Hot answers tagged

15

Since Nginx 1.7.5 you can use always to add a header irrespective of the response code: add_header X-Test "blahblahblah" always;


13

The documentation states that add_header "Adds the specified field to a response header provided that the response code equals 200, 204, 206, 301, 302, 303, 304, or 307. A value can contain variables." So it doesn't work with a 502. I forgot to add that you can use the third party headers more module to add headers to other codes. You'll probably have to ...


8

Yes you can very well hash any header of your choice. Just use "balance hdr(header_name)". I must say I had never thought about doing it that way. In some environments, it can indeed be quite useful. You can also hash on a URL parameter or a POST parameter if that can help. You can't define your hashing method however. You can select if the hash is ...


7

When you enter a URL without a port, port 80 is implied. No browser that I know of has any way to change this behavior; if you want to use port 3333, then you'll need it in the URL.


6

The FOOBAR in %{FOOBAR}e should be an environment variable, but HTTP_HOST is a server variable. If you really want to do that, you may try: RewriteRule (.*) $1 [E=custom_host:%{HTTP_HOST}] RequestHeader set X-Custom-Host-Header "%{custom_host}e" or RewriteCond %{HTTP_HOST} (.*) RewriteRule (.*) $1 [E=custom_host:%1] RequestHeader set ...


5

SPF shouldn't be causing a header to be added. Something else should be doing this. Look at your headers for some segment where there are lots of lines in a row which are indented (continuation lines). This will be your problem header. As you are using ~all, your SPF record won't be that effective. You are better off coming up with a policy which wil ...


5

If you want to add headers then you want something like this: server { listen 80; server_name _; add_header X-Frame-Options "SAMEORIGIN"; add_header X-Frame-Options sameorigin; add_header X-UA-Compatible "IE=Edge,chrome=1"; add_header X-Your-Port-Header-Here $server_port; add_header X-Your-Protocol-Header-Here $scheme; ...


4

in case you do not get any response body in your logs when using "Intended Response Body (E)"; eg.: SecAuditLogParts ABCEFHZ Make sure you also have activated the rule engine: SecRuleEngine On and check your settings for: SecRequestBodyAccess On SecResponseBodyAccess On


3

Bad news! mod_headers in 2.0.59 doesn't seem to play nice with environment variables in its validation code. It parses like this: RequestHeader {action} {inhdr} {value} {envclause} For unset, 2.0.59 validates like this, scrapping a directive if it has a third argument (value) after the directive name: if (new->action == hdr_unset) { if (value) ...


3

Some additional clues According to http://www.w3.org/Protocols/rfc2616/rfc2616-sec3.html#sec3.5: identity The default (identity) encoding; the use of no transformation whatsoever. This content-coding is used only in the Accept- Encoding header, and SHOULD NOT be used in the Content-Encoding header. Akamai seems to be ignoring the fact that a server ...


3

You do not need the full verbose list of all mail exchangers - You probably have a higher-than-necessary level of debugging set somewhere that is causing some part of your mail chain to include this. Determine which part of your mail chain is adding this header. Then make it stop. :-)


3

What you want to use is the header_checks rules. You will need to tweak this for your particular servers but this is an example: /^Received:.* \[127\.0\.\.0\1\]\) by \S+\.server\.com \(Postfix\)/ IGNORE See http://www.postfix.org/header_checks.5.html for more details and options. See for an example post from someone doing the same thing: ...


3

That looks like it might be an IPv6 address, though it's difficult to tell since you have mangled it.


3

Adding some X-Foo: cron header (with the X- prefix!) isn't a problem, you can add them as you like. Edit I forgot about http://tools.ietf.org/html/rfc6648. So scrap the X- part.


3

This header Received: from hello3.much.cheap ([2607:5300:60:6516::]) by mx.google.com with ESMTP id f2si9741219vdb.2.2015.06.05.19.26.14 for <XX@XXXX.com>; Fri, 05 Jun 2015 19:26:15 -0700 (PDT) is indicating that postfix send email to mx.google.com via IPv6. In other case, postfix will send email via IPv4. SPF checker ...


