Questions tagged [http-headers]

In the Hypertext Transfer Protocol (HTTP), HTTP header fields contain the operating parameters of an HTTP request or response. With the request or response line (first line of message), they form the message header.

The header fields define various characteristics of the data transfer that is requested, or the data that is provided in the message body.

Header fields start with the field name, terminated with a colon character, followed by the field value. Field names and values may be any application-specific strings, but a core set of fields is standardized by the Internet Engineering Task Force (IETF) in RFC 2616 and other updates and extension documents (e.g. RFC 4229), and are commonly understood by all compliant protocol implementations.

Many parameters may be followed by a quality or 'q' value, giving a weight to use in content negotiation. The HTTP message header is separated from the message body by a blank line.

List of HTTP Header fields

11828 questions
5
votes
1 answer

Is PHP immune to "HTTP Response Splitting" vulnerabilities?

alert(1)"); echo 1; But it turns out PHP automatically does the encoding: Set-Cookie: test=test%0D%0A%3Cscript%3Ealert%281%29%3C%2Fscript%3E Does that mean it's impossible to reproduce HTTP…
cpuer
  • 7,413
  • 14
  • 35
  • 39
5
votes
1 answer

Content-Security-Policy (CSP) URL doesn't seem to have any effect. Still reporting a violation

I have a CSP with the following line in it: script-src 'nonce-{random}' 'unsafe-inline' 'unsafe-eval' 'strict-dynamic' https: http: https://static.cloudflareinsights.com…
simonw16
  • 960
  • 9
  • 25
5
votes
1 answer

JFrog Artifactory intermittently rejects authentication with 403 forbidden

I am having a hard time configuring zypper clients (SLES and OpenSUSE) to work with our RPM Repository in JFrog due to some "authentication" issues. At first, I thought it was just an issue with zypper and opensuse so I first focused on our efforts…
Lester
  • 1,411
  • 1
  • 12
  • 30
5
votes
0 answers

What User-Agent should be used to fetch Open Graph data?

The title pretty much sums it up. I am wondering what User-Agent I should use for consistent results when using the Open Graph api. So far I have been using the client's User-Agent, but that proved to be unreliable as on YouTube for example, when on…
kess
  • 1,204
  • 8
  • 19
5
votes
3 answers

axios response headers missing data when running in vuejs app

I have simple vuejs application. In the main.js I have something like: import Vue from "vue"; import App from "./App.vue"; import router from "./router/routes"; import store from "./store/root"; import vuetify from "./plugins/vuetify"; import {…
Gelin Luo
  • 14,035
  • 27
  • 86
  • 139
5
votes
4 answers

HTTP 500 error in wget

Take a look at this page: http://www.ptmytrade.com/product.asp?id=61363 It's loading fine (at least here). Now I would like to grab it with wget. $ wget http://www.ptmytrade.com/product.asp?id=61363 --debug DEBUG output created by Wget 1.12 on…
Vlad Vivdovitch
  • 9,295
  • 8
  • 22
  • 21
5
votes
2 answers

PHP header HTTP 1.0 vs 1.1

Possible Duplicate: 404 header - HTTP 1.0 or 1.1? Should you use header( "HTTP/1.0 404 Not Found", true, 404 ); instead of header( "HTTP/1.1 404 Not Found", true, 404 ); when the user agent uses HTTP/1.0? That is, is it good to reply with the…
bloodphp
  • 117
  • 1
  • 7
5
votes
0 answers

Why do I have duplicates headers on Apache 2.4?

When I send a header X-foo: bar to Apache from my backend and I configure Apache with: Header setifempty X-foo "baz" I receive two X-foo headers instead of one with "baz" value. I use the version 2.4.41 httpd (docker image). Is it a bug or a…
Ioni
  • 51
  • 1
5
votes
2 answers

304 response does not set custom header for apache with mod_headers

ServerAdmin webmaster@dev.dom.com DocumentRoot "C:/Program Files/Apache Software Foundation/Apache2.2/htdocs" ServerName dev.dom.com ServerAlias dev.dom.com ErrorLog "logs/dev.dom.com-error.log" CustomLog…
Dominic
  • 1,294
  • 1
  • 15
  • 29
5
votes
2 answers

Are both Shift+F5 and Ctrl+F5 valid for cache bypassing in Google Chrome?

I have been always using Ctrl+F5 on Chrome when I needed to ignore cache and load a new content. Today, I found out that my colleague is using Shift+F5 for the same and apparently, with the same result. My best guess was that the first one just…
René Beneš
  • 448
  • 1
  • 13
  • 29
5
votes
3 answers

How do I modify a response's ReadOnlyHttpHeaders in Spring?

RestTemplate.exchange is returning a ResponseEntity with ReadOnlyHttpHeaders. I want to add/modify these headers but since it is read only how do I do that?
Jumpman
  • 145
  • 1
  • 2
  • 11
5
votes
2 answers

Expires Header max value

I have several millions of image files on a S3 storage bucket and I know they will never change. To optimize requests, I decided to add an expires header to my files (as explained here : google page speed rules) The process of adding the headers to…
Benjamin Simon
  • 444
  • 4
  • 14
5
votes
5 answers

.Net core X-Forwarded-Proto header doesn't pass to Nginx properly

Sorry for the edit history but this issue was really unclear to me and it was difficult to locate the exact problem. I have a .Net-Core web application that runs behind a Nginx and the X-Forwarded-Proto always passes http instead of…
Offir
  • 3,252
  • 3
  • 41
  • 73
5
votes
2 answers

WSGI byte ranges serving

I'm looking into supporting HTTP/1.1 Byte serving in WSGI server/application for: resuming partial downloads multi-part downloads better streaming WSGI PEP 333 mentions that WSGI server may implement handling of byte serving (from RFC 2616 section…
myroslav
  • 3,703
  • 23
  • 29
5
votes
0 answers

When I add headers with an HttpInterceptor they are added to lazyUpdate, not the headers array

I have added an authorization header via an HttpInterceptor in Angular, but the output doesn't seem correct. Based on the JSON output after the header has been added this feels far too unwieldy to be correct Am I adding headers incorrectly, or am I…
Rilcon42
  • 9,584
  • 18
  • 83
  • 167
1 2 3
99
100