Tag Info

Hot answers tagged

34

To remove all custom headers that disclose too much information - the methods are varied (unfortunately) for IIS 7: Header Name: X-Powered-By Add: <httpProtocol> <customHeaders> <remove name="X-Powered-By" /> </customHeaders> </httpProtocol> in the <system.webServer> section. Header Name: Server Implement an ...


27

Your security department wants you to do this to make the server type harder to identify. This may lessen the barrage of automated hacking tools and make it more difficult for people to break into the server. Within IIS, open the web site properties, then go to the HTTP Headers tab. Most of the X- headers can be found and removed here. This can be done ...


19

You can change the Server header if you want, but don't count on this for security. Only keeping up to date will do that, since an attacker can just ignore your Server header and try every known exploit from the beginning of time. RFC 2616 states, in part: Server implementors are encouraged to make this field a configurable option. And Apache did, ...


16

In order to retrieve only the header, give this a try: curl -I example.com From the man page: -I/--head (HTTP/FTP/FILE) Fetch the HTTP-header only! HTTP-servers feature the command HEAD which this uses to get nothing but the header of a document. When used on a FTP or FILE file, curl displays ...


16

In my opinion, it is best to mask this as much as possible. It's one of the tool you use to hack a web site - discover its technology, use the known flaws of that technology. The same reason why security best practice a while back started promoting to have urls in the form "/view/page" instead of "/view/page.jsp" or "/view/page.asp"... so the underlying ...


15

GET / HTTP/1.0 is a legal HTTP request. If there's no Host header field, you may not get the results you were hoping for if the destination server is a virtual host that doesn't have its own IP address to distinguish itself from other virtual hosts. HTTP 1.1 requires the Host field.


15

I believe the key to solving X-Forwarded-For woes when multiple IPs are chained is the recently introduced configuration option, real_ip_recursive (added in nginx 1.2.1 and 1.3.0). From the nginx realip docs: If recursive search is enabled, an original client address that matches one of the trusted addresses is replaced by the last non-trusted address ...


14

Putting this in an ASP.NET application's web.config file will get rid of the X-AspNet-Version header: <system.web> <httpRuntime enableVersionHeader="false" /> </system.web> Note that the system.web tag should already exist in the file. Don't create a duplicate, just add the httpRuntime tag. The httpRuntime tag might also already exist. ...


14

content-length can't be set if the Transfer-Encoding is set to be chunked. At the time of sending the headers, the server is unaware of how much data it will finally send. Each chunk has it's own length header field (see the RFC). If you think about it, unlike with a static HTML file, the web server has no way of knowing how much data will be generated by a ...


13

It seems the difference has to do with the Content-Length header and how it is treated by both commands. But before going into that, curl -X HEAD does not give any output because, by default, curl does not print headers if switch -i is not provided (not needed on -I though). In any case, curl -I is the proper way to fetch the headers. It just ask for the ...


10

For Apache, there is the module mod_asis, which does just that - reads the file and sends it on its merry way as a complete HTTP response. This module is shipped with Apache by default, but you need to enable it first (see the docs, there's a reasonable example).


10

This solution does not describe how to strip a header on HTTP only, as asked in the question title. A safe solution for your problem is to add proxy_set_header X-Forwarded-Protocol $scheme; It will set X-Forwarded-Protocol to http on HTTP requests and to https on HTTPS requests. This makes sure that this header is overridden if the client set it, as ...


8

You should use underscores_in_headers on directive which is off by default.


7

I have discovered that this does what I want: <Location /textfiles> SetEnvIf Request_URI "^.*/([^/]*)$" FILENAME=$1 Header set "Content-disposition" "attachment; filename=%{FILENAME}e" UnsetEnv FILENAME </Location>


7

Just replied to my own question... Header unset Pragma Header unset Last-Modified Header unset Cache-Control


7

No way disable out of the box. But ETags are set by the DefaultServlet via request.setHeader(). So an easy workaround to disable them is to create a filter for DefaultServlet which swallows the tag. For example: void doFilter(ServletRequest request, ServletRequest reponse) { chain.doFilter(request, new HttpServletResponseWrapper(response) { public ...


