We’re rewarding the question askers & reputations are being recalculated! Read more.

Hot answers tagged

84

HTTPS does not just provide secrecy (of which you are doubting the value, though there are good reasons for it still) but also authenticity, which is always of value. Without it, a malicious access point/router/ISP/etc. can rewrite any part of your site before displaying it to the user. This could include: injecting ads for your competitors injecting ads or ...


63

The short answer is "Because HTTP wasn't designed for it". Tim Berners-Lee did not design an efficient and extensible network protocol. His one design goal was simplicity. (The professor of my networking class in college said that he should have left the job to the professionals.) The problem that you outline is just one of the many problems with the ...


33

Please note the question has changed/been clarified since this answer was first written. A further response to the latest iteration of the question is after the second horizontal rule What is the need of methods like GET and POST in the HTTP protocol? They, along with a few other things like header formats, rules for how headers and bodies are separated,...


27

Why 410 gone? Since the page once existed the correct header status return would be 410 gone, this will inform Google and other search engines to drop the page from its index. You should avoid using status 400 bad request since this implies the server did not understand the request due to malformed syntax. Using undesirable status codes will populate your ...


25

"nothing secret on the site" ...According to you. There migh be a perfectly fine reason someone wants a secure connection. It (partly) creates privacy: My admin can see that I'm browsing some picture site on my phone via url, but he can't tell if I'm watching pics of cute cats or hardcore porn. I'd say that's pretty damn good privacy. "a content" and "...


15

According to the current version of the HTTP/1.1 standard, RFC 2616, the value of the Location header must be an absolute URI. However, in the draft standard prepared by the HTTPbis Working Group to eventually replace RFC 2616, this has been changed to allow relative URIs as well, apparently because: "The definition of the Location header [in RFC 2616] ...


15

Officially, yes. Any 4xx status may be interpreted as 400; the same goes for the other status groups. (E.g. a 503 service unavailable error may be interpreted as a 500 internal server error.) The RFC is written this way to allow for implementations that may not support every status, and also to allow additional status codes to be defined without breaking ...


14

According to RFC 2616 (HTTP/1.1), section 3.2.2, the URLs http://www.example.com and http://www.example.com/ are equivalent, and HTTP clients must normalize the former to the latter before sending the request to the server: "If the abs_path is not present in the URL, it MUST be given as "/" when used as a Request-URI for a resource (section 5.1.2)." ...


14

Your web browser doesn't know about the additional resources until it downloads the web page (HTML) from the server, which contains the links to those resources. You might be wondering, why doesn't the server just parse its own HTML and send all the additional resources to the web browser during the initial request for the web page? It's because the ...


14

It is used by Firefox when detecting whether it is using a captive portal. A captive portal is a Web page that the user of a public-access network is obliged to view and interact with before access is granted. Captive portals are typically used by business centers, airports, hotel lobbies, coffee shops, and other venues that offer free Wi-Fi hot spots for ...


13

To complete the other answers, there is no authoritative database of complete IP -> name mappings. DNS provides for two kinds of mappings: name -> IP. Multiple names can map to a single IP IP -> name (aka "reverse"). A given IP can map only to a single name. Whether there is actually a reverse (IP -> name) mapping and what it points to is subject to the ...


12

You get HTTP/2 support, the new web standard designed to significantly improve website loading speeds. Because browser makers have chosen to support HTTP/2 only over HTTPS, enabling HTTPS (on a server that supports HTTP/2) is the only way to get this speed upgrade.


12

HTTP can be thought of as one specific case of generic principles of Remote Procedure Call: you tell the server what you want with some variable field in the request, the server responds accordingly. By now, due to the complex interactivity of ‘Web 2.0,’ these same features are shoved in every field on the request: the URL, headers, the body—and each ...


11

There is more than Google in this world. A 410 unambiguously tells a bot that the file is gone. A 404 does not. A persistent bot might keep trying to find a 404 indefinitely whereas they might stop trying to find a 410 immediately which would make your server very happy.


11

Because they do not know what those resources are. The assets a web page requires are coded into the HTML. Only after a parser determines what those assets are can the y be requested by the user-agent. Additionally, once those assets are known, they need to be served individually so the proper headers (i.e. content-type) can be served so the user-agent ...


