HTTP header fields are components of the message header of requests and responses in the Hypertext Transfer Protocol (HTTP). They define the operating parameters of an HTTP transaction.

learn more… | top users | synonyms

35
votes
5answers
47k views

How to remove IIS/ASP.NET Response Headers

I have a couple IIS/6.0 servers that security is asking me to remove a couple of response headers that are sent to client browsers on requests. They are concerned about divulging platform information ...
16
votes
3answers
16k views

nginx real_ip_header and X-Forwarded-For seems wrong

The wikipedia description of the HTTP header X-Forwarded-For is: X-Forwarded-For: client1, proxy1, proxy2, ... The nginx documentation for the directive real_ip_header reads, in part: This ...
16
votes
3answers
842 views

Is there any reason to keep the “Server” response header in Apache

My server responds with Server: Apache/2.2.15 (CentOS) to all requests. I guess that this gives away my server architecture making it easier to hack attempts. Is this ever useful to a web browser? ...
16
votes
2answers
12k views

Difference between `curl -I` and `curl -X HEAD`

I was watching the funny server type from http://www.reddit.com with curl -I http://www.reddit.com when I guessed that curl -X HEAD http://www.reddit.com would do the same. But, in fact, it doesn't. ...
14
votes
2answers
14k views

What is the mandatory information a HTTP Request Header must contain?

What is the mandatory information a HTTP Request Header must contain ?
13
votes
5answers
17k views

Shell command to see the HTTP headers

Is there a shell command to see the headers of a HTTP request? For example, I would like to know what the headers retrieved from www.example.com/test.php are How can I do this?
10
votes
3answers
15k views

Human readable format for http headers with tcpdump

I would like to view the HTTP headers sent from Apache (listening on port 80) to Tomcat (on port 4080) in a Linux machine. According to Wikipedia, Header fields are colon-separated name-value ...
10
votes
1answer
4k views

What's the use of X-Powered-By, Server and other similar HTTP headers?

What's the use of Server, X-Powered-By and other similar headers? Looks like the consensus is they should be removed so that automatic vulnerability scanners doen't immediately know which version of ...
9
votes
11answers
1k views

.htaccess doesn't redirect to www-prefixed page properly

I'm trying to redirect an url without www. to www.version (example.com to www.example.com). I use the usual RewriteCond %{HTTP_HOST} ^example\.com [nc] RewriteRule (.*) http://www.example.com/$1 ...
7
votes
3answers
4k views

nginx passing back custom header

I have the following example location / { proxy_read_timeout 2000; proxy_next_upstream error; proxy_set_header X-Real-IP ...
7
votes
3answers
3k views

Amazon S3 not sending Content-Type header

I have an application that downloads content from various sources. It relies on the "Content-Type" header being set on images. The majority of web-servers do this correctly but it appears Amazon S3 ...
7
votes
3answers
4k views

What's wrong with this HTTP POST request?

I'm trying to fuzz a server using the Sulley fuzzing framework. I observe the following stream in Wireshark. The error talks about a problem with JSON parsing, however, when I try the same HTTP POST ...
6
votes
1answer
4k views

Nginx : strip header on HTTP, add header on HTTPS

I'm configuring an Nginx server so as to serve as a reverse proxy to serve a Django app (run on Gunicorn). My problem is that I want my site secured with HTTPS, and so I want my Django app to be able ...
6
votes
2answers
5k views

Impact of Connection Close vs Keep-alive

I'm configuring our servers, and due to the nature of our load balancer, we can't send connection keep-alive headers. I'm trying to determine the impact of sending these headers to both the end-user ...
6
votes
2answers
111 views

Does Nginx `if_modified_since` only work on static resources?

I can't seem to find enough documentation. I have an app that generates some dynamic responses, but could still benefit from the Last-Modified header -- so I send it. However, turning on ...
6
votes
2answers
4k views

Nginix proxy caching - how to check if it is working?

I have set up my nginx.conf file to use proxy caching from tutorials I have found online. However, I am trying to figure out how to check if it is actually working. I've read somewhere that adding ...
5
votes
1answer
2k views

add_header directives in location overwriting add_header directives in server

Using nginx 1.2.1 I am able to add multiple headers using add_header as follows: server { listen 80; server_name localhost; root /var/www; add_header Name1 Value1; <=== ...
5
votes
2answers
9k views

How to send Content-Disposition headers in apache for files?

