134
votes
Accepted
What is the purpose of the ".well-known"-folder?
That /.well-known/ subdirectory is defined by RFC 5785 RFC 8615
It is increasingly common for Web-based protocols to require the
discovery of policy or other information about a host ("site-wide
...
- 80.3k
122
votes
Accepted
Best way to redirect all HTTP to HTTPS in IIS
The IIS URL Rewrite Module 2.1 for IIS7+ may be your friend. The module can be downloaded from IIS URL Rewrite. Using the URL Rewrite Module and URL Rewrite Module 2.0 Configuration Reference explain ...
- 3,267
63
votes
Accepted
Can nginx location blocks match a URL query string?
Can nginx location blocks match a URL query string?
Short answer: No.
Long answer: There is a workaround if we have only a handful of such location blocks.
Here's a sample workaround for 3 location ...
- 6,227
54
votes
How to reply with 200 from Nginx, without serving a file?
If you want to return a formatted HTML text, without serving a HTML file:
location / {
default_type text/html;
return 200 "<!DOCTYPE html><h2>gangnam style!</h2>\n";...
- 1,731
54
votes
Accepted
What does "Connection: close" mean when used in the response message?
Yes, this is correct. The server can just say "I don't support your keep-alive request and will just close the connection when I am finished".
From RFC 2616, Section 14.10:
HTTP/1.1 defines ...
- 99.6k
48
votes
Accepted
Can not get rid of `net::ERR_CERT_COMMON_NAME_INVALID` error in chrome with self-signed certificates
Chrome 58+ no longer matches the Common Name (CN) in certs.
Now it uses Subject Alternative Names (SAN) instead.
SAN must contain proper DNS or IP entry.
When DNS is used, it should be a resolvable ...
- 13.5k
40
votes
Accepted
My DNS record can only point to an IP address. How do I make it reach for a port?
DNS records can't point to ports (with a few special case exceptions that do not apply here).
If you have a web service listen on port 8080 and want to reach it without specifying this port, you ...
- 99.6k
39
votes
Accepted
Can X-FORWARDED-FOR contain multiple IPs
Yes, if a request is chained through more than one proxy server, then each proxy should add the IP of the preceding one to the existing X-Forwarded-For header so that the entire chain is preserved.
- 8,078
38
votes
Why are CentOS mirrors HTTP and not HTTPS?
The packages are indeed signed, hence a manipulation would be noticed.
Also the packages are not secret, so there isn't any need to encrypt them on the transfer.
With the mass of downloads from ...
- 658
32
votes
Nginx proxy by Request Method
Although you could achieve this with if, this is generally discouraged by the Nginx documentation, because if doesn't play well with other directives. For example, assume that GET should be open for ...
- 587
30
votes
Running an API, if I correct a content-type header will that break things for customers?
how badly could it mess things up for our existing customers?
It could completely sink their battleships if they've written code that relies on this Content-Type being incorrect.
I would not expect ...
- 427
29
votes
Accepted
What does `* Mark bundle as not supporting multiuse` mean in my curl trace?
From https://github.com/curl/curl/blob/curl-7_82_0/lib/http.c#L4226 :
if(conn->httpversion < 20) {
conn->bundle->multiuse = BUNDLE_NO_MULTIUSE;
infof(data, "Mark bundle as not ...
- 18.1k
25
votes
Can X-FORWARDED-FOR contain multiple IPs
From https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For
X-Forwarded-For: <client>, <proxy1>, <proxy2>
If a request goes through multiple proxies, the IP ...
- 251
25
votes
Accepted
Redirect all requests to HTTPS, except for one subdirectory
Try this:
server {
listen 80;
server_name sub.domain.tld;
server_tokens off;
root /var/www/letsencrypt;
location /.well-known {
try_files $uri $uri/ =404;
...
- 37.6k
25
votes
Accepted
DNS not resolving IP
Your DNS seems fine, app.dotaquiz.org pointing to 185.156.179.139:
;; ANSWER SECTION:
app.dotaquiz.org. 86400 IN A 185.156.179.139
We can see that there isn't a web page configured ...
