Questions tagged [http-headers]

In the Hypertext Transfer Protocol (HTTP), HTTP header fields contain the operating parameters of an HTTP request or response. With the request or response line (first line of message), they form the message header.

Filter by
Sorted by
Tagged with
-1 votes
0 answers
20 views

Need to block Pop Up on any website Using query parameters [closed]

I am working on a project where I open any website but the pop-ups should not open. For example, If I hit the url wish.com, it shows sign-in pop. Is there any possible query string or parameter ...
Noob Coder's user avatar
0 votes
0 answers
4 views

Is it possible to add a custom HTTP referer to an iframe on a 3rd party website

I am embedding YouTube videos as: <iframe allowfullscreen="" scrolling="no" style="background:url(https://i.ytimg.com/vi/54545454/hqdefault.jpg) 50% 50% / cover" src=&...
Kohjah Breese's user avatar
0 votes
1 answer
13 views

What clients actually care about HSTS (Strict-Transport-Security)?

Context: I have an application that provides GUI and API. The GUI is a web page accessed by users through their web browsers. The API is a HTTP(S)-based backend accessed also by other applications. In ...
McLayn's user avatar
  • 331
0 votes
0 answers
22 views

AWS CloudFront blocks Set-Cookie header

I am using CDK to construct a CloudFront distribution which has a Lambda Function behind an HTTP API Gateway as default origin. I am hosting a web application from this lambda which needs to set and ...
Mercury's user avatar
  • 632
0 votes
0 answers
14 views

CSRF token missing when making a POST request via Hoppscotch to Django

I'm working with a Django (version 4.0+) application and facing a CSRF verification issue when trying to make a POST request using Hoppscotch. I'm receiving the following error: { "detail": &...
Ixyz's user avatar
  • 25
0 votes
1 answer
31 views

HTTP Response headers collection cannot be modified in .NET Core web app

I have this controller: [PushHeaderAttribute] public class ClockController : Controller { } Where PushHeaderAttribute is defined as follows: public class PushHeaderAttribute : ...
jstuardo's user avatar
  • 4,059
0 votes
0 answers
12 views

X-Frame-Options inside React App (CRA) seem like doesn't work

I'm trying to know about X-Frame-Options (a common security header). So i run react app in localhost:3000. I also run NodeJS-ExpressJS app in port 5000. My localhost:5000 server look like: (server/...
An Giang's user avatar
0 votes
0 answers
13 views

header is not being set for a request of type get in axios

const config = { headers: { "Authorization": `Bearer ${auth?.accessToken}`, 'Content-Type': 'application/json', }, withCredentials: true,...
Konduru Premsai's user avatar
0 votes
0 answers
13 views

Using custom attributes in "Server-Timing" HTTP response header

I'm adding support for the Server-Timing spec to my REST server, but when I try to add custom attribute names, e.g. db;dur=1.450;cnt=1;rows=3;sent=111;recv=3288, above and beyond the dur and desc ones ...
ddevienne's user avatar
  • 1,812
0 votes
1 answer
26 views

How to Increase Accepted Header Size of the Ballerina Http Listener?

I have encountered an issue where the Ballerina Http Listener returns a 431 error due to header size limitations. How can I increase the accepted header size?
Chiran Sachintha's user avatar
0 votes
1 answer
18 views

Canonical URL and PDF with IIS rewrite module

I am trying to add a canonical url to PDF only using the IIS Rewrite module. I can't get it to work for some reason. Below is what I currently have. Link: <http://www.example.com/downloads/...
Mike Flynn's user avatar
  • 21.9k
0 votes
2 answers
22 views

how to use Sec-Fetch-Site request header in a condition of IIS Rewrite rule

I want to restrict access to some resources hosted on my IIS web site. More specifically, I want these resources, such as images or html files, be viewable only within or from a page hosted on exactly ...
Eric Malalel's user avatar
-1 votes
0 answers
47 views

Prevent storing and verifying fake requests sent to a php website

Can a hacker through the web send a request from source A to source B while source B mistakenly thinks that the request was sent from within site B itself? Can this case be hacked if only requests ...
user3754884's user avatar
0 votes
1 answer
51 views

Google cloud storage bad encoding of UTF-8 files

I have a .txt file encoded in UTF-8 in google cloud storage. When I visit the public URL of the file, I get text with malformed non-ascii(czech) characters. I am sure about the encoding of the file, ...
Tomáš Šíma's user avatar
-1 votes
0 answers
13 views

Trouble Retrieving X-Robots-Tag Added via .htaccess in Magento 2

For specific SEO requirements, I have added an X-Robots-Tag HTTP header via the .htaccess file on my server. However, I am facing an issue: I am unable to retrieve or read this header within Magento 2....
Jeremy B's user avatar
0 votes
1 answer
23 views

Why is content-length header not sent over HTTP/3?

