Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [http-headers]

HTTP header fields are components of the message header of requests and responses in the Hypertext Transfer Protocol (HTTP). They define the operating parameters of an HTTP transaction.

0
votes
1answer
29 views

Rewriting client “Host” http header before nginx validates the field

I get following request from a device and should proxy it to hd10.vtech.com: GET http://hd10.vtech.com/test/pp_firmware/HD10-CH010_SUOTA.bin HTTP/1.1 Host: http://hd10.vtech.com/test/...
0
votes
0answers
29 views

how to write a Nginx server block based on port in host header?

I would like to respond with different HTTP status code based on "port" in HTTP host header. The Host header looks like this : GET / HTTP/1.1 Host: 10.0.200.18:80 Connection: close I wrote a server ...
1
vote
1answer
18 views

Overwrite HTTP headers comming back from a web application server proxied in nginx

I have a web application server reverse-proxied behind nginx 1.15 like so: location / { proxy_pass https://some.awesome.IP:8080; proxy_set_header Host $host; proxy_set_header X-...
0
votes
1answer
26 views

Curl fetch only headers without head

On our company servers due to security purposes our main SysAdmin only allows a few HTTP methods to pass through like (GET, POST, OPTIONS, PUT, etc.) and HEAD is not one of them. I implemented Zabbix ...
0
votes
0answers
5 views

setup x-frame-options under redirection header for nginx

I have below configuration in nginx.conf file for the Rails(3.2) application. For localhost:5478 in prod the response headers of page contain x-frame-options while the ports 5479-82 when accessed ...
0
votes
2answers
48 views

add_header not working in Nginx location

So, I've been trying to figure this out for the past 8 hours, but it seems I'm stuck... I have the following Nginx config file: server_tokens off; upstream php-handler { server unix:/var/run/php5-...
0
votes
0answers
27 views

Browser livarage cache failed on js ,css and png assets on apache

I am trying to enable browser leverage caching for my angular5 application. Files serve with apache Here is the configuration I've added in the vhost <IfModule mod_expires.c> ExpiresActive ...
0
votes
0answers
48 views

What's the “RequestHeader unset MYHEADER early” equivalent for IIS?

I need to protect some servers against the HTTPoxy attack but on IIS. I know that on Apache based Web Servers I can do something like: "RequestHeader unset MYHEADER early", and the key operative work ...
0
votes
2answers
69 views

Does it make sense to use both Varnish AND Browser caching?

I'm a bit confused about what the best practice is when using Varnish: I saw many sites where I know they were using Varnish, which had Cache-Control: no-store, no-cache, must-revalidate HTTP headers ...
0
votes
1answer
13 views

Unable to remove Server HTTP header with Varnish 5

I have the following vcl_deliver subroutine: sub vcl_deliver { # Remove some HTTP-headers: unset resp.http.Server; unset resp.http.X-Varnish; unset resp.http.Via; unset resp.http.X-Cacheable; ...
6
votes
3answers
453 views

Does it makes sense from a security perspective to remove the Server HTTP header?

I'm using Varnish and I'm not quite sure if I should also remove the Server: nginx HTTP header. Why do someone needs to know that I'm using NGINX? Is it ok to remove this HTTP header from the response ...
0
votes
0answers
25 views

Echo HTTP headers in tomcat possible?

I am currently on tomcat 8.5.31 and observing that tomcat instances are not returning "Content-Type" header in response even if it was sent in the request. This behavior is potentially breaking system ...
3
votes
1answer
1k views

How can I add in Apache Feature Policy Header?

I have a multimedia site which offers users to upload their own media (video,music) or embed media from sites like YouTube, Vimeo etc. Recently, new header is being announced. I tried to add this ...
0
votes
0answers
47 views

How to log outgoing HTTP requests (including headers) from an Apache reverse proxy

We have an Apache 2.4 instance set up which acts as a reverse proxy for multiple applications. In one of the virtual hosts I have configured it to set an additional HTTP header in a request before ...
1
vote
1answer
123 views

Nginx cache-control / expire headers will just not work

I've searched everywhere for a working answer to this issue, but none of the answers seem to work. I'm also sorry for the super long post but I just need to ask for help on this. I've tried to be as ...
0
votes
1answer
85 views

How to add vary custom header

My application is changing the content based on user country code. Please find server request flow diagram. https request -> nginx handle the ssl termination -> varnish -> if not cacheed, get ...
2
votes
1answer
290 views

