HTTP header fields are components of the message header of requests and responses in the Hypertext Transfer Protocol (HTTP). They define the operating parameters of an HTTP transaction.

learn more… | top users | synonyms

39
votes
5answers
61k views

How to remove IIS/ASP.NET Response Headers

I have a couple IIS/6.0 servers that security is asking me to remove a couple of response headers that are sent to client browsers on requests. They are concerned about divulging platform information ...
26
votes
3answers
37k views

Human readable format for http headers with tcpdump

I would like to view the HTTP headers sent from Apache (listening on port 80) to Tomcat (on port 4080) in a Linux machine. According to Wikipedia, Header fields are colon-separated name-value ...
25
votes
3answers
27k views

nginx real_ip_header and X-Forwarded-For seems wrong

The wikipedia description of the HTTP header X-Forwarded-For is: X-Forwarded-For: client1, proxy1, proxy2, ... The nginx documentation for the directive real_ip_header reads, in part: This ...
25
votes
2answers
19k views

Difference between `curl -I` and `curl -X HEAD`

I was watching the funny server type from http://www.reddit.com with curl -I http://www.reddit.com when I guessed that curl -X HEAD http://www.reddit.com would do the same. But, in fact, it doesn't. ...
23
votes
5answers
27k views

How to dump entire HTTP requests with apache

Is it possible to dump entire HTTP requests by apache? I need to track all HTTP headers of incomming requests. How to do that?
17
votes
6answers
25k views

Shell command to see the HTTP headers

Is there a shell command to see the headers of a HTTP request? For example, I would like to know what the headers retrieved from www.example.com/test.php are How can I do this?
16
votes
3answers
971 views

Is there any reason to keep the “Server” response header in Apache

My server responds with Server: Apache/2.2.15 (CentOS) to all requests. I guess that this gives away my server architecture making it easier to hack attempts. Is this ever useful to a web browser? ...
14
votes
4answers
26k views

How can I make nginx support @font-face formats and allow access-control-allow-origin?

I've added these rules to mime.types: application/x-font-ttf ttf; font/opentype otf; application/vnd.ms-fontobject eot; font/x-woff ...
14
votes
2answers
20k views

What is the mandatory information a HTTP Request Header must contain?

What is the mandatory information a HTTP Request Header must contain ?
13
votes
1answer
7k views

What's the use of X-Powered-By, Server and other similar HTTP headers?

What's the use of Server, X-Powered-By and other similar headers? Looks like the consensus is they should be removed so that automatic vulnerability scanners doen't immediately know which version of ...
12
votes
5answers
11k views

Referer is passed from HTTPS to HTTP in some cases… How?

In theory browsers do not pass on referer information from HTTPS to HTTP sites. And in my experience this has always been true. But I just found an exception, and I want to understand why it works so ...
11
votes
2answers
4k views

Nginx add_header for a 50* page

I'm currently trying to get nginx to add a header to the response when it is sending some kind of 50* error. I already have an add_header directive on the http block, and that gets respected for all ...
10
votes
2answers
7k views

How do I get Apache2 to parse (without error) Header directives in a .htaccess?

I am getting pages loading with a 500 internal server error, due I believe to a directive that Apache has not been configured to allow. I have AllowOverride set to all, and a .htaccess file, ...
9
votes
11answers
1k views

.htaccess doesn't redirect to www-prefixed page properly

I'm trying to redirect an url without www. to www.version (example.com to www.example.com). I use the usual RewriteCond %{HTTP_HOST} ^example\.com [nc] RewriteRule (.*) http://www.example.com/$1 [R=...
8
votes
4answers
13k views

RequestHeader with Apache environment variable

I have Apache set up as a load balancer. I wanted to make apache set the X-Forwarded-Proto header, but this doesn't work: RequestHeader set X-Forwarded-Proto "%{SERVER_PROTOCOL}e" The header gets ...
8
votes
3answers
4k views

Amazon S3 not sending Content-Type header

I have an application that downloads content from various sources. It relies on the "Content-Type" header being set on images. The majority of web-servers do this correctly but it appears Amazon S3 ...
8
votes
2answers
14k views

How can I log the response header and body in apache?

