I've been using the most excellent http://redbot.org tool for testing have HTTP headers on my site correct (its custom code in PHP serving dynamic content - wanting to ensure it cached where possible - served by Apache2)

One of the tests says:

The If-Modified-Since response is missing required headers

HTTP requires 304 Not Modified responses to have certain headers, if they are also present in a normal (e.g., 200 OK response).
This response is missing the following headers: last-modified.
This can affect cache operation; because the headers are missing, caches might remove them from their cached copies.

... so resonse doesnt include the Last-Modified header. However the code does try to send it. Investigating further, it seems that Apache uses a whitelist of HTTP headers, it will allow on 304 responses...

if (r->status == HTTP_NOT_MODIFIED) {
    apr_table_do((int (*)(void *, const char *, const char *)) form_header_field,
                 (void *) &h, r->headers_out,
else {
    send_all_header_fields(&h, r);

This is found around line 1281 in modules/http/http_filters.c of the Apache HTTPD 2.2.22 source code.

.... "Last-Modified" is not on that list.

So the question is - which is wrong, redbot, or Apache?

http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html doesn't seem to specify if the Last-Modified should be included. (it does say the Etag should be - and that is allowed in Apaches list)

Just incase its useful, this is the test case: http://redbot.org/?uri=http%3A%2F%2Fwww.geograph.org.uk%2Fhelp%2Fsitemap - my code does include the Last-Modified header - its just that redbot never gets it (nor any custom X-.. headers).

  • Why would the Not Modified response need a Last-Modified header? I can't think of any use cases where this would be required. If you're getting a 304, then you already fetched a previous copy and know the last-modified date, which hasn't changed since then. Commented Feb 6, 2012 at 5:24
  • that is pretty much the question. But redbot suggests otherwise - which is what I am questioning. It seems the thinking is caches will update the headers of the 'stored' object with those in the 304 - and as the last modified is now missing, it will be lost from the cached object. -- I supose some testing is needed :) - its worth noting I've never observed any issue with 304s not including the header - 304s continue to be issued for the same object - its just that the advice of redbot suggets otherwise. Commented Feb 6, 2012 at 12:00

2 Answers 2


You're correct. RED implemented the requirements from HTTPbis https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-p4-conditional-18#section-4.1.

Normally, HTTPbis requirements are backwards-compatible with RFC2616 (i.e., they don't make implementations that were conformant to 2616 non-conformance now), but this change slipped through -- we'll be opening an issue to fix that, and in the meantime I'll change REDs requirements.

  • great thanks! Sorry i didnt find a more direct way to contact you! Commented Feb 7, 2012 at 14:35

No, Last-Modified is not required, as you cited from RFC 2616. I've found this issue https://github.com/mnot/redbot/issues/61 in which they implemented the check for required headers. However, they stated in the issue that only "Date" was required, but the implementation was different (by mistake, I think).

  • Ah thanks for that - I failed to find the github project for redbot - otherwise probably would of posted this there. Have tried the Google Group - but its held for moderation. And GGroups has a known issue that group owners arent notified of pending messages :( Commented Feb 6, 2012 at 16:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.