HAProxy add some headers before 302 redirect

I'm trying to add some security headers to the responses that are directed to a specific port. I have the following configured frontend: frontend desenv_ext_1 bind *:80 bind *:443 ssl crt /etc/ssl/...
0
votes
0answers
31 views

How to surely tell if a static file is cached and optimised by CDN

I'm trying to use qiniu CDN to speed up my website in China and oversee. What I care most is the time when people load http://www.funfun.org.cn/1/#/home for the first time. To see how the website is ...
3
votes
2answers
543 views

HSTS in Nginx: should the Strict-Transport-Security header be added in subdomain server blocks too?

Let's take the following nginx.conf configuration file with server blocks for example.com and subdomain.example.com: http { ... server { listen [::]:80 ipv6only=off default_server; ...
0
votes
3answers
328 views

Disable server signature on nginx with modsecurity

I have compiled modsecurity and headers_more_module with nginx(1.13.6) on my ubuntu server. When modsecurity is not enabled at the nginx configuration, I am able to hide the origin server's name in ...
0
votes
0answers
48 views

Order of priority of response headers while deciding to cache a response in nginx

I'm trying to understand how nginx decides if it should cache a response when different response headers like X-Accel-Expires, Expires, Cache-Control, Set-Cookie, Vary are present and finally when ...
0
votes
0answers
16 views

Don't send expires header after break in nginx

location /home { if ($cookie_initd = 't') { return 302 https://example.com/home; break; } ssi on; ssi_types "*"; root $app_root; ...
0
votes
0answers
233 views

HAProxy + AWS Application Load Balancer

I have the following HAProxy config and when my clients come from an nginx proxy through the ALB (Application Load Balancer) then I can see their actual IP addresses (do not confuse ALB (Application), ...
1
vote
1answer
114 views

Nginx drops HTTPS from Akamai during rewrite

Akamai passes the HTTPS request to Nginx and Nginx drops HTTPS from the request as it performs a redirect. Here are the results from curl: $ curl -v -L https://oursite.com/life/facts-and-arguments/ ...
0
votes
1answer
77 views

Which HTTP header maps to Apache's %u log format token?

We have an httpd.conf that contains the following log format and uses the %u token for logging the remote user: LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %D" combined ...
0
votes
0answers
112 views

AWS ALB with IIS IP and Domain Restrictions

On our IIS web servers in AWS we have both public web applications and private once that we want to restrict access to from only our office networks. (And yes i know how silly it is to have internal ...
0
votes
1answer
182 views

Nginx image header cache not updating

I have an image file at https://www.example.com/img/bart-had-a-groove.gif And this is the only cache block in my site config, there is no caching settings in global nginx.conf. location ~* \.(?:jpg|...
1
vote
2answers
485 views

Apache Custom Header with an environment variable

I try to set a custom HTTP Header with an environment variable** with Apache server 2.4.6 and headers_module. I work inside a HTTP VHost on port 80. Everything work as expected with basic example ...
2
votes
1answer
1k views

Enable Both X-Real-IP and X-Forwarded-For in Nginx

How do I enable both X-Real-IP and X-Forwarded-For in Nginx? I currently have the following to get real IPs in Docker network. set_real_ip_from 172.18.0.0/32; real_ip_header X-Real-IP; ...
2
votes
1answer
210 views

Change Underscore to Dash in Apache Header

I have an application that runs behind Apache 2.4.27 that authenticates users with mod_auth_cas. This module stores attributes about the authenticated user in headers. I'm having issues with one ...
1
vote
0answers
218 views

PHP/Apache: multiple calls to header() doesn't work

In my PHP file I have this code (not the real code, just for demonstration purposes): ob_start(); var_export(headers_sent()); var_export(ob_get_status()); header('Content-Type: text/html'); header('...
1
vote
0answers
40 views

NGINX: How to add randomized headers to the responses

I have a list of pre-defined header messages. 1st message is bla bla 2nd message is bla bla 3rd message is bla bla 4th message is bla bla 5th message is bla bla I want to add a random one to the ...
0
votes
2answers
191 views

How to add a header in .htaccess bases on filetype (mime type)? [duplicate]

I would like to add two extra HTTP headers to all responses that are of filetype (mime type) text/html, but not other files. The current headers (edited): curl -I https://www...... HTTP/1.1 200 OK ...
0
votes
1answer
81 views

Apache header remove?

