Questions tagged [http-headers]

HTTP header fields are components of the message header of requests and responses in the Hypertext Transfer Protocol (HTTP). They define the operating parameters of an HTTP transaction.

Filter by
Sorted by
Tagged with
0
votes
1answer
22 views

How to send a HTTP header on all server blocks in nginx?

Let's say I have a running nginx instance with several server blocks (on a linux server), and that I would like to send an extra HTTP header like Permissions-Policy: interest-cohort=() on all ...
-1
votes
0answers
16 views

How to configure a local proxy to send custom header request?

i'm doing some tests on a webpage using jmeter and selenium. What i need to do is to send some custom header request and i would like to do it by using a proxy server in local. For several reasons i ...
0
votes
0answers
19 views

Nginx: block requests with empty http_user_agent header but allow for specific location

So i have this directive in my server block if ($http_user_agent = "") { return 403; }, but I want to allow empty http_user_agent for example.com/web/app/delete. How do i do that?
-1
votes
0answers
21 views

x-fastcgi-cache header is not working

I have an issue running a LEMP stack on Ubuntu20.04 where I want to test that fastcgi-cache is working, but the x-fastcgi-cache header information is not being sent with curl request. This is a ...
-1
votes
1answer
27 views

Can the Upgrade: header have spaces between the comma?

So, I see that Apache, by default shows the Upgrade header like this: Upgrade: h2,h2c Is this header below also valid?: Upgrade: h2, h2c Are spaces allowed between the commas in the Upgrade header? ...
0
votes
0answers
44 views

How to set the HTTP headers “X-Forwarded-Context” or “X-Forwarded-Prefix” with IIS reverse proxy

I try to configure a reverse proxy in the IIS. This required to set some HTTP headers. I was able to add the follow HTTP headers: X-Forwarded-Proto X-Forwarded-Port X-Forwarded-Host This is possible ...
2
votes
0answers
28 views

relayd to match http request according to path and change headers

I have, on OpenBSD, relayd in front of a website. The thing redirect static requests to httpd and dynamic requests to an app running on localhost port 9000 (I wish to avoid revealing the name so I can ...
0
votes
0answers
19 views

asp.net Secure Cookies behind load balancer

This is a hybrid MVC/webforms asp.net application using framework 4.8, forms authentication and Membership. I need to implement secure cookies. The web site is behind a Coyote load balancer which I ...
0
votes
0answers
11 views

How to get nginx to strip cookies except for an allow list?

I'm trying to host sites that use things like WordPress, using nginx as a reverse proxy for PHP-FPM. Often these systems will set all kinds of annoying cookies that are unnecessary and/or the site ...
1
vote
0answers
115 views

How to whitelist Authorization header in CloudFront custom Origin Request Policy?

I have created the following CloudFront Origin Request Policy: I need Authorization header (without Authorization header the AntiForgeryToken header is not forwarded) but I do not understand why ...
0
votes
0answers
47 views

How can we capture the REQUEST_URI into an Apache variable and after third party SSO authentication?

How can we capture the REQUEST_URI into an Apache variable and after third party SSO authentication? We have a third party SSO authentication in place, which is working fine. After successful ...
1
vote
1answer
102 views

Nginx removes post data with content-type header

I am making posts like this: curl 'http://localhost/api.php' -H 'Content-Type: application/json' --data 'names=[{"name":"name"}]' Which results in the post data being deleted. If ...
0
votes
0answers
52 views

Http response header to be returned on request for 206 status

I am facing a performance issue with my Nodejs server, i am getting a Big document from S3 (200mb+) by ID. when client sends the request i take the ID and query a local table on my data base to get ...
0
votes
1answer
60 views

Sending cache headers only for a single request [or for a request following a certain path string]

I have the proxy pass in nginx config defined as follows: location / { proxy_pass http://localhost:3001; proxy_set_header Host $host; proxy_set_header X-Forwarded-For $...
0
votes
0answers
34 views

Are requests with no headers a sign of hacking?

