HTTP header fields are components of the message header of requests and responses in the Hypertext Transfer Protocol (HTTP). They define the operating parameters of an HTTP transaction.

learn more… | top users | synonyms

32
votes
5answers
38k views

How to remove IIS/ASP.NET Response Headers

I have a couple IIS/6.0 servers that security is asking me to remove a couple of response headers that are sent to client browsers on requests. They are concerned about divulging platform information ...
16
votes
3answers
792 views

Is there any reason to keep the “Server” response header in Apache

My server responds with Server: Apache/2.2.15 (CentOS) to all requests. I guess that this gives away my server architecture making it easier to hack attempts. Is this ever useful to a web browser? ...
13
votes
2answers
8k views

Difference between `curl -I` and `curl -X HEAD`

I was watching the funny server type from http://www.reddit.com with curl -I http://www.reddit.com when I guessed that curl -X HEAD http://www.reddit.com would do the same. But, in fact, it doesn't. ...
12
votes
2answers
11k views

What is the mandatory information a HTTP Request Header must contain?

What is the mandatory information a HTTP Request Header must contain ?
11
votes
3answers
10k views

nginx real_ip_header and X-Forwarded-For seems wrong

The wikipedia description of the HTTP header X-Forwarded-For is: X-Forwarded-For: client1, proxy1, proxy2, ... The nginx documentation for the directive real_ip_header reads, in part: This ...
10
votes
5answers
13k views

Shell command to see the HTTP headers

Is there a shell command to see the headers of a HTTP request? For example, I would like to know what the headers retrieved from www.example.com/test.php are How can I do this?
9
votes
10answers
858 views

.htaccess doesn't redirect to www-prefixed page properly

I'm trying to redirect an url without www. to www.version (domain.cz to www.domain.cz). I use the usual RewriteCond %{HTTP_HOST} ^domain\.cz [nc] RewriteRule (.*) http://www.domain.cz/$1 [R=301,L] ...
7
votes
3answers
3k views

nginx passing back custom header

I have the following example location / { proxy_read_timeout 2000; proxy_next_upstream error; proxy_set_header X-Real-IP ...
7
votes
3answers
1k views

What's wrong with this HTTP POST request?

I'm trying to fuzz a server using the Sulley fuzzing framework. I observe the following stream in Wireshark. The error talks about a problem with JSON parsing, however, when I try the same HTTP POST ...
6
votes
1answer
3k views

Nginx : strip header on HTTP, add header on HTTPS

I'm configuring an Nginx server so as to serve as a reverse proxy to serve a Django app (run on Gunicorn). My problem is that I want my site secured with HTTPS, and so I want my Django app to be able ...
6
votes
2answers
3k views

Impact of Connection Close vs Keep-alive

I'm configuring our servers, and due to the nature of our load balancer, we can't send connection keep-alive headers. I'm trying to determine the impact of sending these headers to both the end-user ...
6
votes
1answer
3k views

What's the use of X-Powered-By, Server and other similar HTTP headers?

What's the use of Server, X-Powered-By and other similar headers? Looks like the consensus is they should be removed so that automatic vulnerability scanners doen't immediately know which version of ...
6
votes
3answers
3k views

Amazon S3 not sending Content-Type header

I have an application that downloads content from various sources. It relies on the "Content-Type" header being set on images. The majority of web-servers do this correctly but it appears Amazon S3 ...
5
votes
2answers
8k views

How to send Content-Disposition headers in apache for files?

I have a directory of text files that I'm serving out with apache 2. Normally when I (or any user) access the files they see them in their browser. I want to 'force'* the web browser to pop up a 'Save ...
5
votes
1answer
8k views

Force encoding with IIS 7

I try to force encoding with IIS 7. When I add in the http response headers the key : Content-Type and value charset=utf-8 i got this key content-type : text/html,content-type=utf-8 it's there a ...
5
votes
1answer
1k views

add_header directives in location overwriting add_header directives in server

Using nginx 1.2.1 I am able to add multiple headers using add_header as follows: server { listen 80; server_name localhost; root /var/www; add_header Name1 Value1; <=== ...
5
votes
3answers
402 views

Is my webserver allowing pre-fetching?