I have a case where a customer wants to remove the SAMEORIGIN header and add ALLOW-FROM. This is Apache 2.22 I have done this in both the http:// and https:// configurations: Header set X-Frame-...
0
votes
1answer
33 views

nginx: How can I add headers to both plain HTTP and HTTPS?

I specified the following in the http-block of /etc/nginx/nginx.conf: add_header X-Content-Type-Options nosniff always; add_header X-Frame-Options SAMEORIGIN always; add_header X-XSS-Protection "1; ...
6
votes
1answer
1k views

HTTP status code to signal bad or missing Host header

Is there an HTTP status code which is appropriate to use for clients which send a bad hostname (or none at all) through SNI or the HTTP Host header? An older question address how and why such ...
0
votes
0answers
189 views

Fauxton behind Nginx is not fully working, what are the expected headers?

Fauxton (CouchDB manager) behind Nginx is not fully working. Following Nginx block from CouchDB Wiki is not working at all: location /couchdb { rewrite /couchdb/(.*) /$1 break; proxy_pass ...
0
votes
0answers
83 views

IIS remove header before diagnosed as invalid

The reverse proxy (IIS ARR) gets http request with invalid encoded http headers. IIS Request Diagnostics: MODULE_SET_RESPONSE_ERROR_STATUS ModuleName="ApplicationRequestRouting", Notification="...
0
votes
1answer
46 views

What does a 404 response look like on embedded files

Say an image is embedded in webpage, but the image is not on the server, not found, and the server responds to requests for the image with a 404 error. The image is not displayed on the webpage, the ...
0
votes
1answer
41 views

Is there a reliable way to determine if a URL returns content or an error?

I've got a business requirement to run through a list of URLs and identify the ones that return an error. I've written a simple script that fetches the header for a particular url since I don't care ...
1
vote
1answer
754 views

Nginx rewrite http referer to https

I am using proxy_pass directive to upstream https server. The proxy server is meant for LAN clients. However I have a problem with the upstream django application rejecting http POST requests due to a ...
1
vote
0answers
359 views

Apache 2.4 + PHP-FPM + Chromelogger (how to increase HTTP header length limit?)

I have a running Apache 2.4 + PHP-FPM setup. There is one edge case though, when this setup fails - when using Chromelogger. Chromelogger is a server to client debugging tool, which sends it's data ...
2
votes
1answer
863 views

Nginx on CentOS: How can I change the “Server” header?

I'm running Nginx on Centos6. For security reasons I'd like to change/remove the Server HTTP header contained in the response headers. For instance,nginx's default Sever header looks like:I'm ...
0
votes
0answers
35 views

haproxy replace username with username@domain.com

Am very new to HAProxy so pardon my ignorance if the question is dumb. I have backend servers which runs Gerrit application and frontend is https that listens on 443 with an SSL cert. I don't use any ...
0
votes
0answers
64 views

Nginx response header last modifed

Sorry if this question has been asked many times, but I could not find any proper information on this topic in the nginx docs and Internet. Is the Last-Modified header added automatically to every ...
3
votes
2answers
723 views

Clear browser local cache by sending http headers?

I have modified js and css files in my website. But browser still fetch the contents from local cache because browser has stored it. I want to fetch the fresh content from the server without clearing ...
0
votes
0answers
167 views

Apache set custom header with an evironment variable

I'm trying to return custom header with value GEOIP_COUNTRY_CODE from Maxmind module. I've tried the following and nothing works # MaxMind Requirements: GeoIPEnable On GeoIPScanProxyHeaders On ...
0
votes
1answer
1k views

Nginx map directive only matching default

I'm using Nginx's map directive to route users to either stable or beta servers depending on the value of a custom http header. However, Nginx will only match to the default value, even when I've ...
1
vote
1answer
60 views

“WS” HTTP Headers

I am working with a website running on IIS8.5 and I am seeing a set of requests with what I will call "WS" request headers showing up in the serverVariables collection as follows: HTTP_WSHOST ...
0
votes
2answers
435 views

Adding HTTP Content-Type Header out of a file not working properly

I have a server running on Apache 2.4. Clients can upload files, which are only stored compressed. For every file is also created a textfile containing the mimetype of the file. When a client ...