I run a NodeJS web application with packages up to date and secured with a strong password and RSA for ssh. The application runs on two domains. I check the request headers to get the domain and found ...
0
votes
1answer
86 views

NGINX: How to allow full access if a certain HTTP header is set, else trigger HTTP Basic Authentication

As the question implies I want to allow full access to my website if the X-Auth HTTP header is set and contains a specific string. If this is not the case, HTTP basic authentication should be ...
0
votes
0answers
41 views

Append to header if it does not contain the key

I'm running Apache 2.4.4 and PHP. I have very restrictive default headers for the Content-Security-Policy and the Feature Policy which need to be lifted by PHP dynamically. I'm currently using this ...
0
votes
0answers
18 views

IIS Server Farm Dropping Server Variables From SSO

I have an application that looks for server variables such as REMOTE_USER provided by Single Sign On. I have IIS acting as a reverse proxy to my application which is in a server farm. If I create a ...
2
votes
0answers
929 views

List of all Permissions-Policy header keys and values?

Does someone have a list of all Permissions-Policy header keys and values? What I have: more_set_headers "Permissions-Policy: camera=(self), fullscreen=(*), geolocation=(self), payment=()"; ...
0
votes
1answer
51 views

HAProxy 1.5 - Show Server Name or IP Address in response while behind DNS

Basically exactly what the title is. I have haproxy fronting a server, and infront of that a DNS to provide a human readable name. I would like to setup haproxy to include either the responding ...
0
votes
0answers
120 views

(Reverse Proxy) Apache REMOTE_ADDR Returns (null)

I have a server that sits behind a reverse proxy that require client IP address, and to achieve that I'm trying with the lines below to add X-Forwarded-For in the request header, RequestHeader set &...
0
votes
0answers
146 views

Feature-Policy fullscreen not working as expected

I have NGINX running as a reverse proxy and set the Feature-Policy header with fullscreen to "self". The site itself contains the HTML5 video player, but unless I set fullscreen to "*&...
0
votes
1answer
205 views

My browser keeps showing cached page despite sending no-cache, no-store, must-revalidate from server in response header

The content on our pages keep changing and hence we do not want the browser to cache the page or show cached page or our users. But the browser keeps showing cached page despite sending no-cache, no-...
0
votes
1answer
95 views

Why does Firefox still make connections to server although the HTTP resources are shown as “cached”?

I am confused by the way Firefox shows loaded resources as cached but then I can see the browser issues new DNS query for the domain name and contact the HTTP server again. Below is a simple example ...
0
votes
2answers
886 views

nginx remove header from upstream

I have nginx with upstream. The upstream sets headers: Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Because I want this page to be cached,...
0
votes
0answers
15 views

Apache2 : How to ignore request based on header value

Let's say a device sends an HTTP request with this header : X-Request-Source-Id : abc123 In apache2 configuration, is it possible to ignore request if the header X-Request-Source-Id is null or does ...
0
votes
0answers
68 views

Modify Cache-Control header based on condition over other header in Nginx

In a Nginx working as a proxy, I need to set the "Cache-Control" header on a response based on the size defined on their "content-length". For example, if the response have "...
1
vote
1answer
90 views

How can I apply HSTS header to all vhosts over 443 in Apache

I'm looking to add the HSTS header in Apache... # HSTS / Header Strict Transport Security Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" ... but ...
0
votes
0answers
9 views

Request “wait” time is high. Do you see any issue with this HTTP2.0 header?

In my website, only one request,(ie. the root request) is taking more time. Especially the "wait" time is high. The HTTP2.0 Header for the request that is taking more time is posted below. ...
0
votes
0answers
46 views

Nginx proxy pass to apache server only works with trailing slash in URL

On the main server/domain, I am running an Apache server in a VM, this is accessed via x.com/sub. Nginx on the main server checks the URI and does a proxy pass for /sub to the VM running Apache. ...
0
votes
0answers
12 views

How can a mobile operator's web server seamlessly identify a user during HTTPS traffic?

For un-encrypted HTTP traffic, a networking component between the mobile handset and final web server adds the user's MSISDN into a HTTP header. But how does it work with HTTPS? I do believe it is ...
0
votes
0answers
90 views

Set custom headers during redirect in nginx

I have a pretty standard Symfony config in nginx set. I also have a pretty standard redirection from http to https: server { listen 80; ... if ($scheme = http) { return 301 https://$...
0
votes
1answer
625 views

nginx is not redirecting 302 redirect response to https

Hi I have nginx setup to redirect all port 80 requests to use https instead: server { listen 80; ... return 301 https://$host$request_uri; } Then I have all https requests route to my ...
1
vote
0answers
148 views

How to hide the IIS 8.5 Header when response code 403.7 is returned?

