In the Hypertext Transfer Protocol (HTTP), HTTP header fields contain the operating parameters of an HTTP request or response. With the request or response line (first line of message), they form the message header.
1
vote
0answers
24 views
Append basic authentication header NGINX to existing authentication header of upstream application
Assume the following setup:
The NGINX reverse proxy is asking for basic authentication (which is a good habit when you expose things on the internet). Basic authentication uses the Authorization ...
3
votes
1answer
159 views
Request Missing a User Agent Header
I activated ModSecurity on a cheap web hosting but I have no control over it: that is, the only thing the service provider lets you do is reading logs but, unfortunately, you can't really configure ...
3
votes
0answers
19 views
Header to describe available `content-type` responses?
It's a little cumbersome to scrape through the HTTP RFC for this particular question, so I'm hoping someone can help me short-circuit an answer:
Does the HTTP spec contain functionality for a server ...
3
votes
1answer
29 views
Status code vs. Response Header Status: what is the rule for bots?
Assuming we have a page, which has as Status Code 200 OK and as Response Headers Status HTTP/1.1 410 Gone, like on image:
What is the behavior of bots / Googlebot? To crawl/index or not?
1
vote
2answers
42 views
Chrome isn't loading static content due to HTTP2_SESSION_RECV_INVALID_HEADER - Invalid character in header name - last-modified
HTTP2_SESSION_RECV_INVALID_HEADER
--> error = "Invalid character in header name."
--> header_name = "last-modified:"
--> header_value = "Thursday,%2009-Aug-2018%2001:21:53%20GMT"
This error ...
3
votes
0answers
51 views
Responding other 'Content-Type' different from 'Accept' list
As all you know (else follow this question) the requesting Accept header allows client to specify the expected MIME types for response content.
But my case is:
client indicates an Accept of type ...
1
vote
2answers
34 views
Should I be concerned that Google Ads sometimes shows Passive mixed content (insecure images) in some Ads?
In some pages that have Google Ads, Chrome Dev Tools console shows the warning for a Passive Mixed Content:
Mixed Content: The page at '...' was loaded over HTTPS, but requested
an insecure image
...
0
votes
0answers
12 views
When entering an Url in CSP will the domain name be enough
I'm trying to add CSP to my web site and I wonder how to enter Urls.
When entering an Url in CSP will www.foo.com mean http://www.foo.com and https://www.foo.com?
Since more and more sites are ...
1
vote
1answer
664 views
Does a 504 Gateway Timeout error mean a server has crached?
I am running a php script on a website that creates thumbnails from a big image. The script uses imagick to generates 10 thumbnails per image.
It runs on first page load, when the thumbnails don't ...
2
votes
1answer
207 views
404 status code for HTTP/2
How does a correct 404 status code look like on using HTTP/2 protocol? HTTP/1.1 404 Not Found seems to be for the previous protocol version, but I can't find anywhere something meaningful about status ...
3
votes
2answers
138 views
HTTP-header canonical and link tag canonical on same page?
I've come across websites using both a HTTP-header based canonical as well as a tag-based canonical. Sometimes they are not referencing the same URL which brings me to my question - does one have ...
1
vote
0answers
554 views
How to disable http method verb tunneling in nginx
Our security team ran a web-inspect security scan on our site and asked us to disable verb tunneling using headers or query parameters such as X-HTTP-Method, XHTTP-Method-Override, X-Method-Override, ...
0
votes
0answers
45 views
Why is my Last-Modified header always sent using GMT timezone?
I want to send the last-modified in IST timezone, But it always sends in GMT. What is wrong with this PHP code?
echo "Timezone " . date_default_timezone_get () ; //==>verified, timezone set ...
0
votes
0answers
209 views
Trying to remove “The X-powered header is sent within the response header.” on Apache/nginx
I am trying to address the above issue which is cropping up in SEO. The following solution is the one that is suggested:
<IfModule mod_headers.c>
# Unset Server Signature header
...
0
votes
0answers
35 views
How can I instruct the browser to cache .jpg files using .htaccess?
In my root folder .htaccess file, I have stated:
<IfModule mod_expires.c>
ExpiresActive on
ExpiresDefault "access plus 1 month"
ExpiresByType image/jpeg "access plus 1 year"
</IfModule>
...
1
vote
1answer
835 views
Apache Reverse Proxy Rewrite Remote_User
Running httpd 2.4.6 on CentOS 7 as a reverse proxy for Splunk with SSO.
