2022 Developer Survey is open! Take survey.

Questions tagged [http-headers]

HTTP header fields are components of the message header of requests and responses in the Hypertext Transfer Protocol (HTTP). They define the operating parameters of an HTTP transaction.

Filter by
Sorted by
Tagged with
0 votes
0 answers
18 views

Nginx proxy_pass is not passing customized header into the server

I have Nginx installed on my machine and serve 2 domains. https://example.com/ -> Frontend. https://api.example.com/ -> Backend. I'm communicating backend application through the frontend, But ...
user avatar
  • 101
0 votes
0 answers
20 views

Set header for all except one location

I'd like to set a header on all page request except for one. I've tried the following: location ~ ^\/(?!allow-iframes) { add_header 'X-Frame-Options' 'DENY'; } This has some unexpected behavior. ...
user avatar
  • 127
0 votes
0 answers
28 views

Get content-type header of NGINX response

Is there a way to get the content-type header of an NGINX proxy responses? I want to include this in the cache key of my NGINX cache and cache the content based on the URL and content-type. I'm also ...
user avatar
  • 1
0 votes
0 answers
23 views

After adding HSTS and Xframe policies it's still not showing up in the browser. (NGINX)

I am using docker to run a react app with Nginx not sure why it's not implementing the headers I added. http{ include /etc/nginx/mime.types; default_type application/octet-stream; ...
user avatar
  • 1
1 vote
1 answer
105 views

How can I remove an accept-encoding request header in nginx?

The recent update to zlib due to a security hole appears to cause a major problem when serving PHP-FPM 8.0 via nginx on Ubuntu focal. Any requests with a gzip encoding fail right at the start of the ...
user avatar
  • 2,968
1 vote
1 answer
71 views

Apache 2.4 .htaccess Set Headers for error pages

I am setting some headers using .htaccess for a web page, f. e.: <IfModule mod_headers.c> Header set Strict-Transport-Security "max-age=31536000; includeSubDomains" </IfModule> ...
user avatar
  • 113
0 votes
0 answers
34 views

Setting "Content-Security-Policy default-src https:" breaks site

I need to set the Content-Security-Policy header to allow loading scripts from any HTTPS source. When I add the following line to my nginx configuration, the look and feel of the site breaks. What am ...
user avatar
0 votes
2 answers
52 views

Apache: I cannot set full cache header for text/html using htaccess

I had a similar problem where I couldn't set the full cache header for JS and CSS files in my htaccess file, and it turned out I couldn't because the cache expiry was being set on the server and I had ...
user avatar
  • 1
2 votes
1 answer
215 views

is "access-control-allow-origin" a secure way to restrict communication between two servers?

I have two servers, A and B. I want server B to only accept HTTP requests from server A. is "access-control-allow-origin" a secure way to implement that?
user avatar
0 votes
0 answers
23 views

Multiple cache headers

So I'm running a drupal site and I'd like the response of a specific URL to be cached: I've added this code in the PHP function: $seconds_to_cache = 3600; $ts = gmdate("D, d M Y H:i:s", ...
user avatar
  • 101
0 votes
1 answer
64 views

Apache2.4 SetEnv to value of request header

I want to set the value of env with a request header. SetEnv X_THING %{req:thing} but it's not working as planned; it looks like the value of SetEnv isn't being evaluated.
user avatar
  • 101
1 vote
1 answer
176 views

Is there any difference between using a cookie and using a normal header in the case of HTTP communication?

I have a system consisting of a custom software and an HTTP server. The software will send some requests with some headers and the HTTP server will send response back. Now I have some custom ...
user avatar
  • 185
0 votes
0 answers
26 views

Nginx won't serve images with proper headers (example + conf provided)

Here is an example of an image that is being served incorrectly : https://www.questionhosting.com/product/temp.jpg here is my config server { listen 80; listen 443 ssl; listen [::]:...
user avatar
  • 101
0 votes
0 answers
89 views

Premature end of script headers due to response header length

My question is very similar to this unanswered question: Apache 2.4 + PHP-FPM + Chromelogger (how to increase HTTP header length limit?) Initially I was getting: [proxy_fcgi:error] Premature end of ...
user avatar
0 votes
0 answers
28 views

X-Robots-Tag across Multiple URL

I need to add X-Robots-Tag in my apache config where it can be applied to multiple URL's which are read from a file and apply the X-Robots-Tag HTTP header, is this possible ? Any pointers on how to ...
user avatar
0 votes
0 answers
152 views

HTTP_IF_NONE_MATCH Missing on Server Side with Chrome Requests to NGINX

I'm trying to add etag based cache verification to a web app I've developed that runs on Apache via an NGINX reverse proxy. The web app is written in Perl. In the Perl script, I check for the $ENV{'...
user avatar
0 votes
0 answers
190 views