We have a ColdFusion 11 website, requiring client certificates, running on a publicly accessible Windows Server 2012R2 running IIS 8.5. There is a URL rewrite rule in place to remove the value set in ...
1
vote
2answers
226 views

How to prevent nginx reveals his private address?

I have nginx and a few web servers behind as you can see below: server { listen 80 default_server; server_name _; return 444; access_log /var/log/nginx/adefault....
0
votes
1answer
95 views

Expect-CT header: Is needed something special for report-uri?

I've was reading about the Expect-CT header (e.g. : Expect-CT - A new HTTP Security Header to be aware of ), For example in Apache: Expect-CT: max-age=0, report-uri="https://www.example.com/report" ...
0
votes
0answers
30 views

Upgrade-Insecure-Requests with lighttpd

I'm using lighttpd to serve a site over HTTP and HTTPS (the two versions are identical). I do not wish to stop serving it over HTTP or to forcibly redirect users to the HTTPS version, and I do not ...
0
votes
1answer
288 views

Extracting HTTP Host Header from nginx Stream Proxy

I'm looking to use the stream module of nginx to proxy HTTP traffic. This works well for HTTPS, as the ngx_stream_ssl_preread module exists. This allows me to extract the requested server name from ...
0
votes
2answers
717 views

Nginx return changes http response header content type from application/pdf to text/html

I want to redirect from this url: localhost:80/files/1.pdf to this url: localhost:80/viewer.html?pdf=/files/1.pdf I am using nginx return to do that: location ~* /files/(.+\.pdf)$ { return ...
1
vote
2answers
4k views

Custom headers in nginx: log first, clean afterwards

I need to parse nginx access_log and associate records with user accounts. To do so, I decided to use a custom header: App sends custom header (like x-userid) Nginx stores that value in access_log ...
1
vote
1answer
1k views

How to set the http_referrer in a htaccess redirect?

I have a new domain for my site and want to forward the user to this new site. So I set up a simple redirect in my .htaccess file likeI have a new domain for my site and want to forward the user to ...
1
vote
3answers
1k views

editing nginx http headers

we are trying to migrate from apache to nginx, and we have a setup where the proxy server receives an http header, modifies it and forwards it to the backend. This can easily be done with apache in ...
1
vote
1answer
674 views

Is it safe to use proxy_ignore_headers Vary?

I use a Nginx server that acts like a cache/reverse proxy for my Apache origin server. I was strugling to debug high rate of cache MISS when I found that it is because the response header Vary: ...
1
vote
1answer
304 views

Add header to every request for a sub directory

I've got a server configuration for a PHP application which has a general X-Frame-Options header set to "SAMEORIGIN". Except part of the application should be allowed to be included into an Iframe. ...
0
votes
1answer
2k views

Alter Nginx reverse proxy cache header from Public to Private

I have an Nginx cache server getting content from an origin server, the origin server sets Cache-Control to Public so my Nginx cache server can cache the content and make less requests to origin. But ...
0
votes
1answer
84 views

nginx http_push_preload and forwarding headers/cookies

I'm experimenting with pushing redirects using nginxs http2_push_preload on; directive. In my application I detect redirects and add a Link: <location>; as=document; rel=preload header that ...
0
votes
0answers
270 views

Modify proxied server response headers with nginx

I am coding a github client for fun and a little bit programming experience. GitHub API requires secret token which I don't want to store in my app or input every time. So I would like to bring up ...
0
votes
1answer
879 views

nginx - proxy_pass on user_agent

I have a SPA site, where I need to load the appropriate <meta> tags for each subpage, but it is not that easy from the subpages themselves so I made a separate address where Facebook or Twitter ...
1
vote
1answer
547 views

Can I configure Apache httpd to remove/replace all request headers that match a pattern?

I'm using Apache httpd as a reverse proxy in front of a web application. Authentication is carried out by a module (mod_auth_mellon), which sets various request environment variables with details ...
0
votes
0answers
39 views

I have put the following in the web.xml of my application to attempt to disallow PUT, DELETE, etc

I have put the following in the web.xml of my application to attempt to disallow PUT, DELETE, etc. but this below message shows HTTP/1.1 405 Method Not Allowed Server: Apache-Coyote/1.1 Allow: HEAD, ...

1
2 3 4 5
12