This works with no proxying:
RewriteCond %{LA-U:REMOTE_USER} "user" [NC]
RewriteRule ^.*$ - [F,L]
The above does NOT work ...
2
votes
1answer
90 views
Is it OK for SEO to send a 200 status when I'm actually rewriting the request to a controller and then outputting content to a page dynamically?
After reading endless pages about redirects and best practice, I'm still unsure if what I'm doing here is good, bad, or indifferent as far as SEO is concerned.
I have a table in a database that holds ...
3
votes
3answers
1k views
Why does Pingdom suggest that I add a “Vary: Accept-Encoding” header?
I have tried a tool to measure the speed of my web site. It is Pingdom https://tools.pingdom.com
There is an answer I do not understand
"The following publicly cacheable, compressible resources ...
1
vote
1answer
457 views
X-Frame-Options Enabling on GoDaddy
I am currently developing a website which runs on a GoDaddy Windows with Plesk hosting option. I am doing this as an experimental/learning site so I am trying to be as security conscious as possible ...
0
votes
3answers
67 views
Website <head> section questions
I've been doing some tidying up on my site recently and have been making some minor adjustments to the section of each page (primarily to cut out any potential duplication). However, I just have a ...
1
vote
0answers
24 views
Google Analytics stopped registering hits 10 minutes after implementing measurement protocol
I'm trying to implement google analytics on server-side. In order to (loosely) identify visitors, I'm generating an md5 based on IP and user-agent and send the result to Google for tracking the ...
4
votes
1answer
201 views
Deleting many pages SEO check
I need to delete many pages (recipes) on my website because the recipes were made with products that don't exist any more. Links to those pages are all over social media so I can't just use a 410 ...
2
votes
1answer
176 views
When should I not to use page meta security headers
When should I not to use page meta security headers?
For example, I configured the web server server-side with a powerful content security policy and other hardened security headers, but when review ...
8
votes
1answer
240 views
How is HTTP 418 treated by Google and others as it is not a “real” error?
I was wondering if you know how Google and other search engines treat a website with HTTP status code 418 I'm a teapot.
According to this Wikipedia article, it can be used as a client error code (...
2
votes
3answers
357 views
Does setting a Referrer-Policy header have any effect on non-HTML pages?
The Referrer-Policy header controls how much referrer information the browser exposes to a site when navigating to it. I understand the purpose of this header when set on HTML files; does it make ...
1
vote
1answer
102 views
Access resources of secondary server running different port apache2
I'm currently running a main server from a raspberry pi (32 GB) and a secondary server (4 TB) running as the file storage server. Both servers are running Debian Linux with Apache2 installed. I've ...
3
votes
3answers
259 views
Can browser caching be controlled by HTTP headers alone without using hash names for asset files?
I'm reading it in Webpack docs:
The way it works has a pitfall: if we don’t change filenames of our resources when deploying a new version, browser might think it hasn’t been updated and client ...
1
vote
0answers
360 views
How do I implement “If-Modified-Since” header on a node server?
My web-application is running on a node server on azure. I need to implement the "If-Modified-Since" header on this server. Could you please guide me how to do this?
I tried implementing by setting ...
2
votes
2answers
322 views
CSP3 Report-To header implementation
Issue
Many CSP validators like cspvalidator.org tell me that:
A draft of the next version of CSP deprecates report-uri in favour of
a new report-to directive.
I found more information about ...
1
vote
1answer
64 views
Why everyone uses unsafe content security policy?
I see that all big websites like Google or Facebook, even my bank uses content-security-policy header with unsafe-eval and unsafe-inline. Is there point in using csp if such big companies disable it? ...
2
votes
0answers
666 views
What are these headers and values: HTTP_X_FB_HTTP_ENGINE = Liger, HTTP_X_PURPOSE = preview and HTTP_X_REQUESTED_WITH = com.facebook.katana? [closed]
I'm trying to debug an issue in my website, and i see these headers in my page view log:
[HTTP_X_FB_HTTP_ENGINE] => Liger
[HTTP_X_PURPOSE] => preview
[HTTP_X_REQUESTED_WITH] => com.facebook.katana
...
2
votes
0answers
51 views
Browser's auto request detection with X-Purpose
3 to 4 months ago, I found out that safari/chrome/firefox all have feature that automatically send request with X-Purpose header (with preview value for Safari) to get live thumbnail or top sites ...