While investigating (in Chromium and Firefox devtools) some resources sent over HTTP/3, I noticed that the content-length header is never sent. Why?
lonix's user avatar
  • 15.2k
0 votes
0 answers
44 views

Chrome and MS Edge truncating filename in from Content-Disposition header

I have a file saved with a long filename that I'm trying to download from where it's stored on the server. The filename is 254 characters long. When I download the file from Postman, it pulls back the ...
DFW's user avatar
  • 815
0 votes
1 answer
36 views

Clear-Site-Data "*" : Different behavior in both Firefox and Chrome

I am facing an issue with: Clear-Site-Data "*" I have two domains using two web servers: a.mywebsite.com and b.mywebsite.com 'b' is an iframe in 'a'. When I click logout, I call the logout ...
sam it 's user avatar
2 votes
3 answers
221 views

seleniumbase (undetected Chrome driver): how to set request header?

I am using seleniumbase with Driver(uc=True), which works well for my specific scraping use case (and appears to be the only driver that consistently remains undetected for me). It is fine for ...
MandyShaw's user avatar
  • 1,070
0 votes
0 answers
48 views

Header propagation with quarkus amazon-lambda-rest not working

I am facing an issue while deploying the quarkus java code as native build. I am using java 17 with quarkus bom version of 3.5.1. The header propagation is working when I try from my local environment,...
Venkit's user avatar
  • 1
0 votes
0 answers
16 views

Wrong Content-Type header set automatically in Axios call

A bug was reported by a user of an app that I manage (the backend is written in Java with SB2, frontend in Typescript with React): a HTTP request to upload a file via a multipart form has a Content-...
7evy's user avatar
  • 137
0 votes
0 answers
16 views

Best practice for HTTP GET request with parameters?

I'm building a REST API for a personal project, and one of my handlers is meant to retrieve a set of data from a large SQLite table. The frontend is divided into pages, showing limited results, which ...
Josh Silveous's user avatar
0 votes
0 answers
10 views

Authentication for multiple Web Applications without changing code of the applications

We host a variety of web applications written and maintained by different departments. Currently each of these applications has its own authentication/authorization, which is confusing to our ...
sese317j's user avatar
0 votes
0 answers
35 views

Apikey is invalid for POST, but valid for GET requests?

Try to get any response from public api (Google translate). Have 403 "The request is missing a valid API key" in POST calls, but at the same moment success response from GET calls. val ...
Pavel Lambo's user avatar
0 votes
0 answers
19 views

Adding Optional header in http request in zephyr OS(using nRF9160DK)

I try to put optional header in my http request, based on zephyr OS. I'm trying to use optional_header in zephyr OS, but it didn't work well. I tried like this. Here is my requesting function and ...
Dear_ddyd's user avatar
0 votes
0 answers
31 views

Add headers in a route middleware in Nux 3

I'm migrating a Nuxt 2 to Nuxt 3 application and I need to add an header to the responses that arrive to a specific page. While I'm aware on how to add named route middleware in Vue components, I'm ...
CBD's user avatar
  • 17
0 votes
0 answers
16 views

HTTP RFC Multiple headers with same name and different style

In my team, we are wondering if is compliant with HTTP to have multiple response headers with the same name but different writing styles. For example, we have a provider whose responses include ...
Casto Colina's user avatar
1 vote
1 answer
46 views

go http server header Content-type set to multipart/form-data but get Content-Type: text/plain at the client

the go server set the header Content-type to multipart/form-data router.HandleFunc("/certificates", serveFilesHandler).Methods("GET") func serveFilesHandler(w http.ResponseWriter, ...
Jerome's user avatar
  • 324
0 votes
0 answers
33 views

How to fix access to XMLHttpRequest blocked by CORS policy in Facebook customer chat?

I have added customer chat plugin code generated by Facebook wizard on my otherwise empty page. <div id="fb-root"></div> <!-- Your Customer chat code --> <div id="...
kathdroid's user avatar
0 votes
2 answers
54 views

CSRF client side double submission token generation

I am looking into protecting a website from CSRF attacks. Although sensitive cookies already are tagged with same-site=lax, I would still like to implement CSRF tokens. More specifically the double ...
Bram  Vanbilsen's user avatar
0 votes
1 answer
34 views

Chrome/Edge not sending preflight OPTIONS requests cross origin while Firefox works

I'm sending Authorization token in the header to both the same-origin and cross origin servers. I have set up the server to respond to OPTIONS requests with the following headers: HTTP/1.1 204 No ...
banapaya's user avatar
0 votes
0 answers
25 views

Why is cache-control header set to private even when I set it to a different value?

