Questions tagged [http-headers]

HTTP header fields are components of the message header of requests and responses in the Hypertext Transfer Protocol (HTTP). They define the operating parameters of an HTTP transaction.

Filter by
Sorted by
Tagged with
0
votes
0answers
9 views

How can a mobile operator's web server seamlessly identify a user during HTTPS traffic?

For un-encrypted HTTP traffic, a networking component between the mobile handset and final web server adds the user's MSISDN into a HTTP header. But how does it work with HTTPS? I do believe it is ...
0
votes
0answers
17 views

Set custom headers during redirect in nginx

I have a pretty standard Symfony config in nginx set. I also have a pretty standard redirection from http to https: server { listen 80; ... if ($scheme = http) { return 301 https://$...
0
votes
0answers
14 views

nginx is not redirecting 302 redirect response to https

Hi I have nginx setup to redirect all port 80 requests to use https instead: server { listen 80; ... return 301 https://$host$request_uri; } Then I have all https requests route to my ...
1
vote
0answers
26 views

How to hide the IIS 8.5 Header when response code 403.7 is returned?

We have a ColdFusion 11 website, requiring client certificates, running on a publicly accessible Windows Server 2012R2 running IIS 8.5. There is a URL rewrite rule in place to remove the value set in ...
1
vote
2answers
67 views

How to prevent nginx reveals his private address?

I have nginx and a few web servers behind as you can see below: server { listen 80 default_server; server_name _; return 444; access_log /var/log/nginx/adefault....
0
votes
1answer
12 views

Expect-CT header: Is needed something special for report-uri?

I've was reading about the Expect-CT header (e.g. : Expect-CT - A new HTTP Security Header to be aware of ), For example in Apache: Expect-CT: max-age=0, report-uri="https://www.example.com/report" ...
0
votes
0answers
5 views

Upgrade-Insecure-Requests with lighttpd

I'm using lighttpd to serve a site over HTTP and HTTPS (the two versions are identical). I do not wish to stop serving it over HTTP or to forcibly redirect users to the HTTPS version, and I do not ...
0
votes
0answers
15 views

Extracting HTTP Host Header from nginx Stream Proxy

I'm looking to use the stream module of nginx to proxy HTTP traffic. This works well for HTTPS, as the ngx_stream_ssl_preread module exists. This allows me to extract the requested server name from ...
0
votes
2answers
55 views

Nginx return changes http response header content type from application/pdf to text/html

I want to redirect from this url: localhost:80/files/1.pdf to this url: localhost:80/viewer.html?pdf=/files/1.pdf I am using nginx return to do that: location ~* /files/(.+\.pdf)$ { return ...
0
votes
0answers
23 views

How do I configure an nginx ORIGIN server to return stale-if-error and cache directives?

I have an Nginx server serving a static site (but I'm generalizing the config to work for dynamic content, too). This is the origin server, not a proxy. I would like the nginx server to respond with ...
0
votes
0answers
34 views

Protect large file downloads through Apache / PHP

I need to provide large video files for download through my site, and the files need to be protected - I want to allow only authorised access through a logged in account, and I want to track when/...
0
votes
2answers
115 views

Custom headers in nginx: log first, clean afterwards

I need to parse nginx access_log and associate records with user accounts. To do so, I decided to use a custom header: App sends custom header (like x-userid) Nginx stores that value in access_log ...
1
vote
1answer
132 views

How to set the http_referrer in a htaccess redirect?

I have a new domain for my site and want to forward the user to this new site. So I set up a simple redirect in my .htaccess file likeI have a new domain for my site and want to forward the user to ...
1
vote
3answers
126 views

editing nginx http headers

we are trying to migrate from apache to nginx, and we have a setup where the proxy server receives an http header, modifies it and forwards it to the backend. This can easily be done with apache in ...
0
votes
1answer
74 views

Is it safe to use proxy_ignore_headers Vary?

