Skip to main content

Questions tagged [http-headers]

HTTP header fields are components of the message header of requests and responses in the Hypertext Transfer Protocol (HTTP). They define the operating parameters of an HTTP transaction.

Filter by
Sorted by
Tagged with
0 votes
0 answers
26 views

Allow both `'Access-Control-Allow-Origin' '*'` and `Content-Security-Policy "frame-ancestors *"`

I have the following conf.d/prod.conf. It does not raise Refused to display 'https://v10.frontend.tech/' in a frame because it set 'X-Frame-Options' to 'sameorigin'. because of add_header Content-...
SoftTimur's user avatar
  • 357
0 votes
1 answer
121 views

Apache 2.4 Read from request header and set the same in response header

I am using Apache 2.4.6 I wanted to check if a custom header X-CUSTOM-HEADER is present in the request, if yes then set the same header and same value to the response. If the header is not present in ...
user1081692's user avatar
0 votes
0 answers
13 views

Config nginx proxy for tomcat app on Ubuntu [duplicate]

I have that config for nginx: server { listen 80; server_name myDomain; access_log /var/log/nginx/tomcat-access.log; error_log /var/log/nginx/tomcat-error.log; underscores_in_headers on; if ($...
Olexie Polishchyk's user avatar
0 votes
0 answers
11 views

When does HTTP server send response header Connection: <number> or TE?

I am confusing with a proprietary CWMP ACS sending me these values in the header. What's main purposes of that?
FAQ's user avatar
  • 117
-1 votes
1 answer
106 views

Nginx error "upstream prematurely closed FastCGI request while reading upstream" with generated file download

I just spent the whole day trying to figure out this error. We have a PHP script that generates a file for download. After upgrading nginx (1.16 -> 1.24), this script suddenly started randomly ...
Martin Mystik Jonáš's user avatar
0 votes
0 answers
81 views

Change server header on all endpoints (Flask + Nginx + Gunicorn)

I'm working on a Flask app that uses gunicorn and nginx and should hide its server header, so I managed to do it only for the homepage, like this: gunicorn.conf.py import gunicorn gunicorn.SERVER = '.'...
Juan C's user avatar
  • 113
0 votes
0 answers
136 views

PHP post data lost with Transfer-Encoding: chunked; Apache regression?

I am moving a PHP application from an older CentOS 7 server with Apache 2.4.6 and PHP 7.3.33 (mod_php) to a newer Alma Linux 9 server with Apache 2.4.57 and PHP 8.0.30 (PHP-FPM). This is a back-end ...
arlomedia's user avatar
  • 131
-1 votes
1 answer
49 views

What are cons of websockets? [closed]

I mean why at first place polling and server events exist if websocket can not only solve the problems they are solving but also allow additional functionalities (like bidirectional nature). I guess ...
SUNITA GUPTA's user avatar
0 votes
1 answer
96 views

How do I add a header to a single static file in IIS 10?

Server is Windows Server 2016 I need to serve a single static file with a different header than all the other files (Cache-Control: max-age=15) A different answer gives the leaf XML node as: <...
joshudson's user avatar
  • 422
0 votes
0 answers
31 views

ADFS does not send X-Frame-Options header

ADFS Server does not send the X-Frame-Options header, although it is configured on the server. (Get-AdfsResponseHeaders).ResponseHeaders Key Value --- -----...
David Trevor's user avatar
0 votes
0 answers
30 views

Placement of HTTP Headers in VirtualHost Containers?

Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" Header always set X-XSS-Protection "1; mode=block" Header always set X-Content-Type-...
Kejatz's user avatar
  • 1
0 votes
0 answers
407 views

Why does nginx as a reverse proxy not send Referrer-Policy header?

A bit of context : I'm using nginx as a reverse-proxy for a bunch of apps running in Docker containers. Among those apps there is Nextcloud (fpm), and the settings page complains about HTTP Referrer-...
Manumie's user avatar
  • 43
0 votes
0 answers
91 views

Is there a Apache module can fully log HTTP requests, in a non processed way?

I'm looking for an Apache module that is able to log the RAW content of HTTP requests, unprocessed. Here is one example : POST https://foobar/ HTTP/1.1 Host: foorbar Connection: keep-alive Content-...
tigrou's user avatar
  • 111
0 votes
1 answer
45 views

Nginx add_header Link not parsed by Lighthouse

I'm trying to investigate why Google isn't indexing some pages (allegedly, because they redirect) and, when using Lighthouse to check an example page, I see the following: Error parsing link header (...
knirirr's user avatar
  • 141
2 votes
0 answers
380 views

Why is CloudFront failing to pass a header from the origin to the client?

