Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
90

Here's a one-liner I came up with for displaying request and response HTTP headers using tcpdump (which should work for your case too): sudo tcpdump -A -s 10240 'tcp port 4080 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | egrep --line-buffered "^........(GET |HTTP\/|POST |HEAD )|^[A-Za-z0-9-]+: " | sed -r 's/^...........


89

I believe the key to solving X-Forwarded-For woes when multiple IPs are chained is the recently introduced configuration option, real_ip_recursive (added in nginx 1.2.1 and 1.3.0). From the nginx realip docs: If recursive search is enabled, an original client address that matches one of the trusted addresses is replaced by the last non-trusted address ...


57

With apache2, just run a2enmod headers and then sudo service apache2 restart and it will install the headers module automatically.


43

Since Nginx 1.7.5 you can use always to add a header irrespective of the response code: add_header X-Test "blahblahblah" always;


30

Possibly you could use mod_headers in conjunction with mod_proxy. I haven't tested it though. So for your app-dev vhost you could have: RequestHeader set Host "app.internal.domain" and then you would add: ProxyPreserveHost On


30

how badly could it mess things up for our existing customers? It could completely sink their battleships if they've written code that relies on this Content-Type being incorrect. I would not expect the libraries to throw errors, but I expect that in some cases strict libraries have had their behavior overridden to handle the incorrect MIME type. If your ...


25

Just install fail2ban with the appropriate jail and be done with it. Don't bother to give a custom response, as it's most likely that it will never be seen.


23

Looks like it's due to a new <meta> header that Google is using: <meta name="referrer" content="origin"> Specification: https://w3c.github.io/webappsec-referrer-policy/ It's currently only fully supported by a few browsers, so it's not a complete solution, but certainly a start!


20

It might be useful to developers or Power User clients; but is certainly more commonly useful to hackers and their like. I would leave them on while developing a site, and perhaps upon initial release; but not in the long run. Clients care about content, not headers.


20

The documentation states that add_header "Adds the specified field to a response header provided that the response code equals 200, 204, 206, 301, 302, 303, 304, or 307. A value can contain variables." So it doesn't work with a 502. I forgot to add that you can use the third party headers more module to add headers to other codes. You'll probably have to ...


20

You express configured to serve path /index.html, but you requires /test-express/index.html. Either configure express to serve /test-express/index.html or make nginx to strip /test-exress from proxied request. Latter is as simple as add trailing slashes to location and proxy_pass. location /test-express/ { proxy_pass http://127.0.0.1:3002/; } See http:...


19

You can change the Server header if you want, but don't count on this for security. Only keeping up to date will do that, since an attacker can just ignore your Server header and try every known exploit from the beginning of time. RFC 2616 states, in part: Server implementors are encouraged to make this field a configurable option. And Apache did, with ...


19

content-length can't be set if the Transfer-Encoding is set to be chunked. At the time of sending the headers, the server is unaware of how much data it will finally send. Each chunk has it's own length header field (see the RFC). If you think about it, unlike with a static HTML file, the web server has no way of knowing how much data will be generated by a ...


18

This is expected behaviour. The add_header directives, much like all other array-type directives in nginx, are inherited from the previous level if and only if there are no add_header directives defined on the current level. If you want nginx to add all headers in the location /, you have to list them all in location /, i.e. location / { add_header ...


18

You can get something close to what you want by using -A, e.g. E....c@.@... .....Ng.d.P..Ch.).....s....... .A...u.BHEAD / HTTP/1.1 User-Agent: curl/7.29.0 Host: www.google.com Accept: */* Remember to use -s 0 to make sure you get the whole packet. Alternatively you could use wireshark to view the headers interactively.


18

The header attribute USER_CUSTOMER is invalid syntax. Underscores are not valid in header attributes. There is a workaround but best solution is to rewrite the attribute to valid syntax. Workaround is to set the following where you specify the server name in config: underscores_in_headers on;


17

Yes, if a request is chained through more than one proxy server, then each proxy should add the IP of the preceding one to the existing X-Forwarded-For header so that the entire chain is preserved.


16

In my opinion, it is best to mask this as much as possible. It's one of the tool you use to hack a web site - discover its technology, use the known flaws of that technology. The same reason why security best practice a while back started promoting to have urls in the form "/view/page" instead of "/view/page.jsp" or "/view/page.asp"... so the underlying ...


14

curl -I will generate a HEAD request. Adding the -L option will make it follow redirects. Timeouts can be controlled with several options depending on which bit of the request you want to time out. From the man page: --connect-timeout <seconds> Maximum time in seconds that you allow the connection to the server to take. This only limits ...


14

You'll need to add a line like: LoadModule headers_module modules/mod_headers.so To your httpd.conf to add support for that. In Ubuntu and similar, you can do a2enmod headers and it'll automatically enable it in your configuration.


13

Late but still, I've just dealt with the same issue, and this worked for me: RequestHeader set X_FORWARDED_PROTO 'https' env=HTTPS The documentation says: When the RequestHeader directive is used with the add, append, or set argument, a fourth argument may be used to specify conditions under which the action will be taken. If the environment ...


13

You should use underscores_in_headers on directive which is off by default.


13

This solution does not describe how to strip a header on HTTP only, as asked in the question title. A safe solution for your problem is to add proxy_set_header X-Forwarded-Protocol $scheme; It will set X-Forwarded-Protocol to http on HTTP requests and to https on HTTPS requests. This makes sure that this header is overridden if the client set it, as ...


13

RFC 6066 doesn't specify or even recommend any particular HTTP error in the case that the hostname sent via SNI doesn't match the HTTP Host header. It does recommend that the server abort the TLS handshake if the SNI hostname is not one that it provides service for. From section 3: If the server understood the ClientHello extension but does not ...


13

RFC 7231 says about the Server header: An origin server MAY generate a Server field in its responses. MAY is interpreted as in RFC 2119: MAY This word, or the adjective "OPTIONAL", mean that an item is truly optional. One vendor may choose to include the item because a particular marketplace requires it or because the vendor feels that it ...


11

location ~* \.(eot|ttf|woff)$ { add_header Access-Control-Allow-Origin *; }


11

For Apache, there is the module mod_asis, which does just that - reads the file and sends it on its merry way as a complete HTTP response. This module is shipped with Apache by default, but you need to enable it first (see the docs, there's a reasonable example).


11

Some words of caution to begin with: Know what you're doing, if you're planing to implement HPKP. If you don't do it right, or "if bad things happen", which aren't under your control, you might render your domain unusable. Be sure to test your setup with a domain which isn't that important, or with a very short cache time, like ten seconds for example. ...


11

Would you expect many different HTTP client libraries to throw fatal errors when seeing such a change? No. Every HTTP client library I'm familiar with will ignore the content-type header unless the programmer specifically reads that header and does something with it. I can imagine a library where the content-type: application/json automatically causes a ...


10

You can use the following code in your httpd.conf if you have access, or even your .htaccess , to force Apache, to send an UTF-8 encoding header. AddDefaultCharset utf-8 AddType 'application/json; charset=UTF-8' .json


Only top voted, non community-wiki answers of a minimum length are eligible