I use a Nginx server that acts like a cache/reverse proxy for my Apache origin server. I was strugling to debug high rate of cache MISS when I found that it is because the response header Vary: ...
1
vote
1answer
43 views

Add header to every request for a sub directory

I've got a server configuration for a PHP application which has a general X-Frame-Options header set to "SAMEORIGIN". Except part of the application should be allowed to be included into an Iframe. ...
0
votes
1answer
1k views

Alter Nginx reverse proxy cache header from Public to Private

I have an Nginx cache server getting content from an origin server, the origin server sets Cache-Control to Public so my Nginx cache server can cache the content and make less requests to origin. But ...
0
votes
1answer
31 views

nginx http_push_preload and forwarding headers/cookies

I'm experimenting with pushing redirects using nginxs http2_push_preload on; directive. In my application I detect redirects and add a Link: <location>; as=document; rel=preload header that ...
0
votes
0answers
113 views

Modify proxied server response headers with nginx

I am coding a github client for fun and a little bit programming experience. GitHub API requires secret token which I don't want to store in my app or input every time. So I would like to bring up ...
0
votes
1answer
79 views

nginx - proxy_pass on user_agent

I have a SPA site, where I need to load the appropriate <meta> tags for each subpage, but it is not that easy from the subpages themselves so I made a separate address where Facebook or Twitter ...
1
vote
0answers
54 views

Can I configure Apache httpd to remove/replace all request headers that match a pattern?

I'm using Apache httpd as a reverse proxy in front of a web application. Authentication is carried out by a module (mod_auth_mellon), which sets various request environment variables with details ...
0
votes
0answers
37 views

I have put the following in the web.xml of my application to attempt to disallow PUT, DELETE, etc

I have put the following in the web.xml of my application to attempt to disallow PUT, DELETE, etc. but this below message shows HTTP/1.1 405 Method Not Allowed Server: Apache-Coyote/1.1 Allow: HEAD, ...
1
vote
1answer
232 views

nginx filtering headers with a dot in the header name, even after enabling ignore_invalid_headers

A client (developed by a third party) is sending a request with headers like foo.meta-digest (note the "dot" in the header name). My nginx reverse proxy is removing these headers from the request even ...
0
votes
0answers
15 views

prevent fiddler showing the response of my application

Is there a way to mask the server response from to the Fiddler, Suppose if I opened any website all responses it will show
0
votes
0answers
151 views

Azure Web App X-Forwarded-Proto header is always overwritten

I have an ASP.NET core application hosted on Azure Web Apps. This application has the Azure Frontdoor service sitting in front of it accepting connections and reverse proxying back to the application....
2
votes
0answers
405 views

How to configure Content-Security-Policy for Nginx and Drupal 8?

I have a Nginx server with Ubuntu 18.04 and a Drupal 8 site. I have read on several articles that should not use 'unsafe-eval', 'unsafe-inline' I added headers for security but the pages of the site ...
0
votes
0answers
27 views

BigIP Access Policy for Kerberos Negotiate and Basic as fallback

In BigIP 12, an Access Policy allows to support both Kerberos HTTP Negotiate and Basic thanks to HTTP 401 Response bloc in mode basic+negotiate. Reference: https://techdocs.f5.com/kb/en-us/products/...
0
votes
0answers
158 views

AWS Application Load Balancer returns '412 Precondition Failed' when a conditional header is present

I have an ALB with a Lambda as a target. The lambda is a simple Python one and the only thing it does, is a return of a hardcoded dict. The response is a valid response for ALB and includes Etag ...
0
votes
1answer
473 views

Allow requests only for specific referer within domain

please consider following scenario: I have an API running on the same server as IIS. IIS is hosting a webpage. I want to allow access to the API to this webpage only. No other page from within the ...
-2
votes
1answer
124 views

I can see HTTP/2 headers with curl. But, if this protocol works with frames and binary numbers: shouldn't these headers be “invisible”?

HTTP/2 has several differences with respect to HTTP/1.1. One of them is the use of frames, binary numbers and compression to optimize the headers. However, when I use "curl -v --http2" against a ...
0
votes
0answers
6 views

How to set Http Caching Headers to respect File Modifications

I want to achieve that browsers check the ETag of static files (images, styles, scripts) on each page-load and then decide whether to use the cached version or load the new one from the server. In ...
0
votes
1answer
31 views

Is it possible to import header from file - nginx?

Just started using my very first nginx server and I have added few header, but I was wondering, is it possible somehow to import those headers from different file? Let,s say, I have a _headers file ...
0
votes
2answers
45 views

HTTP Protocol: TLS/Requests/Responses classification after invoking the GET request method in curl

First of all, sorry for the inconvenience. I don't know if this is the right forum, but I've read several threads and there are some very expert people on this subject, so maybe one of them can help ...
1
vote
1answer
138 views

NGINX: Block “wp-login.php”, but allow “wp-login.php?action=logout&redirect_to=…”

I'm blocking access to wp-login.php via NGINX like this (only one IP address is allowed): location ~ ^/wp-login.php { allow 12.12.12.12; deny all; try_files $uri $uri/ /index.php?$args; ...
-1
votes
2answers
554 views

How to add a header to my apache2 server

I have an apache2 web server for testing only (not a production server). It is running on Ubuntu 18.04. I have configured it with TLS. I want to add a header. So I navigated to this file: /etc/...
0
votes
1answer
37 views

When using the curl -v -i command in the Ubuntu Terminal the server responses are duplicated. why?