I need to determine whether the server (Apache 2) is returning the full contents of a page along with its correct header or not. I have a PHP-script that is executed successfully, but the browser is ...
7
votes
1answer
5k views

Nginx : strip header on HTTP, add header on HTTPS

I'm configuring an Nginx server so as to serve as a reverse proxy to serve a Django app (run on Gunicorn). My problem is that I want my site secured with HTTPS, and so I want my Django app to be able ...
7
votes
3answers
7k views

nginx passing back custom header

I have the following example location / { proxy_read_timeout 2000; proxy_next_upstream error; proxy_set_header X-Real-IP $...
7
votes
1answer
3k views

add_header directives in location overwriting add_header directives in server

Using nginx 1.2.1 I am able to add multiple headers using add_header as follows: server { listen 80; server_name localhost; root /var/www; add_header Name1 Value1; <=== ...
7
votes
2answers
8k views

Impact of Connection Close vs Keep-alive

I'm configuring our servers, and due to the nature of our load balancer, we can't send connection keep-alive headers. I'm trying to determine the impact of sending these headers to both the end-user ...
7
votes
3answers
8k views

What's wrong with this HTTP POST request?

I'm trying to fuzz a server using the Sulley fuzzing framework. I observe the following stream in Wireshark. The error talks about a problem with JSON parsing, however, when I try the same HTTP POST ...
7
votes
1answer
2k views

mod_headers not sending headers when file is PHP

I've got my .htaccess file set to the following: Header set MyHeader "I'm Set!" If I go to that directory (http://example.com/test/), which has no default index file, and view the network activity ...
6
votes
2answers
5k views

The Content-Length header does not exist

I have nginx server installed on Linux. When I send a request with curl, the Content-Length header is missing from the response. The 1.php file is: <?php echo "hello"; ?> The example ...
6
votes
1answer
7k views

How can I remove HTTP headers with .htaccess in Apache?

I have a website that is sending out "cache-control" and "pragma" HTTP headers for PHP requests. I'm not doing that in the code, so I'm assuming it's some kind of Apache configuration, as suggested by ...
6
votes
1answer
2k views

Haproxy load balancing with HTTP Headers

We're using HAProxy to load balance our websocket and comet application. There is one HAProxy and 3 applications running in the back. We use HTTP Basic Auth (and we will use other types of auth in ...
6
votes
1answer
11k views

Force encoding with IIS 7

I try to force encoding with IIS 7. When I add in the http response headers the key : Content-Type and value charset=utf-8 i got this key content-type : text/html,content-type=utf-8 it's there a ...
6
votes
3answers
4k views

Set header in apache if it doesn't already exist

I have a proxy that is injecting some headers but I want to modify it so it only sets the headers if they are not already present: <Location /api> RequestHeader set MY_HEADER "value" ...
6
votes
2answers
1k views

Does Nginx `if_modified_since` only work on static resources?

I can't seem to find enough documentation. I have an app that generates some dynamic responses, but could still benefit from the Last-Modified header -- so I send it. However, turning on ...
6
votes
1answer
2k views

Haproxy: reject traffic by user agent from file

I am trying to reject connections from specific user agents (by matching a substring of the user-agent header) using an haproxy ACL with -f option to read from a file. However it is not working, it ...
6
votes
2answers
5k views

Nginix proxy caching - how to check if it is working?

I have set up my nginx.conf file to use proxy caching from tutorials I have found online. However, I am trying to figure out how to check if it is actually working. I've read somewhere that adding ...
6
votes
1answer
1k views

How can the x-frame-options HTTP header of ADFS 3 be manipulated?

By default, ADFS 3 responses contain the "X-Frame-Options: DENY" HTTP header. This prevents ADFS from being run in an iframe, because this presents an opportunity for clickjacking attacks. At the ...
6
votes
2answers
463 views

IIS sets http header Expires to -1, how do I override this with mod_expires

I'm using an IIS website with a Apache HTTP reverse proxy (mod_proxy with ProxyRequests Off). I want to control the expires headers in apache (don't ask), but IIS is setting the header Expires: -1. ...
5
votes
2answers
10k views

How to send Content-Disposition headers in apache for files?

