Hot answers tagged

43

To remove all custom headers that disclose too much information - the methods are varied (unfortunately) for IIS 7: Header Name: X-Powered-By Add: <httpProtocol> <customHeaders> <remove name="X-Powered-By" /> </customHeaders> </httpProtocol> in the <system.webServer> section. Header Name: Server Implement an ...


35

Here's a one-liner I came up with for displaying request and response HTTP headers using tcpdump (which should work for your case too): sudo tcpdump -A -s 10240 'tcp port 4080 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | egrep --line-buffered "^........(GET |HTTP\/|POST |HEAD )|^[A-Za-z0-9-]+: " | sed -r ...


34

I believe the key to solving X-Forwarded-For woes when multiple IPs are chained is the recently introduced configuration option, real_ip_recursive (added in nginx 1.2.1 and 1.3.0). From the nginx realip docs: If recursive search is enabled, an original client address that matches one of the trusted addresses is replaced by the last non-trusted address ...


30

Your security department wants you to do this to make the server type harder to identify. This may lessen the barrage of automated hacking tools and make it more difficult for people to break into the server. Within IIS, open the web site properties, then go to the HTTP Headers tab. Most of the X- headers can be found and removed here. This can be done ...


24

It seems the difference has to do with the Content-Length header and how it is treated by both commands. But before going into that, curl -X HEAD does not give any output because, by default, curl does not print headers if switch -i is not provided (not needed on -I though). In any case, curl -I is the proper way to fetch the headers. It just ask for the ...


23

I think what you want instead of Apache might be a packet analyzer, Also known as a packet sniffer. Two of the most popular ones are probably TCPDump and Wireshark, both of which are free and have versions for Windows and *nix operating systems. These will show you all traffic coming in on an interface, not just what Apache sees. But you can use filters to ...


23

In order to retrieve only the header, give this a try: curl -I example.com From the man page: -I/--head (HTTP/FTP/FILE) Fetch the HTTP-header only! HTTP-servers feature the command HEAD which this uses to get nothing but the header of a document. When used on a FTP or FILE file, curl displays ...


19

Since Nginx 1.7.5 you can use always to add a header irrespective of the response code: add_header X-Test "blahblahblah" always;


19

You can change the Server header if you want, but don't count on this for security. Only keeping up to date will do that, since an attacker can just ignore your Server header and try every known exploit from the beginning of time. RFC 2616 states, in part: Server implementors are encouraged to make this field a configurable option. And Apache did, ...


18

content-length can't be set if the Transfer-Encoding is set to be chunked. At the time of sending the headers, the server is unaware of how much data it will finally send. Each chunk has it's own length header field (see the RFC). If you think about it, unlike with a static HTML file, the web server has no way of knowing how much data will be generated by a ...


17

GET / HTTP/1.0 is a legal HTTP request. If there's no Host header field, you may not get the results you were hoping for if the destination server is a virtual host that doesn't have its own IP address to distinguish itself from other virtual hosts. HTTP 1.1 requires the Host field.


16

Putting this in an ASP.NET application's web.config file will get rid of the X-AspNet-Version header: <system.web> <httpRuntime enableVersionHeader="false" /> </system.web> Note that the system.web tag should already exist in the file. Don't create a duplicate, just add the httpRuntime tag. The httpRuntime tag might also already exist. ...


16

In my opinion, it is best to mask this as much as possible. It's one of the tool you use to hack a web site - discover its technology, use the known flaws of that technology. The same reason why security best practice a while back started promoting to have urls in the form "/view/page" instead of "/view/page.jsp" or "/view/page.asp"... so the underlying ...


14

The documentation states that add_header "Adds the specified field to a response header provided that the response code equals 200, 204, 206, 301, 302, 303, 304, or 307. A value can contain variables." So it doesn't work with a 502. I forgot to add that you can use the third party headers more module to add headers to other codes. You'll probably have to ...


13

Woot! Got it.. It was pretty much what I suspected in my edit, I had to basically do the regex filename check in my sole location {} instead of making an alternative one. location / { root /www/site.org/public/; index index.html; if ($request_filename ~* ^.*?/([^/]*?)$) { set $filename ...


13

Looks like it's due to a new <meta> header that Google is using: <meta name="referrer" content="origin"> Specification: http://wiki.whatwg.org/wiki/Meta_referrer Only supported by webkit at the moment, with Firefox support on the way. So not a complete solution, but certainly a start!


12

It might be useful to developers or Power User clients; but is certainly more commonly useful to hackers and their like. I would leave them on while developing a site, and perhaps upon initial release; but not in the long run. Clients care about content, not headers.


11

Just replied to my own question... Header unset Pragma Header unset Last-Modified Header unset Cache-Control


11

This solution does not describe how to strip a header on HTTP only, as asked in the question title. A safe solution for your problem is to add proxy_set_header X-Forwarded-Protocol $scheme; It will set X-Forwarded-Protocol to http on HTTP requests and to https on HTTPS requests. This makes sure that this header is overridden if the client set it, as ...


10

I think this is a bug in curl. If I specify a method with -X, curl should handle the response according to the RFC. Unfortunately, the maintainer of curl does not agree. Someone filed a bug and even submitted a patch: http://sourceforge.net/tracker/?func=detail&atid=100976&aid=1810273&group_id=976 but the curl maintainer rejected it. Apparently ...


10

For Apache, there is the module mod_asis, which does just that - reads the file and sends it on its merry way as a complete HTTP response. This module is shipped with Apache by default, but you need to enable it first (see the docs, there's a reasonable example).


10

With apache2, just run a2enmod headers and then sudo service apache2 restart and it will install the headers module automatically.


9

maybe dumping of cookies ? otherwise - look at mod_dumpio.


9

location ~* \.(eot|ttf|woff)$ { add_header Access-Control-Allow-Origin *; }


9

Late but still, I've just dealt with the same issue, and this worked for me: RequestHeader set X_FORWARDED_PROTO 'https' env=HTTPS The documentation says: When the RequestHeader directive is used with the add, append, or set argument, a fourth argument may be used to specify conditions under which the action will be taken. If the environment ...


9

You should use underscores_in_headers on directive which is off by default.


9

The parsing of the X-Forwarded-For header is indeed flawed in the nginx real_ip module. len = r->headers_in.x_forwarded_for->value.len; ip = r->headers_in.x_forwarded_for->value.data; for (p = ip + len - 1; p > ip; p--) { if (*p == ' ' || *p == ',') { p++; len -= p - ip; ip = p; break; } } It starts on the far right of ...


9

This is expected behaviour. The add_header directives, much like all other array-type directives in nginx, are inherited from the previous level if and only if there are no add_header directives defined on the current level. If you want nginx to add all headers in the location /, you have to list them all in location /, i.e. location / { add_header ...


9

You'll need to add a line like: LoadModule headers_module modules/mod_headers.so To your httpd.conf to add support for that. In Ubuntu and similar, you can do a2enmod headers and it'll automatically enable it in your configuration.


8

You can manually set the content type for specific file extensions in the web.config file for each web site where this is needed. In the root for the site, find the web.config file and add the remove and mimeMap lines as below (or create the entire file if it doesn't already exist). <?xml version="1.0" encoding="UTF-8"?> <configuration> ...



Only top voted, non community-wiki answers of a minimum length are eligible