Questions tagged [http-headers]
In the Hypertext Transfer Protocol (HTTP), HTTP header fields contain the operating parameters of an HTTP request or response. With the request or response line (first line of message), they form the message header.
11,830
questions
-1
votes
0
answers
20
views
Need to block Pop Up on any website Using query parameters [closed]
I am working on a project where I open any website but the pop-ups should not open. For example, If I hit the url wish.com, it shows sign-in pop.
Is there any possible query string or parameter ...
0
votes
0
answers
4
views
Is it possible to add a custom HTTP referer to an iframe on a 3rd party website
I am embedding YouTube videos as:
<iframe allowfullscreen="" scrolling="no" style="background:url(https://i.ytimg.com/vi/54545454/hqdefault.jpg) 50% 50% / cover" src=&...
0
votes
1
answer
13
views
What clients actually care about HSTS (Strict-Transport-Security)?
Context: I have an application that provides GUI and API. The GUI is a web page accessed by users through their web browsers. The API is a HTTP(S)-based backend accessed also by other applications. In ...
0
votes
0
answers
22
views
AWS CloudFront blocks Set-Cookie header
I am using CDK to construct a CloudFront distribution which has a Lambda Function behind an HTTP API Gateway as default origin. I am hosting a web application from this lambda which needs to set and ...
0
votes
0
answers
14
views
CSRF token missing when making a POST request via Hoppscotch to Django
I'm working with a Django (version 4.0+) application and facing a CSRF verification issue when trying to make a POST request using Hoppscotch. I'm receiving the following error:
{
"detail": &...
0
votes
1
answer
31
views
HTTP Response headers collection cannot be modified in .NET Core web app
I have this controller:
[PushHeaderAttribute]
public class ClockController : Controller
{
}
Where PushHeaderAttribute is defined as follows:
public class PushHeaderAttribute : ...
0
votes
0
answers
12
views
X-Frame-Options inside React App (CRA) seem like doesn't work
I'm trying to know about X-Frame-Options (a common security header). So i run react app in localhost:3000. I also run NodeJS-ExpressJS app in port 5000.
My localhost:5000 server look like: (server/...
0
votes
0
answers
13
views
header is not being set for a request of type get in axios
const config = {
headers: {
"Authorization": `Bearer ${auth?.accessToken}`,
'Content-Type': 'application/json',
},
withCredentials: true,...
0
votes
0
answers
13
views
Using custom attributes in "Server-Timing" HTTP response header
I'm adding support for the Server-Timing spec to my REST server,
but when I try to add custom attribute names, e.g. db;dur=1.450;cnt=1;rows=3;sent=111;recv=3288, above and beyond the dur and desc ones ...
0
votes
1
answer
26
views
How to Increase Accepted Header Size of the Ballerina Http Listener?
I have encountered an issue where the Ballerina Http Listener returns a 431 error due to header size limitations. How can I increase the accepted header size?
0
votes
1
answer
18
views
Canonical URL and PDF with IIS rewrite module
I am trying to add a canonical url to PDF only using the IIS Rewrite module. I can't get it to work for some reason. Below is what I currently have.
Link: <http://www.example.com/downloads/...
0
votes
2
answers
22
views
how to use Sec-Fetch-Site request header in a condition of IIS Rewrite rule
I want to restrict access to some resources hosted on my IIS web site.
More specifically, I want these resources, such as images or html files, be viewable only within or from a page hosted on exactly ...
-1
votes
0
answers
47
views
Prevent storing and verifying fake requests sent to a php website
Can a hacker through the web send a request from source A to source B while source B mistakenly thinks that the request was sent from within site B itself? Can this case be hacked if only requests ...
0
votes
1
answer
51
views
Google cloud storage bad encoding of UTF-8 files
I have a .txt file encoded in UTF-8 in google cloud storage.
When I visit the public URL of the file, I get text with malformed non-ascii(czech) characters.
I am sure about the encoding of the file, ...
-1
votes
0
answers
13
views
Trouble Retrieving X-Robots-Tag Added via .htaccess in Magento 2
For specific SEO requirements, I have added an X-Robots-Tag HTTP header via the .htaccess file on my server. However, I am facing an issue: I am unable to retrieve or read this header within Magento 2....
0
votes
1
answer
23
views
Why is content-length header not sent over HTTP/3?
While investigating (in Chromium and Firefox devtools) some resources sent over HTTP/3, I noticed that the content-length header is never sent.
Why?
0
votes
0
answers
44
views
Chrome and MS Edge truncating filename in from Content-Disposition header
I have a file saved with a long filename that I'm trying to download from where it's stored on the server. The filename is 254 characters long. When I download the file from Postman, it pulls back the ...
0
votes
1
answer
36
views
Clear-Site-Data "*" : Different behavior in both Firefox and Chrome
I am facing an issue with:
Clear-Site-Data "*"
I have two domains using two web servers: a.mywebsite.com and b.mywebsite.com
'b' is an iframe in 'a'.
When I click logout, I call the logout ...
2
votes
3
answers
221
views
seleniumbase (undetected Chrome driver): how to set request header?
I am using seleniumbase with Driver(uc=True), which works well for my specific scraping use case (and appears to be the only driver that consistently remains undetected for me).
It is fine for ...
0
votes
0
answers
48
views
Header propagation with quarkus amazon-lambda-rest not working
I am facing an issue while deploying the quarkus java code as native build. I am using java 17 with quarkus bom version of 3.5.1. The header propagation is working when I try from my local environment,...
0
votes
0
answers
16
views
Wrong Content-Type header set automatically in Axios call
A bug was reported by a user of an app that I manage (the backend is written in Java with SB2, frontend in Typescript with React): a HTTP request to upload a file via a multipart form has a Content-...