I have a directory of text files that I'm serving out with apache 2. Normally when I (or any user) access the files they see them in their browser. I want to 'force'* the web browser to pop up a 'Save ...
5
votes
2answers
12k views

get the authenticated user under apache

Using Apache 2.2 on Windows with mod_auth_sspi and mod_headers. I'm trying to pass the current authenticated user through to the proxy target in the X-Remote-User header. I expect that this is ...
5
votes
1answer
6k views

Disabling 206 partial content responses on nginx

I have an HTML5 web app that uses a video tag. Depending on the user actions, different parts of the video will be played in response. This video does not exceed 5MB. I need this video to be entirely ...
5
votes
2answers
19k views

Header set Access-Control-Allow-Origin not working with mod_rewrite + mod_jk

My first question on here on SF so please forgive me if I manage to bork the post. :) Anyways, I'm using mod_rewrite on one of my machines with a simple rule that redirects to a webapp on another ...
5
votes
3answers
225 views

What is the best way to move site to new domain without losing google page rank

Hello I just bought new domain for my web page. Is it good to use php redirection to the new domain and what are the exact headers that I must send to google bot to just renew the address and keep the ...
5
votes
7answers
12k views

Adding an HTTP request header with Squid

I want to permit my users to login to Google apps only for my domain. I found a solution by adding the HTTP header X-GoogApps-Allowed-Domains as described in this Google help page. I use Squid, but ...
5
votes
3answers
2k views

Incorrect gzipping of http requests, can't find who's doing it

We're seeing some very strange mangling of HTTP responses, and we can't figure out what is doing it. We have an app server handling JSON requests. Occasionally, the response is returned gzipped, but ...
5
votes
3answers
542 views

Is my webserver allowing pre-fetching?

I have an image based website that hosts multiple galleries. When a user clicks one of the images the views property for the particular image is incremented. However, I noticed when using Firefox (14....
5
votes
2answers
3k views

Is the Last-Modified HTTP header required for browser caching?

When I unset the Last-Modified header in Apache (ETags are also disabled), Firefox (4.01) will not cache any file regardless of whether I set a future Expires header or enable the Cache-Control header....
5
votes
2answers
224 views

apache: Send request URI within HTTP header for static files

To fulfil the requirements of the PubSubHubbub 0.4 spec, I have to send a rel=self header for each file. I'm now trying to do that with Apache's mod_headers and environment variables: Header append ...
4
votes
3answers
8k views

Apache proxy_http redirect to ip and set hostname

hopefully you guys can help me with a proxy problem I have. What I already have I have set up an apache http reverse proxy, to proxy requests from *.proxy.domain to *.intern.domain. The apache is ...
4
votes
1answer
15k views

How to configure nginx so it works with Express?

I'm trying to configure nginx so it proxy_pass requests to my node apps. Question on StackOverflow got many upvotes: http://stackoverflow.com/questions/5009324/node-js-nginx-and-now and I'm using ...
4
votes
4answers
4k views

Only allow the POST method for a specific file in a directory

I have one file that should only be accessible via the POST method. /var/www/folder/index.php The document root is /var/www/ and index.php is nested inside a folder. Version of Apache is: 2.4.4. ...
4
votes
2answers
409 views

Obfuscating the server field of an HTTP response header

I'm new to administering a server, and I'm wondering if there is any value in obfuscating the server field for HTTP response headers I'm sending out. Would this prevent hackers from determining which ...
4
votes
2answers
5k views

Set Apache HTTP header except for specified URL

I'm using Apache 2.2 and want to set the X-Frame-Options header to "deny" across most of the site. I can turn it on unconditionally using mod_headers. However, there is one CGI scripts that returns ...
4
votes
1answer
5k views

Apache - disable range requests - disadvantages?

As there is a working exploit against Apache's byte range implementation (CVE-2011-3192, see here), I'd like to disable it until official patches are shipped with my distros (Debian, Ubuntu). The ...
4
votes
3answers
2k views

Is it possible to route requests to different applications via Content-Type?

I'm designing a JSON API, and I'd like to version the API using content negotiation of some kind. I'm currently planning on using Vendor MIME Types to do this. While I can definitely do this at the ...