I have CloudFront configured with an API Gateway origin. In the application accessed via API Gateway, my application responds to a particular request with a Content-Disposition header so that the data ...
Bill's user avatar
  • 201
0 votes
0 answers
68 views

Setting a HTTP Header in ProxyPass to have dynamic route

I am setting up a request header using : RequestHeader set X_FIELD "expr=%{tolower:%{req:SOME-VAL}}" and want to send the value of this HTTP Header in ProxyPass. now I want to send the same ...
abhishek bhardwaj's user avatar
0 votes
0 answers
155 views

Do ETags generated on upstream need If-None-Match check? (NGINX)

(Reposting my post deleted after a year of inactivity) Let's assume I use etag off (and if_modified_since off with add_header Last-Modified "" to not make redundancy) in NGINX and I generate ...
Levi Pesin's user avatar
0 votes
1 answer
95 views

iptables string matching feasability; possible use with fail2ban

We have several Apache 2.4 web servers behind a load balancer and CDN front end - where HTTPS is terminated - we see the client IP in headers from the front end in the back end Apache logs. I'm ...
Special Monkey's user avatar
0 votes
2 answers
160 views

Apache/httpd 'Header set Server' is ignored/overridden

I am using this in a VirtualHost <IfModule headers_module> Header set ProcessingTime "%D" Header set Server "Apache 2.4" </IfModule> I can see that the ...
BairDev's user avatar
  • 125
2 votes
1 answer
983 views

Apache GZIP for images - any reason?

JPEG, GIF, PNG and WEBP images are already compressed. Is there any reason to serve them up using GZIP compression, regardless of whether or not the client says it may accept GZIP compression? curl -H ...
Lumi's user avatar
  • 199
2 votes
1 answer
1k views

Adding custom headers on error responses from haproxy

I have the following haproxy config that adds the access-control-allow-origin header on successful 200 requests with the below config. My problem is, when I hit timeouts or haproxy itself (not my ...
user avatar
0 votes
0 answers
34 views

Serving webpage in different language based on HTTP headers, using Apache negotiation module - shows dir listing only

I would like to configure Apache, such that when we send a request with a given language header, the server should send us back the right version. For example, I have index.eng.html and index.de.html. ...
mazix's user avatar
  • 65
0 votes
0 answers
14 views

How can I add the (virtual) ServerName value as customer Header in Apache2?

I would like to get the ServerName on the HTTP response of Apache in a custom header. Something like this: Header Set X-VirtualServerName "%{SERVERNAME}" Please consider this string can be ...
Tobia's user avatar
  • 1,322
0 votes
0 answers
204 views

Browser not sending username with request in HTTP headers

I'm facing an issue where the browser is not sending the username with the request headers in my web application. I've tried using Google chrome and Edge for testing purposes. I have observed this ...
logeeks's user avatar
  • 119
0 votes
1 answer
929 views

CORS access-control headers not visible in the response headers section of Chrome inspector

Using https://cors-test.codehappy.dev/ to test our test server's new CORS policy, we receive: These are the response headers received when making the request: access-control-allow-credentials: true ...
Steve's user avatar
  • 365
0 votes
1 answer
209 views

Caddyfile header directive unable to override file_server ETag

Invoking caddy run against the Caddyfile: http://localhost header ETag forcedValue file_server I expect curl -v http://localhost/Caddyfile to show a response with the ETag forcedValue. Instead, a ...
Charles Duffy's user avatar
0 votes
0 answers
111 views

Apache Server Config Set Headers Conditionally

I am trying to set cache age for 200 responses and no cache for rest of the calls. I tried below config, which works fine when 200 OK response comes up and I can see max-age=800 in headers But for ...
Vivek Dhiman's user avatar
0 votes
0 answers
947 views

Content-Security-Policy frame-ancestors not working

I'm running an OpenLiteSpeed server and would like to only allow webpages that start with a specific url on my site (e.g. https://example.com/video/**) to be iframed by others. (I want to allow anyone ...
harvey's user avatar
  • 101
0 votes
1 answer
769 views

Writing a RewriteRule based on X-Forwarded-Host

I have an Apache webserver behind a load balancer which proxies request to Apache and have problem regarding configuring directories. Here is my scenario: Upper Load Balancer proxies request to ...
Ageniz Shop's user avatar
1 vote
1 answer
2k views

Nginx - No last-modified or Etag response header on HTML

I am facing a rather odd issue with my web server. The server is configured with Ubuntu 20.04, Nginx v1.22.1, PHP 8.0, and MariaDB to host my WordPress website. The issue is, the server is not sending ...
Dhananjay Bhardwaj's user avatar
1 vote
1 answer
398 views

Cloudflare uncompressing, then re-compressing response bodies

I'm using Node.js/express and if I set the headers Content-Type: application/json Content-Encoding: gzip and send gzipped compressed bodies of JSON data, this works as expected - when not behind ...
Amaterasu's user avatar
  • 111
2 votes
1 answer
465 views

Are HTTP Headers configured by the CDN or by the application?

This is kind of a theoretical question, and I guess it may be too broad or unclear. Foobar is an application serving users across the internet. It relies on a CDN to improve its resiliency, speed, etc ...
SpiceTortilla's user avatar
1 vote
2 answers
5k views

Nginx not working with domain/url that points to server IP

The configuration I have set (below) works for localhost but not for my domain. The goal is to access port 3000 externally with basic auth so only I can access it. When I go to localhost, it is ...
Globe's user avatar
  • 11
0 votes
1 answer
167 views

Apache include value of %{TIME_YEAR} variable in an HTTP response header

I'm trying to do something like the following: <If "%{IPV6} == 'off'"> Header always set Attention "you are using still using IPV4 in %{TIME_YEAR}, please blahblah etc" <...
Displayname71's user avatar
0 votes
0 answers
1k views

How to set Access-Control-Allow-Origin for multiple origin domains with Tomcat?

