Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [http-headers]

HTTP header fields are components of the message header of requests and responses in the Hypertext Transfer Protocol (HTTP). They define the operating parameters of an HTTP transaction.

0
votes
0answers
11 views

HAProxy rate limiting per URL, with client IP in custom header set by reverse proxy

In our current setup CloudFlare is used as a DNS level load balancer, in front of our HAProxy load balancers, which further route requests to our NginX application servers. We only server dynamic ...
0
votes
0answers
19 views

Rewrite URL and setting accept-language header

I am trying to serve accept-language header-dependent static files, while the URL should always look the same. The important snippet of the apache 2.4.10 config: ... RewriteEngine On RewriteCond %{...
-1
votes
1answer
46 views

Apache header editing

I have setup with apache (apache 2.4, redhat 7.6) reverse proxy in front of the JVM. Apache has basic authentication setup on it. The problem is that Apache header with info about basic ...
0
votes
1answer
42 views

Can NGINX “proxy_cache_valid” be relative to Last-Modified instead of time received?

I've been beating my head against the wall trying to get live DASH and HLS video streams to be cached correctly by an NGINX caching HTTPS reverse-proxy server. My current thinking is that my main ...
1
vote
0answers
54 views

nginx hotlink protection for missing referer, but allow direct URL request

I'm using the following hotlink protection for Nginx I found from this page: https://nixcp.com/anti-hotlinking-nginx/ I use this code: location ~* \.(gif|jpg|jpeg|png|webp|svg|ico)$ { ...
0
votes
0answers
42 views

Enterprise customer seems to remove or break HTTP headers

Our web application makes HTTP requests to our API hosted on the same domain as the app assets. We use JWTs for authentication (encrypted token attached in a HTTP header included with every API ...
0
votes
1answer
15 views

Change a header (default type) of specific file type called in admin section of website (nested configuration?)

How could I change header (default type) of js files with the admin pages ? location /admin { #forwarded to varnish proxy_pass http://specificurl:81/admin # not working when reloading ...
0
votes
0answers
627 views

Windows-1251 and HTTP Content-Type

If "Windows-1251" appears as part of the HTTP response header "content-type", does this indicate that the server is running on Windows and not Linux? I ask this because it is my understanding that in ...
3
votes
1answer
87 views

ExpiresByType “access plus 1 month” results in 1 year expires header

I have implemented resourec expiry with the following set up <IfModule mod_expires.c> ExpiresActive On ExpiresByType image/jpg "access plus 1 year" ExpiresByType image/jpeg "access ...
2
votes
1answer
49 views

Apache Underscore in Header is overwriten

I've a service which sets the header x-user_type. Since Apache2.4.33 cannot use this, i'll transform this with the following in a .htaccess: <IfModule mod_headers.c> <IfModule ...
1
vote
1answer
97 views

Rewriting client “Host” http header before nginx validates the field

I get following request from a device and should proxy it to hd10.vtech.com: GET http://hd10.vtech.com/test/pp_firmware/HD10-CH010_SUOTA.bin HTTP/1.1 Host: http://hd10.vtech.com/test/...
0
votes
0answers
47 views

how to write a Nginx server block based on port in host header?

I would like to respond with different HTTP status code based on "port" in HTTP host header. The Host header looks like this : GET / HTTP/1.1 Host: 10.0.200.18:80 Connection: close I wrote a server ...
1
vote
1answer
33 views

Overwrite HTTP headers comming back from a web application server proxied in nginx

I have a web application server reverse-proxied behind nginx 1.15 like so: location / { proxy_pass https://some.awesome.IP:8080; proxy_set_header Host $host; proxy_set_header X-...
0
votes
1answer
54 views

Curl fetch only headers without head

On our company servers due to security purposes our main SysAdmin only allows a few HTTP methods to pass through like (GET, POST, OPTIONS, PUT, etc.) and HEAD is not one of them. I implemented Zabbix ...
0
votes
0answers
86 views

setup x-frame-options under redirection header for nginx

I have below configuration in nginx.conf file for the Rails(3.2) application. For localhost:5478 in prod the response headers of page contain x-frame-options while the ports 5479-82 when accessed ...
0
votes
2answers
188 views

add_header not working in Nginx location

So, I've been trying to figure this out for the past 8 hours, but it seems I'm stuck... I have the following Nginx config file: server_tokens off; upstream php-handler { server unix:/var/run/php5-...
0
votes
0answers
35 views

Browser livarage cache failed on js ,css and png assets on apache

I am trying to enable browser leverage caching for my angular5 application. Files serve with apache Here is the configuration I've added in the vhost <IfModule mod_expires.c> ExpiresActive ...
0
votes
0answers
85 views

What's the “RequestHeader unset MYHEADER early” equivalent for IIS?