2
votes
0answers
37 views
Detect prerender view in PHP? [closed]
How can I detect a prerender page view in PHP?
When I use prerender it messes up my page view counter.
1
vote
2answers
5k views
Setting X-Forwarded-Proto under Apache 2.4
Ive been advised that I need to set the RequestHeader X-Forwarded-Proto for a node.js application (NodeBB) to resolve an issue with sessions / csrf tokens.
Here's the relevant excerpt from my ...
2
votes
1answer
76 views
How to pass requested domain to server when behind MaxCDN?
I have a bit of a problem getting our server to know what domain was requested to get to the server.
The scenario is like this.
site1.tld, site2.tld, site3.tld and site4.tld are all pointing to ...
6
votes
1answer
144 views
Is it feasible to use Vary: headers with If-none-match: to improve caching?
As we all know, sending a response header Vary: Some-Header causes (or should cause) caches to store different variants of the response, one for each value of Some-Header: it encounters in requests.
...
2
votes
0answers
38 views
How lenient should I be when checking the range header parameters?
I made more of my URLs now accept the HTTP range request so that only user requested bytes of the document can be parsed. This is the range header my code supports:
range: bytes=s-e
where s is the ...
5
votes
2answers
142 views
Is it an overkill to specify the accept-ranges header for small HTML pages?
I tested my site homepage through rigor.com (formerly zoompf.com) and they believe all resources should have an accept-ranges header, but since my HTML code size is under 20 KB (mostly under 10 KB), I ...
2
votes
1answer
265 views
How to invalidate Google Search results?
Due to a misconfiguration all HTTPS traffic to a specific server showed the wrong content for a while.
Google indexed this content including urls that don't exist in the affected sites.
For example: ...
3
votes
3answers
82 views
If i use 301 redirects (to bounce the requests), will the other destination be aware of my Server IP?
(Just for the knowledge)
I wonder, let's say one day, when my Site is suddenly having some attacks at the login page (e.g: /login.php). If i don't bother about my Login page anymore, and i want to ...
5
votes
1answer
203 views
Looking for explanation of Apache behavior on manipulating headers
Tried to get an answer at ServerFault - they don't know, all real gurus are sitting here.
The background of the issue: Googlebot creates non-existing URLs and tries to crawl them. On some URLs Apache ...
3
votes
1answer
129 views
Googlebots request types
Does Google's bot send HEAD requests as well as GET requests?
I wondering about this because I'm running a Tornado application that does not support HEAD request and I have a lot of 404 errors in ...
2
votes
2answers
2k views
Is there a way to block wget from crawling and downloading my website?
I do not want ANY of my alleged website to be crawled and downloaded (css, images, html, etc). Is there a way to block wget completely?
3
votes
2answers
48 views
Handling bots that request URLs in paths
In my server log, I found at least one IP address to be requesting a full URL in an awkward place. For example, the header the client sends to my server is this:
GET http://www.3rdpartysite.com/file....
1
vote
0answers
265 views
Is a Server and Date HTTP header really necessary for error or redirecting pages?
On practically every URL I visit using the command-line tool CURL, there is always a server identification header and date header outputted regardless of the status of the request.
For example, on my ...
1
vote
2answers
58 views
Is it a good idea to close the connection on a web hacker / spammer?
When I receive a request from a web spammer, such as a GET /wp-login.php, I am thinking of replying with an error (404) and closing the HTTP connection immediately with this header:
Connection: close
...
2
votes
0answers
1k views
What strings do %{HTTP_HOST} and other mod_rewrite variables return? [closed]
If I have a htaccess file that has RewriteCond %{HTTP_HOST} in it, what is the HTTP_HOST? This is something I've been struggling to find out. To help me understand, could you tell me, in each example ...
2
votes
1answer
48 views
requesting for downloadable files via HEAD
I bet google is checking web pages via HTTP HEAD and HTTP GET request methods. So I'm thinking I should also allow proper header output for downloadable files from my website via HTTP HEAD request but ...
1
vote
1answer
47 views
Can servers ever return headers not beginning with HTTP?
When I checked URLs for headers, they always start with HTTP. For example, HTTP/1.1 301 Moved Permanently.
If I remember, I think in the past, headers started with Status: followed by a code.
...
1
vote
1answer
481 views
How to serve for International Googlebots if we redirect users to subdomains for language matching?
So, we have a site and a few sub-domains with content in different languages and we're using Hreflang and canonical implementations for SEO.
We do detect the language that users use in their browsers ...
