Questions tagged [http-headers]
HTTP header fields are components of the message header of requests and responses in the Hypertext Transfer Protocol (HTTP). They define the operating parameters of an HTTP transaction.
620
questions
0
votes
0
answers
16
views
Browser not sending username with request in HTTP headers
I'm facing an issue where the browser is not sending the username with the request headers in my web application. I've tried using Google chrome and Edge for testing purposes.
I have observed this ...
- 117
0
votes
1
answer
94
views
CORS access-control headers not visible in the response headers section of Chrome inspector
Using https://cors-test.codehappy.dev/ to test our test server's new CORS policy, we receive:
These are the response headers received when making the request:
access-control-allow-credentials: true
...
- 365
0
votes
1
answer
25
views
Caddyfile header directive unable to override file_server ETag
Invoking caddy run against the Caddyfile:
http://localhost
header ETag forcedValue
file_server
I expect curl -v http://localhost/Caddyfile to show a response with the ETag forcedValue.
Instead, a ...
- 946
0
votes
0
answers
29
views
Apache Server Config Set Headers Conditionally
I am trying to set cache age for 200 responses and no cache for rest of the calls.
I tried below config, which works fine when 200 OK response comes up and I can see max-age=800 in headers
But for ...
- 101
0
votes
0
answers
522
views
Content-Security-Policy frame-ancestors not working
I'm running an OpenLiteSpeed server and would like to only allow webpages that start with a specific url on my site (e.g. https://example.com/video/**) to be iframed by others. (I want to allow anyone ...
- 101
0
votes
0
answers
71
views
Apache htaccess denying requests for iOS connections when proper headers are passed
In my the directory for my api, my htaccess file has the following lines:
Header always set Access-Control-Allow-Origin "*"
Header always set Access-Control-Allow-Methods "GET, POST, ...
- 103
0
votes
1
answer
258
views
Writing a RewriteRule based on X-Forwarded-Host
I have an Apache webserver behind a load balancer which proxies request to Apache and have problem regarding configuring directories.
Here is my scenario:
Upper Load Balancer proxies request to ...
1
vote
1
answer
606
views
Nginx - No last-modified or Etag response header on HTML
I am facing a rather odd issue with my web server. The server is configured with Ubuntu 20.04, Nginx v1.22.1, PHP 8.0, and MariaDB to host my WordPress website.
The issue is, the server is not sending ...
1
vote
1
answer
188
views
Cloudflare uncompressing, then re-compressing response bodies
I'm using Node.js/express and if I set the headers
Content-Type: application/json
Content-Encoding: gzip
and send gzipped compressed bodies of JSON data, this works as expected - when not behind ...
- 11
0
votes
0
answers
99
views
Built header value not working
I am building an Authorization header before forwarding the request to the proper service. The token is being passed to Nginx as a query string parameter named custom.
Here is the thing:
set $...
2
votes
1
answer
250
views
Are HTTP Headers configured by the CDN or by the application?
This is kind of a theoretical question, and I guess it may be too broad or unclear.
Foobar is an application serving users across the internet. It relies on a CDN to improve its resiliency, speed, etc ...
1
vote
1
answer
2k
views
Nginx not working with domain/url that points to server IP
The configuration I have set (below) works for localhost but not for my domain. The goal is to access port 3000 externally with basic auth so only I can access it. When I go to localhost, it is ...
- 11
0
votes
1
answer
68
views
Apache include value of %{TIME_YEAR} variable in an HTTP response header
I'm trying to do something like the following:
<If "%{IPV6} == 'off'">
Header always set Attention "you are using still using IPV4 in %{TIME_YEAR}, please blahblah etc"
<...
- 109
0
votes
0
answers
1k
views
How to set Access-Control-Allow-Origin for multiple origin domains with Tomcat?
An answer on SO to the same nice - and following guidelines - question but for Apache, how to set Access-Control-Allow-Origin entry header for multiple origin domains deals with .htaccess, checking ...
- 113
-1
votes
1
answer
46
views
What is the web server software announcing itself as "VDL/1.0"?
I am looking at an old web form located at: http://www.teleservices.lyon.fr/etat-civil/naissance/
Of course, it is obsolete, bogus, without TLS, etc.
But I don’t recognize the web server publishing it....
- 111
1
vote
1
answer
187
views
What is this formatting in the "Bearer" Authentication token of a HTTP get
I came across a "Bearer" Authentication in the header of a HTTP request (I want to understand an API) that I want to replicate.
This is the header field:
authentication : Bearer ...
- 113
1
vote
0
answers
1k
views
Nginx - remove HTTP Header from response
Hey guys.