I'm using .NET Framework 4.8 with MVC and trying to set HttpResponseMessage's cacheControl header to public, max-age=300. My Approach is the following [HttpGet] public HttpResponseMessage Get() ...
uwon's user avatar
  • 47
1 vote
2 answers
81 views

Adding Header to request that comes from within an Iframe

My problem is rather complicated and I dont know if the way we are doing it currently is the correct approach. So first a broad overview of the System: We have multiple "services" (all web ...
sese317j's user avatar
-1 votes
1 answer
66 views

Refused to apply inline style because it violates the following Content Security Policy directive for style-src

I've removed all the inline CSS from my application which were present before. But still I'm getting error as "Refused to apply inline style because it violates the following Content Security ...
Debashis's user avatar
0 votes
1 answer
83 views

In Chrome console: Error with Permissions-Policy-Report-Only header: Feature fullscreen's parameters are ignored

How do I get the Permissions-Policy-Report-Only header to call the reporting endpoint? I am trying to use this header to collect data from the browser, say when the unload event gets called or when ...
mypseudonym's user avatar
0 votes
0 answers
22 views

Fetch request, header and response [duplicate]

I try to get all the needed information from a fetch request. For this, i need some custom headers and the json data. If i use this, i get the json data: fetch(url, { method: "POST&...
Angled's user avatar
  • 43
0 votes
1 answer
17 views

http header not passing correctly

so i'm creating an API scrip in jmeter with only one request (GET). this request requires to pass some http headers, which I add it in the HTTP HEADER MANAGER. These are the headers: Authorization: ...
radnarac's user avatar
0 votes
0 answers
32 views

NextJS NextRequest Context

I would like to understand a behavior in my NextJS application. For each request a middleware is launched, which looks like this: export async function middleware(request: NextRequest) { request....
pharaoh2000's user avatar
0 votes
0 answers
18 views

CSP frame-ancestors wildcard usage failing

I've got a need to whitelist my website from being iframed just for one particular domain. The url accessing the wildcard will be something like https://app.domain.com/project/123/456 The https://app....
Ela Buwa's user avatar
  • 1,688
0 votes
0 answers
30 views

cookie is not set in browser regardless setting everything

there are several questions in this topic. I tried many of the proposed solutions, but still I can't get it work. I have a backend (NestJs) on localhost:3000 and a frontend (Angular) on localhost:4200....
derstauner's user avatar
  • 1,540
-1 votes
0 answers
14 views

I want to understand Microsoft SSO work flow with third party

I am a newbie in the penetration testing field. So i'm currently learning the login flow of microsoft office, and i was able to understand how it sends headers and data to the final endpoints which is ...
Abbigail Felix's user avatar
0 votes
0 answers
30 views

Youtube Data API HTTP Referrer Restriction not working with Sveltekit and Vercel

There is a similar question on SO, and I have tried to do those things with my situation, but it is not working for me, hence asking this question as well. YouTube API V3 - HTTP referrer restriction I ...
rchrdnsh's user avatar
0 votes
1 answer
77 views

next.js does a fetch instead of a redirect with a text/x-component content-type

I have a function in a next.js v13 app router app that ends with a redirect: ... return NextResponse.redirect(redirectUrl.toString() Instead of redirecting to a page, it instead informs the browser ...
PGT's user avatar
  • 1,568
0 votes
0 answers
34 views

What is the x-incap-sess-cookie-hdr header?

I've seen an HTTP header called x-incap-sess-cookie-hdr Her are some examples: x-incap-sess-cookie-hdr: IfBmOyLQ2RLSl9UHsx97BvdpPGUAAAAAWwDOZlrDvW75HkdClD+7bQ== x-incap-sess-cookie-hdr: xOY/...
Hazem Hussien's user avatar
0 votes
0 answers
30 views

Adding X-Content-Type-Options to web.config causes page source to be returned?

My apologies if this is a basic question, but here goes: I'm seeing a confusing issue when setting HTTP headers in my .NET Core website's web.config In the "customHeaders" element, I've ...
anotherWebDev's user avatar
0 votes
0 answers
32 views

Server sent a too long line error, while trying to connect ssh through Http Custom ssh client for Android

Im facing a problem, while trying to connect ssh with custom request/payload I'm using HTTP CUSTOM ssh client for Android. I'm using:- jep-asset.akamaized.net as sni And 49.44.112.166:443 as proxy:...
ThorinX1 's user avatar
1 vote
0 answers
32 views

Making Angular add X-XSRF-TOKEN header despite having not root cookie

In our application (frontend is in angular, backend in java) there's the problem of not adding the X-XSRF-TOKEN header on a request, resulting in backend returning 403 (forbidden). The xsrf mechanism ...
Joe D's user avatar
  • 74
0 votes
1 answer
43 views

Request and Http Work on Postman but fails in Python

I have the following code: import http.client conn = http.client.HTTPSConnection("www.williams-sonoma.com") payload = '' headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)...
Ashish Khatana's user avatar
-1 votes
1 answer
74 views

How do I add my own custom header key/value on TWebHttpRequest?

I've placed a non-visual TWebHttpRequest component onto my form and there is a Headers property where I can see and change some of the default headers: But there doesn't seem to be a way to add my ...
Shaun Roselt's user avatar
0 votes
0 answers
39 views

Why are these headers not working? Steam login

I want to understand why the headers from the browser do not work. The authorization method has changed in Steam. Previously, everything worked on headers from the browser, but now.. The first thing ...
igreklpofrss's user avatar

1
2 3 4 5
237