11

There doesn't seem to be a standard. The StackOverflow answer leans towards 410 GONE, but I think 301 MOVED PERMANENTLY is more appropriate. To make the correct choice, we have to look at your specific case. If your goal is to have all calls being made to API v1 fail without taking any further action, 410 GONE works for that. If you want some continuity, ...


11

If there is no Cache-Control header and no Expires header, but there is a Last-Modified header (which most web servers send by default for static assets), most browsers will use heuristic freshness to determine how long to cache that asset for. The typical calculation for this (which is the one suggested by RFC 7234) is: (current time - last modified time)...


10

In client-server applications, the IP address of the client (i.e., the browser) is sent via the socket connection (the request) to the server (e.g., Apache). If the client is using a proxy server however, that may be the proxy's IP address instead of the client's IP. Remote_Addr is an ENV returned by the server and available to server-side scripts/...


10

(Parts taken from my answer to a similar question.) HTTPS can achieve two things: Authentication. Making sure that the visitor is communicating with the real domain owner. Encryption. Making sure that only this domain owner and the visitor can read their communication. Probably everyone agrees that HTTPS should be mandatory when transmitting secrets (...


9

See http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.9.3: The max-age directive on a response implies that the response is cacheable (i.e., "public") unless some other, more restrictive cache directive is also present. It's conceivable (likely?) that there are proxies in the wild which break this but since the only failure mode could be ...


8

If your framework/CMS/whatever has the appropriate functions, you can include the scripting conditionally as @Michael suggests, but without the additional library. Taking your datatables case, for example, WordPress might handle the situation via something like: // For reference; this isn't functional code. if (is_page('whatever')) { <script src="/...


8

A user agent of Java/[version] is the default UA when making any web requests through the Java programming language. In other words, someone has written a spider-like program in Java, which is clearly parsing links incorrectly. As Dave suggested in the comments, the requests could be coming from another site - check the referring URL in your weblogs. In ...


8

From Wikipedia: Web Distributed Authoring and Versioning (WebDAV) is an extension of the Hypertext Transfer Protocol (HTTP) that facilitates collaboration between users in editing and managing documents and files stored on World Wide Web servers. PROPFIND — used to retrieve properties, stored as XML, from a web resource. It is also overloaded to allow one ...


8

Web browsers do not care about canonical URLs. It is for search engine use only (specifically Google). Additionally, canonical URLs do not affect the loading or rendering of a web page. So no assets will be loaded over HTTP which is what would cause an insecure error message. So, no, they will not display any error message.


8

Because, in your example, web server would always send CSS and images regardless if the client already has them, thus greatly wasting bandwidth (and thus making the connection slower, instead of faster by reducing latency, which was presumably your intention). Note that CSS, JavaScript and image files are usually sent with very long expire times for exactly ...


8

Actually I just found an answer to my own question addressed in the relevant RFC 7230 (or its predecessor RFC 2616), e.g. in the description of status code "303 See Other": Except for responses to a HEAD request, the representation of a 303 response ought to contain a short hypertext note with a hyperlink to the same URI reference provided in the Location ...


8

Don't know if it's possible with simple command, but there are special "Reverse-IP" services just for that, check that one for example: http://viewdns.info/reverseip/ Apparently if you share IP with other domain, that is considered... malicious, like it's sending spam or spreading some viruses or having some "illegal" content, then your good domain also ...


7

On our website we have recently implemented 410 errors for pages that have been removed permanently. We have around 40 million pages in the Google index and get crawled with 2 million requests per day by the Googlebot. After cleaning up our database we found a large number of 404 errors kept showing up in the Crawl Errors on Webmaster Tools. When we ...


7

HTTP2 is based on SPDY and does exactly what you suggest: At a high level, HTTP/2: is binary, instead of textual is fully multiplexed, instead of ordered and blocking can therefore use one connection for parallelism uses header compression to reduce overhead allows servers to “push” responses proactively into client caches More is ...


7

Since 2014, Google has been giving websites available over HTTPS a slightly higher search engine ranking score. Given that your blog is only available over HTTP, it may appear lower in the results for some searches. However, Google isn't penalizing web site owners if other parts of their web sites aren't available over HTTPS but the main site is, at least as ...


Only top voted, non community-wiki answers of a minimum length are eligible