

I have a couple IIS/6.0 servers that security is asking me to remove a couple of response headers that are sent to client browsers on requests. They are concerned about divulging platform information ...
22
votes
5answers
27k views

How to dump entire HTTP requests with apache

Is it possible to dump entire HTTP requests by apache? I need to track all HTTP headers of incomming requests. How to do that?
3
votes
2answers
1k views

Apache HSTS exception for some virtual hosts

In the global config section for Apache 2.2.15, I have the following (per recommendation) <IfModule mod_headers.c> Header add Strict-Transport-Security "max-age=15768000;includeSubDomains" ...
2
votes
1answer
355 views

Why does this HTTP header configuration cause browsers to always perform If-Modified-Since requests?

On our server, we have configured http response headers as follows: Cache-Control:max-age=28800, must-revalidate # (8 hours) Connection:Keep-Alive Date:Wed, 24 Apr 2013 21:36:19 GMT ...
14
votes
3answers
25k views

How can I make nginx support @font-face formats and allow access-control-allow-origin?

I've added these rules to mime.types: application/x-font-ttf ttf; font/opentype otf; application/vnd.ms-fontobject eot; font/x-woff ...
7
votes
1answer
3k views

add_header directives in location overwriting add_header directives in server

Using nginx 1.2.1 I am able to add multiple headers using add_header as follows: server { listen 80; server_name localhost; root /var/www; add_header Name1 Value1; <=== ...
10
votes
2answers
4k views

Nginx add_header for a 50* page

I'm currently trying to get nginx to add a header to the response when it is sending some kind of 50* error. I already have an add_header directive on the http block, and that gets respected for all ...
8
votes
2answers
14k views

How can I log the response header and body in apache?

I need to determine whether the server (Apache 2) is returning the full contents of a page along with its correct header or not. I have a PHP-script that is executed successfully, but the browser is ...
3
votes
2answers
1k views

In Nginx, block user based on X header value

I have 6 Nginx servers behind load balancer. Of course, if I just try to "deny" based on IP address it does not work as the app servers just see the load balancer IP. However, I learned about the ...
3
votes
2answers
5k views

How to filter Varnish logs based on XID?

I'm running into infrequent 503 errors which appear hard to pinpoint. Varnishlog is driving me mad, since I can't seem to get the information I want out of it. I'd like to see both the client- and ...
7
votes
1answer
2k views

mod_headers not sending headers when file is PHP

I've got my .htaccess file set to the following: Header set MyHeader "I'm Set!" If I go to that directory (http://example.com/test/), which has no default index file, and view the network activity ...
6
votes
1answer
5k views

Nginx : strip header on HTTP, add header on HTTPS

I'm configuring an Nginx server so as to serve as a reverse proxy to serve a Django app (run on Gunicorn). My problem is that I want my site secured with HTTPS, and so I want my Django app to be able ...
4
votes
1answer
5k views

Apache - disable range requests - disadvantages?

As there is a working exploit against Apache's byte range implementation (CVE-2011-3192, see here), I'd like to disable it until official patches are shipped with my distros (Debian, Ubuntu). The ...
4
votes
3answers
2k views

Is it possible to route requests to different applications via Content-Type?

I'm designing a JSON API, and I'd like to version the API using content negotiation of some kind. I'm currently planning on using Vendor MIME Types to do this. While I can definitely do this at the ...
4
votes
2answers
6k views

Apache redirect and set cache headers?

Doing a redirect in Apache is easy (mod_alias): RedirectMatch ^.*$ http://portal.example.com/ Setting cache headers is equally easy: Header set Cache-Control max-age=0 Header set Expires "Thu, 01 ...
2
votes
3answers
2k views

How do I add no-cache headers to all 404 pages served by apache and nginx?

I have recently run into an issue after switching to Cloudflare, and the solution is to basically stop Cloudflare from caching 404 responses. In our load-balanced multi-server setup, occasional 404s ...
1
vote
1answer
167 views

Apache 2.4.16 Response Header value clipped

Problem: The value of a Response Header is greater than 8K and always clipped. Server Config: Apache 2.4.16-x64 with mod_proxy and mod_proxy_http / Running on Windows Server 2012 Httpd.conf: ...
2
votes
1answer
2k views

LiteSpeed enable Access-Control-Allow-Origin (no response header on CORS request)

Seriously, I can't find a single page discussing this for litespeed. Using this format in the htaccess "Header set Access-Control-Allow-Origin http://aSite.com" (and https) sends the setting in the ...
2
votes
1answer
3k views

Set Server response header in IIS7

Is it possible in IIS7, without using URL Scan to remove the Server in the response header? I have tried the following: HttpModule I've installed a signed one into the GAC and also tried the ...
1
vote
3answers
1k views

Use apache to strip off a URL param and add it as a custom HTTP header on a redirect

Let's say my browser issues a request to http://localhost/accounts?memberUuid=<some uuid> I'd like apache2 to pickup that request, add a custom HTTP header with the uuid in it, strip the uuid ...
1
vote
3answers
12k views

Remove X-Forwarded-For header in Squid 3.0

Some months ago I was working with Squid 3.0 and managed to get rid of the X-Forwarded-For header completely. Now I am trying to do the same thing but I do not seem to hit the nail. I have tried ...
1
vote
1answer
2k views

Should I use Expires headers, Cache-Control headers, or both?

Just trying to do a bit of performance tuning on a client's site. I don't want to set far future expiries yet, because we are still changing a lot of stuff regularly, but I'd like to give everything ...
0
votes
1answer
85 views

Apache configuration redirect using only redirect, not rewrite

PS: this is the 2nd part of the question originally posted here. I'd like to disable the HSTS header completely for specific virtual hosts. I have (per recommendation) a redirect in the 443 container ...
0
votes
1answer
5k views

nginx proxy_set_header x-forwarded-proto seemingly not working

Since i am a beginner in nginx proxying i have a question. The gist of it: Where does an nginx proxy set defaults for php's $_SERVER["HTTP_X_FORWARDED_HOST"], $_SERVER["HTTP_X_FORWARDED_SERVER"] and ...
-1
votes
1answer
517 views

Debug Nginx caching

I want to determine when I am getting cache hits or misses. Preferably, this would be a header, like X-Cache: HIT or X-Cache: MISS How can I do this with Nginx (a reverse proxy for the upstream ...