Hot answers tagged http-headers
12
No, it is not used for anything important. (Netcraft's server market share surveys probably use it, as presumably do other 3rd party surveys.)
Yes, it is a (very) small security issue. Of course your server should be secured and up to date at all times, but having an extra layer of 'obscurity' on top of a well secured server is only beneficial. If nothing ...
11
After the site is closed sending a 410 Gone HTTP status code would be the proper way to do it as this will tell search engines those pages are gone for good and to remove them from their index.
404 will do this, too, but may take longer as the search engines will keep retrying to reach it several times before removing it from their index.
Also, make sure ...
7
TCP already has error correction, but this only helps you on the TCP layer. An intermediary HTTP proxy or load balancer can corrupt the data on the HTTP layer, and then retransmit it. A HTTP MD5 makes it possible to detect this corruption. The reason why nobody really talks about this need is that the problem is very rare indeed; most HTTP proxies etc "just ...
7
Here's some I use:
# Don't allow any pages to be framed by my site or any others
# Defends against Clickjacking!
Header set X-Frame-Options DENY
# Only allow JavaScript from the same domain to be run.
# Also, don't allow inline JavaScript to run.
Header set X-Content-Security-Policy "allow 'self';"
# Turns on IE 8 XSS prevention tools
Header set ...
7
ETags are an alternative to (but can be used in combination with) "Last-Modified-Time" in order to determine cache validation.
The client can send a pre-condition such as if-matches or if-none-matches based on the ETag. This is not just for GET requests (which is what webpagetest.org does) you can use "opportunistic updating" so that a PUT request has a ...
7
It is referring to Response Headers and not document body ("Content-Type tag").
If you check Response Headers of your page with any HTTP Debugger (for example, Net panel of Firebug for Firefox, or similar tab of Developer Tools in Google Chrome/Internet Explorer/Safari/Opera), you will see this line:
Content-Type: text/html
At the same time, if you check ...
6
If the page is not replaced by new content Send a 410 GONE HTTP status message which tells search engines that the page doesn't exist anymore. Have the page's content tell the user why the page is gone and give them options for finding existing content on your website. This should links to your home page, site map (if one exists), search page (if one ...
5
You can't really control what headers user agents decide to send to you. If the file in question is in the browser's cache and it decides it need to check for a new version then it will. According to this article, these are the situations browsers will request using If-Modified-Since:
The cached entry has no expiration date and the content is being ...
5
Do a 307 temporary redirect on the server side. You can do this with PHP or .htaccess, it doesn't matter which. But definitely make sure you send the 307 header as that is what tells the search engines the redirect is temporary and to try again later. Without it they will consider the pages removed which is exactly what you don't want.
PHP:
...
5
To paraphrase Coding Horror's excellent evaluation of the YSlow Firebug plugin (which it appears WebPageTest.org is using as a basis for their evaluation):
"Yahoo is one of the busiest websites in the world - its problems are probably not your problems."
If you're not dealing in millions of uniques across your load-balanced network every day, there's a ...
5
As you correctly note, the Accept header is used by HTTP clients to tell the server what content types they'll accept. The server will then send back a response, which will include a Content-Type header telling the client what the content type of the returned content actually is.
However, as you may have noticed, HTTP requests can also contain Content-Type ...
5
Section 14.30 of the HTTP 1.1 RFC http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.30 is not significantly different. I don't know that you're going to see any actual practical limitations for this.
The only time I've seen even a warning about this issue is when I used to test in Lynx and the location was not absolute it would warn you "Location ...
5
According to the current version of the HTTP/1.1 standard, RFC 2616, the value of the Location header must be an absolute URI.
However, in the draft standard prepared by the HTTPbis Working Group to eventually replace RFC 2616, this has been changed to allow relative URIs as well, apparently because:
"The definition of the Location header [in RFC 2616] ...
5
"Is there a common way to override the server headers send to the browser from within the HTML document?"
AFAIK no, you do what you can do already. The defined charset via Header trumps your definition in the META tag.
If you have access to the server, e.g. Apache, it is configured by this statement (see the comment lines):
# Read the documentation before ...
4
You could read the values of the cookies into ENV variables, unset the headers using mod_headers RequestHeader directives, and then set the headers again.
Update: Solution for reading cookie values into ENV vars and then manipulating headers to control Set-Cookie header order.