I have the following question:
Is it possible to remove or change the value of a header that was added a few lines earlier?
Here is the whole scenario:
Setup
my-website.com.conf
...
server {
...
- 11
2
votes
1
answer
2k
views
Which static file types does Nginx generate ETags for by default?
In modern versions of Nginx, the ETag is automatically generated for static file types, even if you don't specifically enable the etag on in your location blocks or otherwise:
https://nginx.org/en/...
- 254
1
vote
1
answer
346
views
NGINX byte-range requests are enabled but Pocket Casts still reports invalid headers
My NGINX web server has byte ranges enabled via add_header Accept-Ranges bytes; and I can successfully get byte ranges of podcast episodes via curl:
$ curl -I -r 200-300 https://konradhoeffner.de/...
- 195
2
votes
0
answers
447
views
Are servers allowed to add a Content-Encoding header based on filename, if there is no compression on-the-fly?
Problem
Suppose we have a compressed archive on disk, e.g. file.tar.gz, which should be served as-is.
The file is served with Content-Type: application/gzip, but for some reason the server also adds a ...
- 137
0
votes
0
answers
170
views
Do ETags generated on upstream need If-None-Match check? (Nginx)
Let's assume I use etag off (and if_modified_since off with add_header Last-Modified "" to not make redundancy) in Nginx and I generate ETags on upstream (i.e. I'm using proxy_pass).
Do then ...
0
votes
1
answer
114
views
Apache sends corrupted header [duplicate]
I have configured a basic virtual host just to be able to list a specific directory on the server. For the local files it’s working perfectly, but one of the folder listed at the root is a symlink to ...
- 193
1
vote
0
answers
312
views
Set header for all except one location
I'd like to set a header on all page request except for one. I've tried the following:
location ~ ^\/(?!allow-iframes) {
add_header 'X-Frame-Options' 'DENY';
}
This has some unexpected behavior. ...
- 137
1
vote
1
answer
2k
views
How can I remove an accept-encoding request header in nginx?
The recent update to zlib due to a security hole appears to cause a major problem when serving PHP-FPM 8.0 via nginx on Ubuntu focal. Any requests with a gzip encoding fail right at the start of the ...
- 3,128
1
vote
1
answer
644
views
Apache 2.4 .htaccess Set Headers for error pages
I am setting some headers using .htaccess for a web page, f. e.:
<IfModule mod_headers.c>
Header set Strict-Transport-Security "max-age=31536000; includeSubDomains"
</IfModule>
...
- 113
0
votes
0
answers
842
views
Setting "Content-Security-Policy default-src https:" breaks site
I need to set the Content-Security-Policy header to allow loading scripts from any HTTPS source. When I add the following line to my nginx configuration, the look and feel of the site breaks. What am ...
- 111
0
votes
2
answers
683
views
Apache: I cannot set full cache header for text/html using htaccess
I had a similar problem where I couldn't set the full cache header for JS and CSS files in my htaccess file, and it turned out I couldn't because the cache expiry was being set on the server and I had ...
- 1
2
votes
1
answer
306
views
is "access-control-allow-origin" a secure way to restrict communication between two servers?
I have two servers, A and B. I want server B to only accept HTTP requests from server A.
is "access-control-allow-origin" a secure way to implement that?
- 131
0
votes
1
answer
659
views
Apache2.4 SetEnv to value of request header
I want to set the value of env with a request header.
SetEnv X_THING %{req:thing}
but it's not working as planned; it looks like the value of SetEnv isn't being evaluated.
- 101
1
vote
1
answer
1k
views
Is there any difference between using a cookie and using a normal header in the case of HTTP communication?
I have a system consisting of a custom software and an HTTP server. The software will send some requests with some headers and the HTTP server will send response back.
Now I have some custom ...
- 195
0
votes
0
answers
551
views
Nginx won't serve images with proper headers (example + conf provided)
Here is an example of an image that is being served incorrectly :
https://www.questionhosting.com/product/temp.jpg
here is my config
server {
listen 80;
listen 443 ssl;
listen [::]:...
- 101
0
votes
0
answers
351
views
HTTP_IF_NONE_MATCH Missing on Server Side with Chrome Requests to NGINX
I'm trying to add etag based cache verification to a web app I've developed that runs on Apache via an NGINX reverse proxy. The web app is written in Perl. In the Perl script, I check for the $ENV{'...
1
vote
0
answers
636
views
Can CloudFront handle repeated headers?
According to this answer, you can have multiple headers for certain headers, such as Cache-Control.