I'm doing university work on the HTTP protocol and I want to explain "visually" how an HTTP connection occurs between a client and a server. To do this, I use in the Ubuntu terminal (which I have ...
0
votes
3answers
53 views

Is RFC 7231 the latest version about the HTTP/1.1 protocol?

I'm doing an university work on HTTP and I try to explain what happens when there is an HTTP connection between a client and a server. To do this, I'm using the "curl -v -i" command on an Ubuntu ...
1
vote
1answer
85 views

“Report-To” HTTP header implementation for GAE Standard

I'm attempting to add a "Report-To:" HTTP header to our App Engine's app.yaml configuration file for integration with https://report-uri.com (based on the Reporting API here, here, and here) but when ...
0
votes
0answers
131 views

NodeJS: HTTP header undefined

I'm using Flow to send an HTTP with this example body: { "$content-type": "multipart/form-data", "$multipart": [ { "headers": { "Email-To": "test@email.no", "Content-...
0
votes
1answer
807 views

CORS policy: No 'Access-Control-Allow-Origin' for JSON files

I kept a JSON files in Server A, ip : 111.111.111.111/folder1/a.json From Server B [ ip : 444.444.444.444 ], I am trying to access that JSON file , I received the result below: Access to ...
0
votes
2answers
1k views

How to keep Authentication header with redirect using NGINX ingress annotations

I have an nginx ingress controller for my kubernetes cluster. I have a need to add a permanent redirect to an ingress which I can successfully do with nginx.ingress.kubernetes.io/permanent-redirect: "...
0
votes
1answer
163 views

Nginx multiple Link headers in same request

In Apache if I make a request that contains multiple Link headers, it will merge them into one comma separated list. In nginx, if I make the same request all but the last are discarded For example, ...
0
votes
0answers
116 views

Apache httpd setting a custom header prefix

I'm using apache httpd24 to extract the headers from aws cognito and pass it to a JAVA application. AWS is sending me the following headers: username email firstname family_name And my target ...
0
votes
0answers
27 views

Can I get the CRC32C checksum of a range content when I use HTTP Range Get requests to get a range of content in google cloud storage

When I want to get a partial range of file content in the google cloud storage, I used XML API and use HTTP Range Get requests. From the google cloud response, I can find the header x-goog-hash, and ...
0
votes
0answers
27 views

Read-only Access to Kibana/ESAAS

Allowing "GET" Operations only via a group is breaking kibana access. When user accesses kibana with credentials; the "discover" page is not displayed. The page "Localhost:5601/app/kibana#/discover?_g"...
0
votes
0answers
81 views

Apache. How to set header conditional on Content-Length?

I need to "Header unset Content-Length" for the files bigger then 2147483647. Is it possible to setup conditional unset ? apache2.4 on 32bit system any suggestions appreciated.
1
vote
1answer
946 views

nginx reverse proxy with named location: how to override backend header?

I'm having a difficult time getting add_header to work when try_files is used to send requests to a named location which specifies a backend with proxy_pass. Basically, I want to override Content-...
0
votes
0answers
219 views

Chrome err_spdy_protocol_error and Firefox using spdy without according headers

On Chrome, when calling my webpage, I get a err_spdy_protocol_error page. Also, an nginx ssl handshake error is thrown. This got me thinking, why is Chrome using SPDY to call my page and why does it ...
1
vote
1answer
590 views

How do allow fontawesome as a style-src in my Content-Security-Policy?

I'm trying to set my Content-Security-Policy header in .htaccess. I've already tried a variation of the answer to this post but it doesnt work. All my fontawesome icons are broken. Header always set ...
2
votes
1answer
320 views

nginx - Security headers within location block?

I have been testing the security headers (https://securityheaders.com) of my nginx setup and wanted to check peoples opinion with nginx suffix location blocks. Currently, I get 'A+' for http(s)://my....

1
2 3 4 5
12