<IfModule mod_rewrite.c>
RewriteEngine on
# Read cookie1 into ...
4
A .htaccess file works only on the Apache webserver, you're using Microsoft's IIS Webserver.
See 'Add Expires or Cache Control Header to static content in IIS'
4
You're correct. RED implemented the requirements from HTTPbis http://tools.ietf.org/html/draft-ietf-httpbis-p4-conditional-18#section-4.1.
Normally, HTTPbis requirements are backwards-compatible with RFC2616 (i.e., they don't make implementations that were conformant to 2616 non-conformance now), but this change slipped through -- we'll be opening an issue ...
3
No, Last-Modified is not required, as you cited from RFC 2616. I've found this issue https://github.com/mnot/redbot/issues/61 in which they implemented the check for required headers. However, they stated in the issue that only "Date" was required, but the implementation was different (by mistake, I think).
3
So is there a way in S3 to set a dynamic Expires that is always one
year from the request date?
Not that I know of, and I doubt that dedicated support for this will be considered by the AWS team:
You are probably aware that one can't set a dynamic Expires: ... value as such because The only value valid in an Expires header is a HTTP date; anything ...
3
What's the best way to determine users' preferred language?
Ask - include a language selection dialog on every page and abide by the user's choice.
The easiest way to to manage user preferences with this method is to host localized/internationalized content under distinct domains or URI's - e.g. "domain.com":"domain.kr" or ...
3
SEO-wise it's not advised to use a meta-refresh or javascript, because they will not pass pagerank and it'll just evaporate. Instead, use a 302 redirect (htacess or php header()). This will ensure that the original homepage maintains it's pagerank while it's under construction.
But really, can't you tinker with it on a test environment and just upload it to ...
3
Use rel="nofollow" on all links that you don't want spiders to follow or index (i.e. days, months, etc.).
Use robots.txt to specify paths that you want them to ignore.
If your site is a web application, consider using robots.txt to disallow indexing of the whole app with:
User-agent: *
Disallow: /
3
I can't really answer the question of what information would be missed, though I will say from an analytics standpoint we do tend to care about the browser and OS our users are visiting with (to determine what HTML features we can get away with using).
Philosophically I can give you my view on the sitiation--
What CAN be done falls in to two categories:
...
3
As it stands, your cache settings don't appear to match your update cycle, so I think you're on the right track. Adding indicators that allow your site to be cached by your end users and inline caches will improve your users' experience and has the potential to reduce your bandwidth and server load.
What you set the above to depends on your tolerance for ...
3
The problem is you have a hidden character between the <head> and first <meta> element. Make sure all your pages and PHP files have the correct UTF-8 encoding (you can convert them in Notepad++ or Sublime Text if you have those apps).
Edit: just tested and it's the character 'ZERO WIDTH NO-BREAK SPACE' (U+FEFF)
3
The s-maxage header is intended for proxies, while max-age is intended for regular users.
A typical end user (not using a proxy) would have the file cached for a year. The same should be the case for someone using a proxy as well, since the proxy will likely send the file unmodified, i.e. including the max-age header.
But the proxy itself would only cache ...
3
In the requests towards the (non-SPDY) website I work for i've seen requests with up to 4-5 KiB of request headers. (we kicked the offending javascript that caused that)
Assuming the SPDY compression does at least a compression to leave at most 25% of a header (note that I have NOT tested SPDY yet!!!) then the resulting request header goes down to a size ...
2
The page you are redirected to includes this code:
<meta name='robots' content='noindex,nofollow' />
This instructs the search engines not to index that page nor follow any links from it. So I recommend removing that ASAP.
Regarding the title: when I search for +"pubvantage" I currently see "wordpress" as the page title. Since there is no content ...
2
You also want to make sure important cookie headers are sent with the HttpOnly option.
http://www.owasp.org/index.php/HttpOnly
There are ways to force this externally using ModSecurity, apparently, and of course you can (and should) set it from within application code that sets cookies.
2
Can server break clients' cache settings?
Not with HyperText Transfer Protocol - the client always has the option to clear his or her cache and or otherwise ignore the Expires/max-age value and force a new request.
Is there any way (I guess not) to break the client's cache settings (even the homepage is cached)?
HTTP clients (I tested with ...
Only top voted, non community-wiki answers of a minimum length are eligible