I have a directory of text files that I'm serving out with apache 2. Normally when I (or any user) access the files they see them in their browser. I want to 'force'* the web browser to pop up a 'Save ...
5
votes
1answer
2k views

How do I get Apache2 to parse (without error) Header directives in a .htaccess?

I am getting pages loading with a 500 internal server error, due I believe to a directive that Apache has not been configured to allow. I have AllowOverride set to all, and a .htaccess file, ...
5
votes
1answer
9k views

Force encoding with IIS 7

I try to force encoding with IIS 7. When I add in the http response headers the key : Content-Type and value charset=utf-8 i got this key content-type : text/html,content-type=utf-8 it's there a ...
5
votes
3answers
464 views

Is my webserver allowing pre-fetching?

I have an image based website that hosts multiple galleries. When a user clicks one of the images the views property for the particular image is incremented. However, I noticed when using Firefox ...
5
votes
2answers
3k views

Is the Last-Modified HTTP header required for browser caching?

When I unset the Last-Modified header in Apache (ETags are also disabled), Firefox (4.01) will not cache any file regardless of whether I set a future Expires header or enable the Cache-Control ...
5
votes
2answers
110 views

apache: Send request URI within HTTP header for static files

To fulfil the requirements of the PubSubHubbub 0.4 spec, I have to send a rel=self header for each file. I'm now trying to do that with Apache's mod_headers and environment variables: Header append ...
5
votes
0answers
559 views

Haproxy: reject traffic by user agent from file

I am trying to reject connections from specific user agents (by matching a substring of the user-agent header) using an haproxy ACL with -f option to read from a file. However it is not working, it ...
4
votes
2answers
3k views

The Content-Length header does not exist

I have nginx server installed on Linux. When I send a request with curl, the Content-Length header is missing from the response. The 1.php file is: <?php echo "hello"; ?> The example ...
4
votes
2answers
312 views

Obfuscating the server field of an HTTP response header

I'm new to administering a server, and I'm wondering if there is any value in obfuscating the server field for HTTP response headers I'm sending out. Would this prevent hackers from determining which ...
4
votes
1answer
5k views

How can I remove HTTP headers with .htaccess in Apache?

I have a website that is sending out "cache-control" and "pragma" HTTP headers for PHP requests. I'm not doing that in the code, so I'm assuming it's some kind of Apache configuration, as suggested by ...
4
votes
4answers
2k views

Only allow the POST method for a specific file in a directory

I have one file that should only be accessible via the POST method. /var/www/folder/index.php The document root is /var/www/ and index.php is nested inside a folder. Version of Apache is: 2.4.4. ...
4
votes
2answers
1k views

How to set cache to never expire and minimize requests in Nginx?

I have a cache invalidation system in place, so I need to set the cache for css|js to never expire. I tried this location ~* \.(js|css)$ { # |png|jpg|jpeg|gif|ico expires max; #log_not_found ...
4
votes
3answers
2k views

Is it possible to route requests to different applications via Content-Type?

I'm designing a JSON API, and I'd like to version the API using content negotiation of some kind. I'm currently planning on using Vendor MIME Types to do this. While I can definitely do this at the ...
4
votes
2answers
16k views

Header set Access-Control-Allow-Origin not working with mod_rewrite + mod_jk

My first question on here on SF so please forgive me if I manage to bork the post. :) Anyways, I'm using mod_rewrite on one of my machines with a simple rule that redirects to a webapp on another ...
4
votes
1answer
4k views

Disabling 206 partial content responses on nginx

I have an HTML5 web app that uses a video tag. Depending on the user actions, different parts of the video will be played in response. This video does not exceed 5MB. I need this video to be entirely ...
4
votes
2answers
2k views

Set header in apache if it doesn't already exist

I have a proxy that is injecting some headers but I want to modify it so it only sets the headers if they are not already present: <Location /api> RequestHeader set MY_HEADER "value" ...
4
votes
1answer
2k views

mod_headers not sending headers when file is PHP

I've got my .htaccess file set to the following: Header set MyHeader "I'm Set!" If I go to that directory (http://example.com/test/), which has no default index file, and view the network activity ...
4
votes
1answer
3k views

Nginx $http_x_forwarded_for not always being set

I've noticed in our access logs that sometimes, the $http_x_forwarded_for variable has not been set, and instead, the correct IP is the one set to $remote_addr. Is it possible to set ...
4
votes
0answers
732 views

How to log effective outgoing HTTP requests made by Squid, with headers after adaptation?