IIS 10.0.14393.0 window server 2016, remove server header "Microsoft-HTTPAPI/2.0"

I have application running on window server 2016, IIS 10.0, when i am sending curl request to my domain curl request : curl -i X TRACE -d "test" https://example.com I am getting following ...
user avatar
0 votes
0 answers
114 views

Cannot fully disable gzip content encoding on specific POST requests

I've been trying to figure this one out for a while. I have disabled gzip/compression options on both Apache Tomcat (which is running the reportserver software in docker) and on nginx (acting as a ...
user avatar
  • 249
0 votes
0 answers
336 views

Apache Header set missing in server response when php-fpm is active, shown when php-fpm is inactive

Problem: When php-fpm is enabled, cors headers set in .htaccess are not shown in response. When php-fpm is disabled, cors headers are shown in the response. Current setup: Server: Ubuntu 20.04 on ...
user avatar
  • 101
0 votes
0 answers
84 views

NGINX Ingress Controller forwarded Certificate to Apache2 Extraction

On our k8s cluster we use NGINX Ingress Controller to request the clients (web-browsers) to provide a client certificate. If the certificate is valid, the request ist proxied to a full-blown Apache ...
user avatar
  • 51
1 vote
0 answers
496 views

Can CloudFront handle repeated headers?

According to this answer, you can have multiple headers for certain headers, such as Cache-Control. Will CloudFront respect both times that Cache-Control appears? For example, if the Origin were to ...
user avatar
  • 111
0 votes
1 answer
88 views

Setting Nginx expires epoch header selectively

I have a folder containing imagery on my server that is used to service both a mobile app, via a CDN, and to work with a backend webapp used to manage the content delivered to the app. For the latter ...
user avatar
  • 173
0 votes
1 answer
170 views

Remove "Via" response header from "ledge"

I have an Openresty web-server that is also working as caching server by using ledge. ledge is setting a "Via" response header that exposing the hostname of the server which is fqdn. Via: 1....
user avatar
  • 177
1 vote
1 answer
151 views

Apache LocationMatch match group and use in a header

I am trying to get a pattern from an URL, and to use it in a header. Something like <LocationMatch "^/static/(?<sitename>[^/]+)"> Header set Content-Security-Policy-Report-Only &...
user avatar
  • 11
0 votes
1 answer
326 views

iptables not working with "x-forwarded-for" (behind Cloudflare)

I have a webserver (Ubuntu with Apache) running behind Cloudflare. I want to block a user using the iptables. Here I want to implement the string match extension of iptables and drop the connection if ...
user avatar
0 votes
0 answers
596 views

how to allow POST to php file in apache only from same-origin?

I have a website with a HTML form that, when submitted, successfully sends a POST request to a .php file on the server (Apache 2.4.48). However, when I let Javascript handle the submitting through a ...
user avatar
  • 1
0 votes
1 answer
52 views

CORS prevent js window.onerror from subdomain reporting informations

To log Javascript errors i have set up a function with window.onerror which trigger an ajax request and inform me about script errors. I load all my static files from a subdomain and if an error ...
user avatar
  • 103
0 votes
0 answers
69 views

How to set header in request for HAProxy based on script output?

I have haproxy which runs fine, but we have backend, which validate token against our identity service. I want to move that logic to HAProxy, where we can run some python or sh script, and get the ...
user avatar
  • 255
0 votes
0 answers
31 views

What is an HTTP Proxy (forward not reverse) required to do with a client's request headers?

1 Could someone help me distill down what, exactly, the minimum requirements are for a proxy server (just a forward proxy not reverse) with regard to headers? What headers absolutely must be deleted ...
user avatar
1 vote
0 answers
697 views

Nginx - Reverse proxy - add request header to each request

I have nginx as a reverse proxy. I am trying to add a request header for each request, so i tried: location / { proxy_pass some.host.com; proxy_set_header MY_HEADER somename; } But the header is ...
user avatar
  • 13
0 votes
1 answer
380 views

How to Avoid Crazy Caching with "Vary: Cookie" Header in NGINX

I know Vary: Cookie is not well liked, since it causes caching of every variation of cookies a user might report. On the other hand, without it, I've had to use Cache-Control: no-cache to tell my ...
user avatar
0 votes
0 answers
42 views

HTTP redirect not working

My website: https://www.louiswebsdale.co.uk/ keeps giving the "400 bad request invalid header" error when trying to visit it without the https. So www.louiswebsdale.co.uk or http://www....
user avatar
0 votes
0 answers
139 views

Multiple session ID headers sent by Apache HTTPD serving PHP

Problem I get a multiple equal HTTP headers in responses of a web application. Sometimes it's dozens of replications depending on the script called. SetUp It's a large and very old PHP based ...
user avatar
  • 136
0 votes
0 answers
88 views

Authorization header missing in PHP POST request IIS

I'm currently trying to read the authorization header in a PHP script that I'm calling with a POST request. The Authorization header is populated with a token. It seems the Authorization header is ...
user avatar
0 votes
2 answers
418 views

How reliable is the "host" in an incoming HTTPS request?