I need to protect some servers against the HTTPoxy attack but on IIS. I know that on Apache based Web Servers I can do something like: "RequestHeader unset MYHEADER early", and the key operative work ...
0
votes
2answers
153 views

Does it make sense to use both Varnish AND Browser caching?

I'm a bit confused about what the best practice is when using Varnish: I saw many sites where I know they were using Varnish, which had Cache-Control: no-store, no-cache, must-revalidate HTTP headers ...
0
votes
1answer
70 views

Unable to remove Server HTTP header with Varnish 5

I have the following vcl_deliver subroutine: sub vcl_deliver { # Remove some HTTP-headers: unset resp.http.Server; unset resp.http.X-Varnish; unset resp.http.Via; unset resp.http.X-Cacheable; ...
6
votes
3answers
500 views

Does it makes sense from a security perspective to remove the Server HTTP header?

I'm using Varnish and I'm not quite sure if I should also remove the Server: nginx HTTP header. Why do someone needs to know that I'm using NGINX? Is it ok to remove this HTTP header from the response ...
0
votes
0answers
38 views

Echo HTTP headers in tomcat possible?

I am currently on tomcat 8.5.31 and observing that tomcat instances are not returning "Content-Type" header in response even if it was sent in the request. This behavior is potentially breaking system ...
3
votes
1answer
4k views

How can I add in Apache Feature Policy Header?

I have a multimedia site which offers users to upload their own media (video,music) or embed media from sites like YouTube, Vimeo etc. Recently, new header is being announced. I tried to add this ...
0
votes
0answers
179 views

How to log outgoing HTTP requests (including headers) from an Apache reverse proxy

We have an Apache 2.4 instance set up which acts as a reverse proxy for multiple applications. In one of the virtual hosts I have configured it to set an additional HTTP header in a request before ...
1
vote
1answer
522 views

Nginx cache-control / expire headers will just not work

I've searched everywhere for a working answer to this issue, but none of the answers seem to work. I'm also sorry for the super long post but I just need to ask for help on this. I've tried to be as ...
0
votes
1answer
157 views

How to add vary custom header

My application is changing the content based on user country code. Please find server request flow diagram. https request -> nginx handle the ssl termination -> varnish -> if not cacheed, get ...
2
votes
1answer
672 views

HAProxy add some headers before 302 redirect

I'm trying to add some security headers to the responses that are directed to a specific port. I have the following configured frontend: frontend desenv_ext_1 bind *:80 bind *:443 ssl crt /etc/ssl/...
0
votes
0answers
31 views

How to surely tell if a static file is cached and optimised by CDN

I'm trying to use qiniu CDN to speed up my website in China and oversee. What I care most is the time when people load http://www.funfun.org.cn/1/#/home for the first time. To see how the website is ...
4
votes
2answers
990 views

HSTS in Nginx: should the Strict-Transport-Security header be added in subdomain server blocks too?

Let's take the following nginx.conf configuration file with server blocks for example.com and subdomain.example.com: http { ... server { listen [::]:80 ipv6only=off default_server; ...
0
votes
3answers
668 views

Disable server signature on nginx with modsecurity

I have compiled modsecurity and headers_more_module with nginx(1.13.6) on my ubuntu server. When modsecurity is not enabled at the nginx configuration, I am able to hide the origin server's name in ...
0
votes
0answers
83 views

Order of priority of response headers while deciding to cache a response in nginx

I'm trying to understand how nginx decides if it should cache a response when different response headers like X-Accel-Expires, Expires, Cache-Control, Set-Cookie, Vary are present and finally when ...
0
votes
0answers
51 views

Don't send expires header after break in nginx

location /home { if ($cookie_initd = 't') { return 302 https://example.com/home; break; } ssi on; ssi_types "*"; root $app_root; ...
0
votes
0answers
368 views

HAProxy + AWS Application Load Balancer

I have the following HAProxy config and when my clients come from an nginx proxy through the ALB (Application Load Balancer) then I can see their actual IP addresses (do not confuse ALB (Application), ...
1
vote
1answer
169 views

Nginx drops HTTPS from Akamai during rewrite

Akamai passes the HTTPS request to Nginx and Nginx drops HTTPS from the request as it performs a redirect. Here are the results from curl: $ curl -v -L https://oursite.com/life/facts-and-arguments/ ...
0
votes
1answer
174 views

Which HTTP header maps to Apache's %u log format token?