I have an image based website that hosts multiple galleries. When a user clicks one of the images the views property for the particular image is incremented. However, I noticed when using Firefox ...
5
votes
2answers
3k views

Is the Last-Modified HTTP header required for browser caching?

When I unset the Last-Modified header in Apache (ETags are also disabled), Firefox (4.01) will not cache any file regardless of whether I set a future Expires header or enable the Cache-Control ...
4
votes
2answers
256 views

Obfuscating the server field of an HTTP response header

I'm new to administering a server, and I'm wondering if there is any value in obfuscating the server field for HTTP response headers I'm sending out. Would this prevent hackers from determining which ...
4
votes
4answers
834 views

Only allow the POST method for a specific file in a directory

I have one file that should only be accessible via the POST method. /var/www/folder/index.php The document root is /var/www/ and index.php is nested inside a folder. Version of Apache is: 2.4.4. ...
4
votes
1answer
4k views

How can I remove HTTP headers with .htaccess in Apache?

I have a website that is sending out "cache-control" and "pragma" HTTP headers for PHP requests. I'm not doing that in the code, so I'm assuming it's some kind of Apache configuration, as suggested by ...
4
votes
2answers
942 views

How to set cache to never expire and minimize requests in Nginx?

I have a cache invalidation system in place, so I need to set the cache for css|js to never expire. I tried this location ~* \.(js|css)$ { # |png|jpg|jpeg|gif|ico expires max; #log_not_found ...
4
votes
2answers
14k views

Header set Access-Control-Allow-Origin not working with mod_rewrite + mod_jk

My first question on here on SF so please forgive me if I manage to bork the post. :) Anyways, I'm using mod_rewrite on one of my machines with a simple rule that redirects to a webapp on another ...
4
votes
1answer
2k views

Disabling 206 partial content responses on nginx

I have an HTML5 web app that uses a video tag. Depending on the user actions, different parts of the video will be played in response. This video does not exceed 5MB. I need this video to be entirely ...
3
votes
4answers
430 views

Static file with HTTP headers?

Is it possible to save a static html file with built in http headers ? So that putting it on any server will work including the http headers? If so how?
3
votes
1answer
3k views

How to disable ETag headers in Tomcat

Tomcat seems to send an ETag header with each response by default. I'd like to disable these for reasons outlined here. I know I can strip them out in my Apache configuration, but is there any way to ...
3
votes
1answer
739 views

Using curl to make a HEAD request with a hard timeout

I'd like to use curl to send a HTTP HEAD request to a URL to verify that it is working correctly (server is up and sends a successful response). At the end, I need the final HTTP response code ...
3
votes
2answers
3k views

How to filter Varnish logs based on XID?

I'm running into infrequent 503 errors which appear hard to pinpoint. Varnishlog is driving me mad, since I can't seem to get the information I want out of it. I'd like to see both the client- and ...
3
votes
2answers
3k views

Set Apache HTTP header except for specified URL

I'm using Apache 2.2 and want to set the X-Frame-Options header to "deny" across most of the site. I can turn it on unconditionally using mod_headers. However, there is one CGI scripts that returns ...
3
votes
1answer
1k views

only http header communication? - please explain

The screen shot below is made using firebug. The firefox <-> web server communication captured happened after clicking login button. But I cannot see any redirection in my firefox. Does that mean ...
3
votes
3answers
1k views

Is it possible to route requests to different applications via Content-Type?

I'm designing a JSON API, and I'd like to version the API using content negotiation of some kind. I'm currently planning on using Vendor MIME Types to do this. While I can definitely do this at the ...
3
votes
1answer
1k views

Set header in apache if it doesn't already exist

I have a proxy that is injecting some headers but I want to modify it so it only sets the headers if they are not already present: <Location /api> RequestHeader set MY_HEADER "value" ...
3
votes
1answer
3k views

Nginix proxy caching - how to check if it is working?

I have set up my nginx.conf file to use proxy caching from tutorials I have found online. However, I am trying to figure out how to check if it is actually working. I've read somewhere that adding ...
3
votes
1answer
5k views

How do I alter the Last-Modified header on NGNIX?

