I am trying to send HTTP response headers from Apache on an Amazon Linux 2 AMI EC2 instance. I had originally tried to do this in
httpd.conf and tried a few variations...
Header always set X-Frame-Options "SAMEORIGIN"
But the header is not set. So I figured maybe they're reset somewhere down the line, but at least
.htaccess should be able to set them, so I tried a couple of variations...
Header set ApacheFoo ApacheBar Header add Strict-Transport-Security "max-age=31104000; includeSubdomains"
But again, neither of these headers are set.
However, if I use PHP to set the headers, it works fine...
<?php header("phpfoo: phpbar"); die(print_r(headers_list(), 1));
I have the
phpfoo: phpbar header showing up in Chrome's DevTools, but none of the ones set directly in Apache have been set.
.htaccess solution works fine on my own local Windows+Apache setup, but not on AWS, so I'm assuming the issue is specific to it and am wondering if there are any quirks specific to this platform that I need to know about?
Headers module is definitely loaded. If I run
sudo httpd -S (I have to use
sudo to run this command or there is a permission issue to do with accessing a
.pem file required for SSL, Apache starts fine so I assume this is not an issue if imbued with its permissions), this is the output (host specific info replaced with asterisks):
VirtualHost configuration: *:80 *.com (/etc/httpd/conf/httpd.conf:44) *:443 is a NameVirtualHost default server ip-*-*-*-*.us-east-2.compute.internal (/etc/httpd/conf.d/ssl.conf:56) port 443 namevhost ip-*-*-*-*.us-east-2.compute.internal (/etc/httpd/conf.d/ssl.conf:56) port 443 namevhost *.com (/etc/httpd/conf/httpd-le-ssl.conf:2) alias www.*.com ServerRoot: "/etc/httpd" Main DocumentRoot: "/var/www/html" Main ErrorLog: "/etc/httpd/logs/error_log" Mutex authdigest-opaque: using_defaults Mutex watchdog-callback: using_defaults Mutex proxy-balancer-shm: using_defaults Mutex rewrite-map: using_defaults Mutex ssl-stapling-refresh: using_defaults Mutex authdigest-client: using_defaults Mutex lua-ivm-shm: using_defaults Mutex ssl-stapling: using_defaults Mutex proxy: using_defaults Mutex authn-socache: using_defaults Mutex ssl-cache: using_defaults Mutex default: dir="/run/httpd/" mechanism=default Mutex mpm-accept: using_defaults Mutex cache-socache: using_defaults PidFile: "/run/httpd/httpd.pid" Define: DUMP_VHOSTS Define: DUMP_RUN_CFG User: name="apache" id=48 Group: name="apache" id=48