We have an httpd.conf that contains the following log format and uses the %u token for logging the remote user: LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %D" combined ...
0
votes
0answers
154 views

AWS ALB with IIS IP and Domain Restrictions

On our IIS web servers in AWS we have both public web applications and private once that we want to restrict access to from only our office networks. (And yes i know how silly it is to have internal ...
0
votes
1answer
300 views

Nginx image header cache not updating

I have an image file at https://www.example.com/img/bart-had-a-groove.gif And this is the only cache block in my site config, there is no caching settings in global nginx.conf. location ~* \.(?:jpg|...
1
vote
2answers
2k views

Apache Custom Header with an environment variable

I try to set a custom HTTP Header with an environment variable** with Apache server 2.4.6 and headers_module. I work inside a HTTP VHost on port 80. Everything work as expected with basic example ...
2
votes
2answers
2k views

Enable Both X-Real-IP and X-Forwarded-For in Nginx

How do I enable both X-Real-IP and X-Forwarded-For in Nginx? I currently have the following to get real IPs in Docker network. set_real_ip_from 172.18.0.0/32; real_ip_header X-Real-IP; ...
3
votes
1answer
304 views

Change Underscore to Dash in Apache Header

I have an application that runs behind Apache 2.4.27 that authenticates users with mod_auth_cas. This module stores attributes about the authenticated user in headers. I'm having issues with one ...
1
vote
0answers
285 views

PHP/Apache: multiple calls to header() doesn't work

In my PHP file I have this code (not the real code, just for demonstration purposes): ob_start(); var_export(headers_sent()); var_export(ob_get_status()); header('Content-Type: text/html'); header('...
1
vote
0answers
54 views

NGINX: How to add randomized headers to the responses

I have a list of pre-defined header messages. 1st message is bla bla 2nd message is bla bla 3rd message is bla bla 4th message is bla bla 5th message is bla bla I want to add a random one to the ...
0
votes
2answers
534 views

How to add a header in .htaccess bases on filetype (mime type)? [duplicate]

I would like to add two extra HTTP headers to all responses that are of filetype (mime type) text/html, but not other files. The current headers (edited): curl -I https://www...... HTTP/1.1 200 OK ...
0
votes
1answer
101 views

Apache header remove?

I have a case where a customer wants to remove the SAMEORIGIN header and add ALLOW-FROM. This is Apache 2.22 I have done this in both the http:// and https:// configurations: Header set X-Frame-...
0
votes
1answer
34 views

nginx: How can I add headers to both plain HTTP and HTTPS?

I specified the following in the http-block of /etc/nginx/nginx.conf: add_header X-Content-Type-Options nosniff always; add_header X-Frame-Options SAMEORIGIN always; add_header X-XSS-Protection "1; ...
6
votes
1answer
2k views

HTTP status code to signal bad or missing Host header

Is there an HTTP status code which is appropriate to use for clients which send a bad hostname (or none at all) through SNI or the HTTP Host header? An older question address how and why such ...
0
votes
0answers
257 views

Fauxton behind Nginx is not fully working, what are the expected headers?

Fauxton (CouchDB manager) behind Nginx is not fully working. Following Nginx block from CouchDB Wiki is not working at all: location /couchdb { rewrite /couchdb/(.*) /$1 break; proxy_pass ...
0
votes
0answers
122 views

IIS remove header before diagnosed as invalid

The reverse proxy (IIS ARR) gets http request with invalid encoded http headers. IIS Request Diagnostics: MODULE_SET_RESPONSE_ERROR_STATUS ModuleName="ApplicationRequestRouting", Notification="...
0
votes
1answer
50 views

What does a 404 response look like on embedded files

Say an image is embedded in webpage, but the image is not on the server, not found, and the server responds to requests for the image with a 404 error. The image is not displayed on the webpage, the ...
0
votes
1answer
48 views

Is there a reliable way to determine if a URL returns content or an error?

I've got a business requirement to run through a list of URLs and identify the ones that return an error. I've written a simple script that fetches the header for a particular url since I don't care ...