My server returns the following headers: Cache-Control:no-cache Connection:keep-alive Date:Thu, 07 Jul 2011 10:41:57 GMT Expires:Thu, 01 Jan 1970 00:00:01 GMT Last-Modified:Thu, 07 Jul 2011 08:06:32 ...
3
votes
2answers
1k views

IIS 7.5 Custom HTTP Response Headers Not Working

Trying to setup custom HTTP Response Headers on a new install of IIS7.5 on Windows Server 2008 R2 Standard and they are not working. Default headers work fine (X-Powered-By, etc...). Modifying ...
3
votes
0answers
579 views

How to log effective outgoing HTTP requests made by Squid, with headers after adaptation?

I use Squid to modify some HTTP headers sent by clients. For testing purposes, I want to completely delete the 'User-Agent' header. Here is my config : request_header_access User-Agent deny all ...
2
votes
2answers
622 views

The Content-Length header does not exist

I have nginx server installed on Linux. When I send a request with curl, the Content-Length header is missing from the response. The 1.php file is: <?php echo "hello"; ?> The example ...
2
votes
2answers
3k views

IIS 7.5 Server response headers (UrlScan does not work)

In the past you could use UrlScan by Microsoft to modify the headers and remove the one's displaying IIS version for example. This does not work for IIS 7.5 and IIS 7.0 is the latest version ...
2
votes
2answers
357 views

What sort of magic is my ISP doing?

While trying to setup OpenDNS, and failing to make website filtering actually work, I realized my ISP is doing something nefarious with all HTTP requests. To make a long story short, if there's a ...
2
votes
2answers
485 views

Why is SPDY breaking 'Vary: Accept-Encoding' in Nginx 1.4.3?

I've compiled Nginx 1.4.3 from source with the SPDY module. However when SPDY is enabled, it seems to break my 'Vary: Accept-Encoding' header. My Nginx Configuration: ./configure ...
2
votes
6answers
3k views

HTTP load balancer with header-based routing?

I am looking for a HTTP load balancing solution that will provide the following: 1) Accept HTTP connections on port X and forward them to one of multiple other hosts (and/or ports), either randomly ...
2
votes
3answers
6k views

Human readable format for http headers with tcpdump

I would like to view the HTTP headers sent from Apache (listening on port 80) to Tomcat (on port 4080) in a Linux machine. According to Wikipedia, Header fields are colon-separated name-value ...
2
votes
2answers
609 views

nginx conditional Accept header

Some mobile devices send the following incorrect requests to our servers : GET / HTTP/1.0 Accept: User-Agent : xxx The empty Accept header causes our Ruby on Rails server to throw back a 500 error. ...
2
votes
2answers
2k views

Can't turn off SNI on apache

When I go to: http://web-sniffer.net/ and check the headers of my site (https://www.example.org), I get a status code 200 But when I use the radio button HTTP/1.0 (without Host header), I get a ...
2
votes
2answers
537 views

Can I get Apache 2.2 to set a particular response header if some other response header is missing

I have an Apache 2.2 server running mod_proxy. We had a scenario where a response came through from the origin corrupted, it didn't have any content-type or cache-control headers. This meant that ...
2
votes
1answer
1k views

Sending Content (Message Body) along with 304 Not Modified header

For static html pages, when the response header from the server is 304 Not Modified, isn't it the server's responsibility to send back only the headers and not the message-body (html content) along ...
2
votes
3answers
2k views

HTTP Headers - need to check OPTIONS

I've received the results of a pen test and there is some unwanted exposure in the HTTP OPTIONS where the fact that Frontpage Server Extensions was available (now removed) was reported. I need to ...
2
votes
2answers
171 views

Apache HSTS exception for some virtual hosts

In the global config section for Apache 2.2.15, I have the following (per recommendation) <IfModule mod_headers.c> Header add Strict-Transport-Security "max-age=15768000;includeSubDomains" ...
2
votes
1answer
1k views

server_tokens off but still publishing them

I added server_tokens off; to http{} section of /etc/nginx/nginx.conf file and restarted nginx with service nginx restart command. but server still publishing the server tokens when responsing ...
2
votes
1answer
199 views

Apache returns 206 for some MP3's

We're trying to serve MP3 files from web1.cowbird.com. Most of the time everything works fine. However, sometimes there's a file that the browser is unable to play, and I have no idea why. Here is an ...