Tag Info

Hot answers tagged

31

To remove all custom headers that disclose too much information - the methods are varied (unfortunately) for IIS 7: Header Name: X-Powered-By Add: <httpProtocol> <customHeaders> <remove name="X-Powered-By" /> </customHeaders> </httpProtocol> in the <system.webServer> section. Header Name: Server Implement an ...


27

Your security department wants you to do this to make the server type harder to identify. This may lessen the barrage of automated hacking tools and make it more difficult for people to break into the server. Within IIS, open the web site properties, then go to the HTTP Headers tab. Most of the X- headers can be found and removed here. This can be done ...


19

You can change the Server header if you want, but don't count on this for security. Only keeping up to date will do that, since an attacker can just ignore your Server header and try every known exploit from the beginning of time. RFC 2616 states, in part: Server implementors are encouraged to make this field a configurable option. And Apache did, ...


16

In my opinion, it is best to mask this as much as possible. It's one of the tool you use to hack a web site - discover its technology, use the known flaws of that technology. The same reason why security best practice a while back started promoting to have urls in the form "/view/page" instead of "/view/page.jsp" or "/view/page.asp"... so the underlying ...


14

Putting this in an ASP.NET application's web.config file will get rid of the X-AspNet-Version header: <system.web> <httpRuntime enableVersionHeader="false" /> </system.web> Note that the system.web tag should already exist in the file. Don't create a duplicate, just add the httpRuntime tag. The httpRuntime tag might also already exist. ...


13

In order to retrieve only the header, give this a try: curl -I example.com From the man page: -I/--head (HTTP/FTP/FILE) Fetch the HTTP-header only! HTTP-servers feature the command HEAD which this uses to get nothing but the header of a document. When used on a FTP or FILE file, curl displays ...


12

GET / HTTP/1.0 is a legal HTTP request. If there's no Host header field, you may not get the results you were hoping for if the destination server is a virtual host that doesn't have its own IP address to distinguish itself from other virtual hosts. HTTP 1.1 requires the Host field.


10

It seems the difference has to do with the Content-Length header and how it is treated by both commands. But before going into that, curl -X HEAD does not give any output because, by default, curl does not print headers if switch -i is not provided (not needed on -I though). In any case, curl -I is the proper way to fetch the headers. It just ask for the ...


10

For Apache, there is the module mod_asis, which does just that - reads the file and sends it on its merry way as a complete HTTP response. This module is shipped with Apache by default, but you need to enable it first (see the docs, there's a reasonable example).


9

I believe the key to solving X-Forwarded-For woes when multiple IPs are chained is the recently introduced configuration option, real_ip_recursive (added in nginx 1.2.1 and 1.3.0). From the nginx realip docs: If recursive search is enabled, an original client address that matches one of the trusted addresses is replaced by the last non-trusted address ...


7

This solution does not describe how to strip a header on HTTP only, as asked in the question title. A safe solution for your problem is to add proxy_set_header X-Forwarded-Protocol $scheme; It will set X-Forwarded-Protocol to http on HTTP requests and to https on HTTPS requests. This makes sure that this header is overridden if the client set it, as ...


7

Just replied to my own question... Header unset Pragma Header unset Last-Modified Header unset Cache-Control


7

I have discovered that this does what I want: <Location /textfiles> SetEnvIf Request_URI "^.*/([^/]*)$" FILENAME=$1 Header set "Content-disposition" "attachment; filename=%{FILENAME}e" UnsetEnv FILENAME </Location>


7

You should use underscores_in_headers on directive which is off by default.


6

The reason for setting the header to vary by user agent is that Apache's recommended configuration for mod_deflate serves uncompressed versions of some content to Netscape 4 users. There are probably few enough Netscape 4 users now that you can just serve compressed content to all browsers that claim to support it, and not vary by user agent. So instead of ...


6

No way disable out of the box. But ETags are set by the DefaultServlet via request.setHeader(). So an easy workaround to disable them is to create a filter for DefaultServlet which swallows the tag. For example: void doFilter(ServletRequest request, ServletRequest reponse) { chain.doFilter(request, new HttpServletResponseWrapper(response) { public ...