2

The IPv4 header contains total length, which is the total length of the packet including header. The IPv6 header contains payload length, which is the length of the actual payload not including the header. Since both are 16-bit unsigned integers, the IPv6 packet can contain in it's payload an entire IPv4 packet including header, so the IPv6 packet can handle ...


2

The end user is forwarding their email via the MTA (like /etc/aliases).


2

Solved - Following line in /etc/postfix/master.cf was causing conflict : pickup fifo n - - 60 1 pickup -o content_filter= # -o receive_override_options=no_header_body_checks //commented this line out


2

Ok, so it turns out that it works in 2.2, but you need to increase the max AJP packet size if you have a Tomcat behind it and use mod_proxy_ajp, or else it will still give a 400 Bad Request. Specifically, set this in Apache: LimitRequestFieldSize 65536 ProxyIOBufferSize 65536 and this in Tomcat server.xml on the ajp connector: packetSize="65536" Only ...


2

You can do this via mod_security, see the Documentation about Audit Log data format.


2

You seem to have mis-spelled header_checks as smtp_client_restrictions, which isn't even the correct spelling of the wrong parameter. ☺ This sort of thing is far better done with a simple shim around sendmail, that your PHP (or whatever) scripts are configured to use, you know. The shim script would be a simple exercise in the use of the cat and echo ...


2

This answers your exact question: http://hoursofop.tumblr.com/post/17760274650 It applies to a Ubuntu system and worked perfectly for me. Be careful to choose the right "smtp" line in master.cf. I used a tab to indent the -o line. Also note that SendGrid strip out the X-SMTPAPI header from the email before it is sent on - so you won't find it there but you ...


2

This should mostly just be a matter of making sure that your modules and settings match between the two servers. Run a2enmod deflate on the server that's not compressing to make sure the module's enabled, then check to be sure the configurations match (server config in apache2.conf, site config in sites-available, and module config in ...


2

As per the Squid FAQ: Squid.conf ACLs Header modification via Squid ACLs is limited to deleting a header or replacing a matching header with a constant string. In other words, you won't be able to add arbitrary request headers simply by using Squid ACLs. The Squid ACLs limit you to deleting existing headers or replacing existing headers, but ...


1

Using squid, you will: Set up dyanmic SSL certificate generation. Install the root certificate in the web clients' browsers. Set up SSL Bump to intercept proxied SSL/TLS traffic. Use ACLs to insert your desired header(s).


1

Do you can with new Squid 3.3 that support the command "request_header_add". I used CentOS for do it. My Squid.conf is: acl CONNECT method CONNECT visible_hostname MySERVER.local acl local src 192.168.0.0/24 http_access allow local ssl_bump client-first all always_direct allow all http_port 3128 ssl_bump generate-host-certificates=on ...


1

Caching is rarely a 'drop in' solution, but if implemented correctly it can result in a significant speed increase for a website. The first item you mention 'a lot of CSS images' - is not a server issue per se. To fetch those, the browser must make a request for each image, each with its own overhead. Combine the images into a CSS sprite so that you can ...


1

As stated by David, your question is very broad. However, after having tried to read your mind, it seems to me that what you want is to use the HTTP caching features. I believe you want the users's browsers accessing your web site to cache its images as well as its .css files, so that they avoid fetching all this content every single time they access your ...


1

You remove email headers at your own peril; I cannot believe any company would be stupid enough to think that standards compliance to promote interoperability will have negative security impacts of any magnitude.


1

From http://wiki.nginx.org/HttpGzipModule gzip on; gzip_min_length 1000; gzip_proxied expired no-cache no-store private auth; gzip_types text/plain application/xml; gzip_disable "MSIE [1-6]\."; From http://wiki.nginx.org/HttpHeadersModule expires 24h; expires modified +24h; expires @15h30m; expires 0; ...



Only top voted, non community-wiki answers of a minimum length are eligible