I'm trying to understand what level of confidence I can have when my API which lives at api.foo.com receives a POST request from a page that has foo.com specified as its host value in the header. ...
user avatar
2 votes
0 answers
877 views

Disable nginx version in Server header on AWS Elastic Beanstalk

I want to disable the default nginx behaviour where it adds a Server header including the nginx version: nginx/1.18.0. I'm fine if it just says nginx. From what I can find, I can do that by adding set ...
user avatar
  • 431
0 votes
0 answers
565 views

Add headers in nginx config on AWS Elastic Beanstalk

I'm trying to have the nginx on my Elastic Beanstalk application add some headers to every response. I've edited my 00_application.conf file (in .ebextensions/nginx/conf.d/elasticbeanstalk) to include:...
user avatar
  • 431
0 votes
0 answers
33 views

Can anyone explain the Forwarded header to me?

I am a little confused on the this current standard for headers (https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Forwarded). I tried reading the specification (https://datatracker.ietf.org/...
user avatar
0 votes
2 answers
949 views

Apache .htaccess set a header if Request URI does not exactly match a desired value

Goal: using a .htaccess file in /directory/, if request URI does NOT exactly match "/directory/" then set a header. For example, the header SHOULD be set if the request URI is "/...
user avatar
0 votes
1 answer
340 views

How to send a HTTP header on all server blocks in nginx?

Let's say I have a running nginx instance with several server blocks (on a linux server), and that I would like to send an extra HTTP header like Permissions-Policy: interest-cohort=() on all ...
user avatar
-1 votes
1 answer
68 views

Can the Upgrade: header have spaces between the comma?

So, I see that Apache, by default shows the Upgrade header like this: Upgrade: h2,h2c Is this header below also valid?: Upgrade: h2, h2c Are spaces allowed between the commas in the Upgrade header? ...
user avatar
0 votes
0 answers
695 views

How to set the HTTP headers "X-Forwarded-Context" or "X-Forwarded-Prefix" with IIS reverse proxy

I try to configure a reverse proxy in the IIS. This required to set some HTTP headers. I was able to add the follow HTTP headers: X-Forwarded-Proto X-Forwarded-Port X-Forwarded-Host This is possible ...
user avatar
  • 165
3 votes
0 answers
142 views

relayd to match http request according to path and change headers

I have, on OpenBSD, relayd in front of a website. The thing redirect static requests to httpd and dynamic requests to an app running on localhost port 9000 (I wish to avoid revealing the name so I can ...
user avatar
0 votes
1 answer
373 views

asp.net Secure Cookies behind load balancer

This is a hybrid MVC/webforms asp.net application using framework 4.8, forms authentication and Membership. I need to implement secure cookies. The web site is behind a Coyote load balancer which I ...
user avatar
  • 123
0 votes
0 answers
116 views

How to get nginx to strip cookies except for an allow list?

I'm trying to host sites that use things like WordPress, using nginx as a reverse proxy for PHP-FPM. Often these systems will set all kinds of annoying cookies that are unnecessary and/or the site ...
user avatar
  • 2,968
1 vote
2 answers
2k views

How to whitelist Authorization header in CloudFront custom Origin Request Policy?

I have created the following CloudFront Origin Request Policy: I need Authorization header (without Authorization header the AntiForgeryToken header is not forwarded) but I do not understand why ...
user avatar
0 votes
0 answers
135 views

How can we capture the REQUEST_URI into an Apache variable and after third party SSO authentication?

How can we capture the REQUEST_URI into an Apache variable and after third party SSO authentication? We have a third party SSO authentication in place, which is working fine. After successful ...
user avatar
1 vote
1 answer
659 views

Nginx removes post data with content-type header

I am making posts like this: curl 'http://localhost/api.php' -H 'Content-Type: application/json' --data 'names=[{"name":"name"}]' Which results in the post data being deleted. If ...
user avatar
0 votes
1 answer
63 views

Sending cache headers only for a single request [or for a request following a certain path string]

I have the proxy pass in nginx config defined as follows: location / { proxy_pass http://localhost:3001; proxy_set_header Host $host; proxy_set_header X-Forwarded-For $...
user avatar
  • 125
0 votes
0 answers
40 views

Are requests with no headers a sign of hacking?

I run a NodeJS web application with packages up to date and secured with a strong password and RSA for ssh. The application runs on two domains. I check the request headers to get the domain and found ...
user avatar

1
2 3 4 5
13