An answer on SO to the same nice - and following guidelines - question but for Apache, how to set Access-Control-Allow-Origin entry header for multiple origin domains deals with .htaccess, checking ...
Amessihel's user avatar
  • 113
1 vote
1 answer
686 views

NGINX 302 redirect / proxy

I have an icecast server that runs on port 8000 however when I set up a proxy using NGINX I seem not to be able to make it look like it is the original server. I am wondering is there anyway to kinda ...
RussellHarrower's user avatar
-1 votes
1 answer
71 views

What is the web server software announcing itself as "VDL/1.0"?

I am looking at an old web form located at: http://www.teleservices.lyon.fr/etat-civil/naissance/ Of course, it is obsolete, bogus, without TLS, etc. But I don’t recognize the web server publishing it....
Damien Clauzel's user avatar
1 vote
1 answer
680 views

What is this formatting in the "Bearer" Authentication token of a HTTP get

I came across a "Bearer" Authentication in the header of a HTTP request (I want to understand an API) that I want to replicate. This is the header field: authentication : Bearer ...
tzippy's user avatar
  • 113
1 vote
0 answers
4k views

Nginx - remove HTTP Header from response

Hey guys. I have the following question: Is it possible to remove or change the value of a header that was added a few lines earlier? Here is the whole scenario: Setup my-website.com.conf ... server { ...
bananensplit's user avatar
2 votes
1 answer
5k views

Which static file types does Nginx generate ETags for by default?

In modern versions of Nginx, the ETag is automatically generated for static file types, even if you don't specifically enable the etag on in your location blocks or otherwise: https://nginx.org/en/...
Jesse Nickles's user avatar
1 vote
1 answer
487 views

NGINX byte-range requests are enabled but Pocket Casts still reports invalid headers

My NGINX web server has byte ranges enabled via add_header Accept-Ranges bytes; and I can successfully get byte ranges of podcast episodes via curl: $ curl -I -r 200-300 https://konradhoeffner.de/...
Konrad Höffner's user avatar
2 votes
0 answers
621 views

Are servers allowed to add a Content-Encoding header based on filename, if there is no compression on-the-fly?

Problem Suppose we have a compressed archive on disk, e.g. file.tar.gz, which should be served as-is. The file is served with Content-Type: application/gzip, but for some reason the server also adds a ...
djvg's user avatar
  • 139
0 votes
1 answer
188 views

Apache sends corrupted header [duplicate]

I have configured a basic virtual host just to be able to list a specific directory on the server. For the local files it’s working perfectly, but one of the folder listed at the root is a symlink to ...
gregseth's user avatar
  • 203
1 vote
0 answers
402 views

Set header for all except one location

I'd like to set a header on all page request except for one. I've tried the following: location ~ ^\/(?!allow-iframes) { add_header 'X-Frame-Options' 'DENY'; } This has some unexpected behavior. ...
Pardoner's user avatar
  • 137
1 vote
1 answer
4k views

How can I remove an accept-encoding request header in nginx?

The recent update to zlib due to a security hole appears to cause a major problem when serving PHP-FPM 8.0 via nginx on Ubuntu focal. Any requests with a gzip encoding fail right at the start of the ...
Synchro's user avatar
  • 3,230
1 vote
1 answer
1k views

Apache 2.4 .htaccess Set Headers for error pages

I am setting some headers using .htaccess for a web page, f. e.: <IfModule mod_headers.c> Header set Strict-Transport-Security "max-age=31536000; includeSubDomains" </IfModule> ...
MW.'s user avatar
  • 113
0 votes
0 answers
1k views

Setting "Content-Security-Policy default-src https:" breaks site

I need to set the Content-Security-Policy header to allow loading scripts from any HTTPS source. When I add the following line to my nginx configuration, the look and feel of the site breaks. What am ...
electrophile's user avatar
0 votes
2 answers
1k views

Apache: I cannot set full cache header for text/html using htaccess

I had a similar problem where I couldn't set the full cache header for JS and CSS files in my htaccess file, and it turned out I couldn't because the cache expiry was being set on the server and I had ...
228's user avatar
  • 1
2 votes
1 answer
337 views

is "access-control-allow-origin" a secure way to restrict communication between two servers?

I have two servers, A and B. I want server B to only accept HTTP requests from server A. is "access-control-allow-origin" a secure way to implement that?
Soroush Bgm's user avatar
0 votes
1 answer
1k views

Apache2.4 SetEnv to value of request header

I want to set the value of env with a request header. SetEnv X_THING %{req:thing} but it's not working as planned; it looks like the value of SetEnv isn't being evaluated.
Konchog's user avatar
  • 101

1
2 3 4 5
13