- 49.8k
22
votes
Why are CentOS mirrors HTTP and not HTTPS?
From a technical perspective the fact plain HTTP content can easily be cached by proxy servers can make quite a bit of difference when you need to manage and update more than a handful of systems.
...
- 6,003
20
votes
104: Connection reset by peer while reading response header from upstream (Nginx)
I know this topic is old, but it still continues to pop up occasionally, so, looking for answers on the web, I came up with the following three possibilities:
A programming error is sometimes ...
- 334
19
votes
nginx responding to unknown host names?
For http:
server {
listen 80 default_server;
server_name _;
return 404;
}
For https, you actually need to point nginx at ssl cert/key. According to
documentation, nginx only looks at '...
- 699
19
votes
How to serve different robots.txt for http and https on same site?
Use an Alias
Create two files, robots.txt and robots_http.txt and add this to your http VirtualHost:
Alias "/robots.txt" "/path/to/documentroot/robots_http.txt"
- 25k
18
votes
Accepted
Under HTTP2, how often are new TCP connections initiated?
There are only few guidelines in the relevant section 9 of the specification:
There should not be multiple connections from the browser to the same server
Connections should not be closed "until it ...
- 13.7k
18
votes
11: Resource temporarily unavailable, while connecting to upstream + Bad Gateway (Nginx)
These errors could be caused by lack of allowed maximum number of socket connections (mostly default is 128). You can view the current limit by executing cat /proc/sys/net/core/somaxconn and it's ...
18
votes
Accepted
Is the Host: header required over SSL?
A HTTP/1.0 request does not need a Host according to the standard, but this header is still usually needed in practice to decide on multi-domain setups which content to serve. But if this header is ...
- 13.7k
17
votes
Accepted
HTTP status code to signal bad or missing Host header
RFC 6066 doesn't specify or even recommend any particular HTTP error in the case that the hostname sent via SNI doesn't match the HTTP Host header. It does recommend that the server abort the TLS ...
- 248k
15
votes
How to redirect HTTP to HTTPS on AWS Application Load Balancer?
As of July 2018, this is supported on application load balancers.
Add/Edit your HTTP:80 listener
Set the action to Redirect
protocol: https
port: 443
set the next dropdown to Original host, path, ...
- 151
15
votes
Accepted
Does it makes sense from a security perspective to remove the Server HTTP header?
RFC 7231 says about the Server header:
An origin server MAY generate a Server field in its responses.
MAY is interpreted as in RFC 2119:
MAY This word, or the adjective "OPTIONAL", mean ...
- 248k
15
votes
Why are CentOS mirrors HTTP and not HTTPS?
The packages are signed by an off-channel method (GPG keys stored on your system).
The main use of having HTTP is to make it easy to have a dependency proxy between the Internet and your machines, ...
- 251
14
votes
Is there a maximum size for content of an HTTP POST?
The specifications of the POST method do not impose any limit on the size of data, but both the web servers and the browsers will set their own limits.
For example:
Internet Explorer: 2 GB
Firefox: 2 ...
- 241
14
votes
Accepted
Serving port 443 over http creates 400 Bad Request Error instead of redirect
TL;TR: you cannot serve both HTTP and HTTPS on the same port (443).
While it would be in theory possible to figure out based on the first data from the client if the client is sending a HTTP request (...
- 13.7k
13
votes
Accepted
Windows Server 2012 R2 IIS 10 / HTTP/2
No, IIS is a integrated part of the OS and can't be separately upgraded to a newer version. HTTP/2 especially isn't implemented in IIS, but in a kernel mode driver that is naturally only available in ...
- 99.6k
12
votes
Accepted
nginx does not respond correctly to HTTP/1.1
I had an accidental "http2" directive on one of my port 80 server directives (you can see it in the "api" server). For some reason using this on one server block affects others. ...
- 331
Only top scored, non community-wiki answers of a minimum length are eligible