6

Use wget for instance wget -O - -o /dev/null --save-headers www.example.com/test.php


6

I think this is a bug in curl. If I specify a method with -X, curl should handle the response according to the RFC. Unfortunately, the maintainer of curl does not agree. Someone filed a bug and even submitted a patch: http://sourceforge.net/tracker/?func=detail&atid=100976&aid=1810273&group_id=976 but the curl maintainer rejected it. Apparently ...


6

Redirection is typically effected through HTTP response status codes 301 (Moved Permanently) or 302 (Found / Moved Temporarily). Those 301 and 302 HTTP response status codes used to perform redirection are included in the HTTP headers. Just because you didn't "see any redirection in Firefox" doesn't mean redirection wasn't taking place: it was, behind the ...


6

The parsing of the X-Forwarded-For header is indeed flawed in the nginx real_ip module. len = r->headers_in.x_forwarded_for->value.len; ip = r->headers_in.x_forwarded_for->value.data; for (p = ip + len - 1; p > ip; p--) { if (*p == ' ' || *p == ',') { p++; len -= p - ip; ip = p; break; } } It starts on the far right of ...


6

First and foremost, yell. Loudly. At your vendor. For having a product not supporting the over-a-decade-old HTTP/1.1 protocol. The impact of not having persistent connections is a major increase in loading time of resources. With keep-alive, a single TCP connection can be used to request multiple resources; without, a new TCP session (with a new ...


5

curl -I will generate a HEAD request. Adding the -L option will make it follow redirects. Timeouts can be controlled with several options depending on which bit of the request you want to time out. From the man page: --connect-timeout <seconds> Maximum time in seconds that you allow the connection to the server to take. This only limits ...


5

Because the XID also appears in the TxHeader tag line when communicating with a client: 12 SessionOpen c 127.0.0.1 33829 :80 12 ReqStart c 127.0.0.1 33829 1171098618 12 RxRequest c GET 12 RxURL c / 12 RxProtocol c HTTP/1.1 12 RxHeader c Host: ganglia.gentoo 12 RxHeader c User-Agent: Mozilla/5.0 (X11; Linux i686; ...


5

It might be useful to developers or Power User clients; but is certainly more commonly useful to hackers and their like. I would leave them on while developing a site, and perhaps upon initial release; but not in the long run. Clients care about content, not headers.


5

This is expected behaviour. The add_header directives, much like all other array-type directives in nginx, are inherited from the previous level if and only if there are no add_header directives defined on the current level. If you want nginx to add all headers in the location /, you have to list them all in location /, i.e. location / { add_header ...


5

You can use the retry-after header like this. ErrorDocument 503 /503.html RewriteEngine On RewriteCond %{REQUEST_URI} !^/503.html$ Header always set Retry-After "3600" RewriteRule .* - [R=503] Here is a blog post for more details.


5

You can do that with curl: curl -i 'http://example.com/' Result: HTTP/1.0 302 Found Location: http://www.iana.org/domains/example/ Server: BigIP Connection: Keep-Alive Content-Length: 0 (for some reason, IANA decided to redirect example.com, result: no body) curls manual page about the -i option: -i/--include (HTTP) Include the HTTP-header ...


5

You can use an IIS Native-Code module to remove any headers in IIS 7.5 (in fact, the same module should work for IIS 7.0 - 8.5). Native-Code modules differ from the more common Managed modules, as they are written using the win32 APIs rather than ASP.NET. They work for all requests, including static pages and images. Binaries and source code of an ...


4

There is no point to sending a message body with a 304 response. In fact, the HTTP specification says that the server must not do so. If you have one that is, it's misbehaving according to the spec. From the HTTP Specification: The 304 response MUST NOT contain a message-body, and thus is always terminated by the first empty line after the ...


4

It'll fool some bots, but a human attacker isn't going to care that you're not advertising your server's minor version in headers. There is value in bot dodging, but it's pretty limited. If you're looking to do this, make sure you aren't presenting full version information on error pages, either (the ServerSignature directive, for example, in Apache).



Only top voted, non community-wiki answers of a minimum length are eligible