Will CloudFront respect both times that Cache-Control appears? For example, if the Origin were to ...
- 111
0
votes
1
answer
299
views
Setting Nginx expires epoch header selectively
I have a folder containing imagery on my server that is used to service both a mobile app, via a CDN, and to work with a backend webapp used to manage the content delivered to the app. For the latter ...
- 173
0
votes
1
answer
468
views
Remove "Via" response header from "ledge"
I have an Openresty web-server that is also working as caching server by using ledge. ledge is setting a "Via" response header that exposing the hostname of the server which is fqdn.
Via: 1....
- 177
1
vote
1
answer
571
views
Apache LocationMatch match group and use in a header
I am trying to get a pattern from an URL, and to use it in a header.
Something like
<LocationMatch "^/static/(?<sitename>[^/]+)">
Header set Content-Security-Policy-Report-Only &...
- 11
0
votes
1
answer
697
views
iptables not working with "x-forwarded-for" (behind Cloudflare)
I have a webserver (Ubuntu with Apache) running behind Cloudflare. I want to block a user using the iptables. Here I want to implement the string match extension of iptables and drop the connection if ...
- 33
0
votes
0
answers
971
views
how to allow POST to php file in apache only from same-origin?
I have a website with a HTML form that, when submitted, successfully sends a POST request to a .php file on the server (Apache 2.4.48).
However, when I let Javascript handle the submitting through a ...
- 1
0
votes
1
answer
401
views
CORS prevent js window.onerror from subdomain reporting informations
To log Javascript errors i have set up a function with window.onerror which trigger an ajax request and inform me about script errors. I load all my static files from a subdomain and if an error ...
- 103
0
votes
0
answers
170
views
How to set header in request for HAProxy based on script output?
I have haproxy which runs fine, but we have backend, which validate token against our identity service.
I want to move that logic to HAProxy, where we can run some python or sh script, and get the ...
- 255
0
votes
0
answers
78
views
What is an HTTP Proxy (forward not reverse) required to do with a client's request headers?
1
Could someone help me distill down what, exactly, the minimum requirements are for a proxy server (just a forward proxy not reverse) with regard to headers? What headers absolutely must be deleted ...
1
vote
1
answer
2k
views
Nginx - Reverse proxy - add request header to each request
I have nginx as a reverse proxy. I am trying to add a request header for each request, so i tried:
location / {
proxy_pass some.host.com;
proxy_set_header MY_HEADER somename;
}
But the header is ...
- 13
0
votes
1
answer
2k
views
How to Avoid Crazy Caching with "Vary: Cookie" Header in NGINX
I know Vary: Cookie is not well liked, since it causes caching of every variation of cookies a user might report. On the other hand, without it, I've had to use Cache-Control: no-cache to tell my ...
0
votes
0
answers
71
views
HTTP redirect not working
My website: https://www.louiswebsdale.co.uk/ keeps giving the "400 bad request invalid header" error when trying to visit it without the https. So www.louiswebsdale.co.uk or http://www....
2
votes
2
answers
2k
views
How reliable is the "host" in an incoming HTTPS request?
I'm trying to understand what level of confidence I can have when my API which lives at api.foo.com receives a POST request from a page that has foo.com specified as its host value in the header.
...
- 141
2
votes
0
answers
2k
views
Disable nginx version in Server header on AWS Elastic Beanstalk
I want to disable the default nginx behaviour where it adds a Server header including the nginx version: nginx/1.18.0. I'm fine if it just says nginx.
From what I can find, I can do that by adding set ...
- 501
0
votes
0
answers
1k
views
Add headers in nginx config on AWS Elastic Beanstalk
I'm trying to have the nginx on my Elastic Beanstalk application add some headers to every response.
I've edited my 00_application.conf file (in .ebextensions/nginx/conf.d/elasticbeanstalk) to include:...
- 501
0
votes
0
answers
36
views
Can anyone explain the Forwarded header to me?
I am a little confused on the this current standard for headers (https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Forwarded). I tried reading the specification (https://datatracker.ietf.org/...
- 101
0
votes
2
answers
3k
views
Apache .htaccess set a header if Request URI does not exactly match a desired value
Goal: using a .htaccess file in /directory/, if request URI does NOT exactly match "/directory/" then set a header. For example, the header SHOULD be set if the request URI is "/...
- 109
0
votes
1
answer
1k
views
How to send a HTTP header on all server blocks in nginx?
Let's say I have a running nginx instance with several server blocks (on a linux server), and that I would like to send an extra HTTP header like Permissions-Policy: interest-cohort=() on all ...
- 103