I use Squid to modify some HTTP headers sent by clients. For testing purposes, I want to completely delete the 'User-Agent' header. Here is my config : request_header_access User-Agent deny all ...
3
votes
4answers
458 views

Static file with HTTP headers?

Is it possible to save a static html file with built in http headers ? So that putting it on any server will work including the http headers? If so how?
3
votes
1answer
4k views

How to disable ETag headers in Tomcat

Tomcat seems to send an ETag header with each response by default. I'd like to disable these for reasons outlined here. I know I can strip them out in my Apache configuration, but is there any way to ...
3
votes
1answer
1k views

Using curl to make a HEAD request with a hard timeout

I'd like to use curl to send a HTTP HEAD request to a URL to verify that it is working correctly (server is up and sends a successful response). At the end, I need the final HTTP response code ...
3
votes
2answers
4k views

How to filter Varnish logs based on XID?

I'm running into infrequent 503 errors which appear hard to pinpoint. Varnishlog is driving me mad, since I can't seem to get the information I want out of it. I'd like to see both the client- and ...
3
votes
2answers
3k views

Set Apache HTTP header except for specified URL

I'm using Apache 2.2 and want to set the X-Frame-Options header to "deny" across most of the site. I can turn it on unconditionally using mod_headers. However, there is one CGI scripts that returns ...
3
votes
1answer
1k views

only http header communication? - please explain

The screen shot below is made using firebug. The firefox <-> web server communication captured happened after clicking login button. But I cannot see any redirection in my firefox. Does that mean ...
3
votes
6answers
4k views

HTTP load balancer with header-based routing?

I am looking for a HTTP load balancing solution that will provide the following: 1) Accept HTTP connections on port X and forward them to one of multiple other hosts (and/or ports), either randomly ...
3
votes
1answer
4k views

How do I set proper Headers for JSON in Apache?

I have an Apache server which is serving out static JSON files. The Content Type is correctly being represented in the header with an Content-Type: application/json header. How do I add the correct ...
3
votes
1answer
3k views

IIS 7 returns HTTP 200 on custom 404 error page

I have successfully set up custom static error pages for IIS7. IIS7 is currently working as a gateway to a Java tomcat application. The issue is that when the 404 error page is served it is served ...
3
votes
1answer
6k views

How do I alter the Last-Modified header on NGNIX?

My server returns the following headers: Cache-Control:no-cache Connection:keep-alive Date:Thu, 07 Jul 2011 10:41:57 GMT Expires:Thu, 01 Jan 1970 00:00:01 GMT Last-Modified:Thu, 07 Jul 2011 08:06:32 ...
3
votes
1answer
3k views

Disable compression on SSL/TLS connections in Apache < 2.2.16 using mod_header

Because of CRIME, as I understand, compression on SSL connections have to be turned off. In newer versions of apache this can be done with a newly introduced directive SSLCompression off, in older ...
3
votes
1answer
2k views

Apache reverse proxy not preserving headers

Does anyone know if there is something strange going on? It seems that my reverse proxy setup, doesn't preserve the correct caching headers from the original virtualhost. Let me explain... I am ...
3
votes
2answers
952 views

In Nginx, block user based on X header value

I have 6 Nginx servers behind load balancer. Of course, if I just try to "deny" based on IP address it does not work as the app servers just see the load balancer IP. However, I learned about the ...
3
votes
1answer
3k views

Add a custom header to ProxyPass requests

I have a simple apache vhost: <VirtualHost *:80> ServerName hello.local ProxyPass / http://localhost:8810/ ProxyPassReverse / http://localhost:8810/ </VirtualHost> All request to ...