Custom headers (mod_headers) not showing in combination with mod_rewrite

Question

I have a vhost with multiple domainnames linked to it. I'm trying to send additional headers when a request is made to one particular domainname.

Here's what I'm doing (tried both in the vhost as in .htaccess, results are the same)

SetEnvIf HOST thishost THETAG=noindex
Header set X-Robots-Tag "%{THETAG}e" env=THETAG
Header set X-Robots-Test "Yes"

So basically, the X-Robots-Test header should always be present. The X-Robots-Tag should only be present if the THETAG header is set, which is only set if the host header contains "thishost".

The RewriteRule looks something like this, so basically a 301 redirect from page1 to page2

RewriteRule page1 page2 [L,R=301]

When a request is made to page2, the headers are show correctly, but when the request is made to page1 (and redirected by mod_rewrite) the headers are not present (not even the test header).

When a redirect is initiated from a PHP script rather than mod_rewrite, it does show the headers so I assume the problem is that mod_rewrite is taking precedence on mod_headers. Is there any way to fix this?

Answer 1

As @Zimmi said in the comments, Headers are only applied on "Success" responses (HTTP 2xx codes). Redirects are 3xx codes and therefore won't get the header.

If you're using Header set … then use Header always set …. If you're using a different action (add, append, etc) then use the appropriate action.

Note, though, that you shouldn't blindly "always set". From the documents:

The default value of onsuccess may need to be changed to always under the circumstances similar to those listed below. Note also that repeating this directive with both conditions makes sense in some scenarios because always is not a superset of onsuccess with respect to existing headers:

You're adding a header to a non-success (non-2xx) response, such as a redirect, in which case only the table corresponding to always is used in the ultimate response. You're modifying or removing a header generated by a CGI script, in which case the CGI scripts are in the table corresponding to always and not in the default table. You're modifying or removing a header generated by some piece of the server but that header is not being found by the default onsuccess condition.

For HSTS headers (which is what I was trying to add to domain cannonicalisation) then it seems to be the correct approach.