0

I've a jetty server behind an apache httpd server. I properly handle headers to be returned to requests I receive at jetty level.

But sometimes apache httpd add some headers (typically the Content-Type) that I don't want them to be added in my responses (I filter them out in jetty).

I tried to not load headers_mod by commenting the following line in /etc/httpd/conf/httpd.conf, but this did not fix the problem:

LoadModule headers_module modules/mod_headers.so

And when looking at the commands I can use in mod_headers documenation I don't see anyone that can be used to mute httpd!!

Any idea how I can force httpd to behave as I want??

bachr
  • 163
  • 1
  • 5
  • 11

1 Answers1

1

There isn't just a "No adding any headers ever!" flag in apache - any module can add headers to a response. Apache's designed as a web server - you should expect that it's going to behave as one, and that you'll need to change a lot of options to disable every way that it will manipulate your headers (pro tip: I know of at least two that will require you to edit the source code).

If you need absolute assurance that your proxy won't modify HTTP headers, use something other than Apache - HAProxy or Varnish might fit your use case a little better.

Shane Madden
  • 114,520
  • 13
  • 181
  • 251
  • I use haproxy to strip / change headers. Works great. – Aaron Mar 17 '17 at 17:25
  • Thanks @Shane, if potentially there are many modules who can write a given header, how can I find them so that I will not load them. – bachr Mar 20 '17 at 09:09