6

I think this is a bug in curl. If I specify a method with -X, curl should handle the response according to the RFC. Unfortunately, the maintainer of curl does not agree. Someone filed a bug and even submitted a patch: http://sourceforge.net/tracker/?func=detail&atid=100976&aid=1810273&group_id=976 but the curl maintainer rejected it. Apparently ...


6

Redirection is typically effected through HTTP response status codes 301 (Moved Permanently) or 302 (Found / Moved Temporarily). Those 301 and 302 HTTP response status codes used to perform redirection are included in the HTTP headers. Just because you didn't "see any redirection in Firefox" doesn't mean redirection wasn't taking place: it was, behind the ...


6

You can manually set the content type for specific file extensions in the web.config file for each web site where this is needed. In the root for the site, find the web.config file and add the remove and mimeMap lines as below (or create the entire file if it doesn't already exist). <?xml version="1.0" encoding="UTF-8"?> <configuration> ...


6

None of the HTTP Headers are required in a Request. There are no required Response headers either. All that and more in HTTP 1.1 - RFC 2616


6

The reason for setting the header to vary by user agent is that Apache's recommended configuration for mod_deflate serves uncompressed versions of some content to Netscape 4 users. There are probably few enough Netscape 4 users now that you can just serve compressed content to all browsers that claim to support it, and not vary by user agent. So instead of ...


6

Use wget for instance wget -O - -o /dev/null --save-headers www.example.com/test.php


6

The parsing of the X-Forwarded-For header is indeed flawed in the nginx real_ip module. len = r->headers_in.x_forwarded_for->value.len; ip = r->headers_in.x_forwarded_for->value.data; for (p = ip + len - 1; p > ip; p--) { if (*p == ' ' || *p == ',') { p++; len -= p - ip; ip = p; break; } } It starts on the far right of ...


6

First and foremost, yell. Loudly. At your vendor. For having a product not supporting the over-a-decade-old HTTP/1.1 protocol. The impact of not having persistent connections is a major increase in loading time of resources. With keep-alive, a single TCP connection can be used to request multiple resources; without, a new TCP session (with a new ...


6

curl -I will generate a HEAD request. Adding the -L option will make it follow redirects. Timeouts can be controlled with several options depending on which bit of the request you want to time out. From the man page: --connect-timeout <seconds> Maximum time in seconds that you allow the connection to the server to take. This only limits ...


6

It might be useful to developers or Power User clients; but is certainly more commonly useful to hackers and their like. I would leave them on while developing a site, and perhaps upon initial release; but not in the long run. Clients care about content, not headers.


6

You can use an IIS Native-Code module to remove any headers in IIS 7.5 (in fact, the same module should work for IIS 7.0 - 8.5). Native-Code modules differ from the more common Managed modules, as they are written using the win32 APIs rather than ASP.NET. They work for all requests, including static pages and images. Binaries and source code of an ...


5

You can do that with curl: curl -i 'http://example.com/' Result: HTTP/1.0 302 Found Location: http://www.iana.org/domains/example/ Server: BigIP Connection: Keep-Alive Content-Length: 0 (for some reason, IANA decided to redirect example.com, result: no body) curls manual page about the -i option: -i/--include (HTTP) Include the HTTP-header ...


5

Because the XID also appears in the TxHeader tag line when communicating with a client: 12 SessionOpen c 127.0.0.1 33829 :80 12 ReqStart c 127.0.0.1 33829 1171098618 12 RxRequest c GET 12 RxURL c / 12 RxProtocol c HTTP/1.1 12 RxHeader c Host: ganglia.gentoo 12 RxHeader c User-Agent: Mozilla/5.0 (X11; Linux i686; ...


5

This is expected behaviour. The add_header directives, much like all other array-type directives in nginx, are inherited from the previous level if and only if there are no add_header directives defined on the current level. If you want nginx to add all headers in the location /, you have to list them all in location /, i.e. location / { add_header ...



Only top voted, non community-wiki answers of a minimum length are eligible