0
votes
0
answers
16
views
Best practice for HTTP GET request with parameters?
I'm building a REST API for a personal project, and one of my handlers is meant to retrieve a set of data from a large SQLite table. The frontend is divided into pages, showing limited results, which ...
0
votes
0
answers
10
views
Authentication for multiple Web Applications without changing code of the applications
We host a variety of web applications written and maintained by different departments. Currently each of these applications has its own authentication/authorization, which is confusing to our ...
0
votes
0
answers
35
views
Apikey is invalid for POST, but valid for GET requests?
Try to get any response from public api (Google translate).
Have 403 "The request is missing a valid API key" in POST calls, but at the same moment success response from GET calls.
val ...
0
votes
0
answers
19
views
Adding Optional header in http request in zephyr OS(using nRF9160DK)
I try to put optional header in my http request, based on zephyr OS.
I'm trying to use optional_header in zephyr OS, but it didn't work well.
I tried like this.
Here is my requesting function and ...
0
votes
0
answers
31
views
Add headers in a route middleware in Nux 3
I'm migrating a Nuxt 2 to Nuxt 3 application and I need to add an header to the responses that arrive to a specific page.
While I'm aware on how to add named route middleware in Vue components, I'm ...
0
votes
0
answers
16
views
HTTP RFC Multiple headers with same name and different style
In my team, we are wondering if is compliant with HTTP to have multiple response headers with the same name but different writing styles. For example, we have a provider whose responses include ...
1
vote
1
answer
46
views
go http server header Content-type set to multipart/form-data but get Content-Type: text/plain at the client
the go server set the header Content-type to multipart/form-data
router.HandleFunc("/certificates", serveFilesHandler).Methods("GET")
func serveFilesHandler(w http.ResponseWriter, ...
0
votes
0
answers
33
views
How to fix access to XMLHttpRequest blocked by CORS policy in Facebook customer chat?
I have added customer chat plugin code generated by Facebook wizard on my otherwise empty page.
<div id="fb-root"></div>
<!-- Your Customer chat code -->
<div id="...
0
votes
2
answers
54
views
CSRF client side double submission token generation
I am looking into protecting a website from CSRF attacks. Although sensitive cookies already are tagged with same-site=lax, I would still like to implement CSRF tokens. More specifically the double ...
0
votes
1
answer
34
views
Chrome/Edge not sending preflight OPTIONS requests cross origin while Firefox works
I'm sending Authorization token in the header to both the same-origin and cross origin servers. I have set up the server to respond to OPTIONS requests with the following headers:
HTTP/1.1 204 No ...
0
votes
0
answers
25
views
Why is cache-control header set to private even when I set it to a different value?
I'm using .NET Framework 4.8 with MVC and trying to set HttpResponseMessage's cacheControl header to public, max-age=300. My Approach is the following
[HttpGet]
public HttpResponseMessage Get()
...
1
vote
2
answers
81
views
Adding Header to request that comes from within an Iframe
My problem is rather complicated and I dont know if the way we are doing it currently is the correct approach.
So first a broad overview of the System:
We have multiple "services" (all web ...
-1
votes
1
answer
66
views
Refused to apply inline style because it violates the following Content Security Policy directive for style-src
I've removed all the inline CSS from my application which were present before.
But still I'm getting error as "Refused to apply inline style because it violates the following Content Security ...
0
votes
1
answer
83
views
In Chrome console: Error with Permissions-Policy-Report-Only header: Feature fullscreen's parameters are ignored
How do I get the Permissions-Policy-Report-Only header to call the reporting endpoint?
I am trying to use this header to collect data from the browser, say when the unload event gets called or when ...
0
votes
0
answers
22
views
Fetch request, header and response [duplicate]
I try to get all the needed information from a fetch request. For this, i need some custom headers and the json data. If i use this, i get the json data:
fetch(url, {
method: "POST&...
0
votes
1
answer
17
views
http header not passing correctly
so i'm creating an API scrip in jmeter with only one request (GET). this request requires to pass some http headers, which I add it in the HTTP HEADER MANAGER. These are the headers:
Authorization: ...
0
votes
0
answers
32
views
NextJS NextRequest Context
I would like to understand a behavior in my NextJS application.
For each request a middleware is launched, which looks like this:
export async function middleware(request: NextRequest) {
request....
0
votes
0
answers
18
views
CSP frame-ancestors wildcard usage failing
I've got a need to whitelist my website from being iframed just for one particular domain.
The url accessing the wildcard will be something like https://app.domain.com/project/123/456
The https://app....
0
votes
0
answers
30
views
cookie is not set in browser regardless setting everything
there are several questions in this topic. I tried many of the proposed solutions, but still I can't get it work.
I have a backend (NestJs) on localhost:3000 and a frontend (Angular) on localhost:4200....
-1
votes
0
answers
14
views
I want to understand Microsoft SSO work flow with third party
I am a newbie in the penetration testing field. So i'm currently learning the login flow of microsoft office, and i was able to understand how it sends headers and data to the final endpoints which is ...
0
votes
0
answers
30
views
Youtube Data API HTTP Referrer Restriction not working with Sveltekit and Vercel
There is a similar question on SO, and I have tried to do those things with my situation, but it is not working for me, hence asking this question as well.
YouTube API V3 - HTTP referrer restriction
I ...
0
votes
1
answer
77
views
next.js does a fetch instead of a redirect with a text/x-component content-type
I have a function in a next.js v13 app router app that ends with a redirect:
...
return NextResponse.redirect(redirectUrl.toString()
Instead of redirecting to a page, it instead informs the browser ...
0
votes
0
answers
34
views
What is the x-incap-sess-cookie-hdr header?
I've seen an HTTP header called x-incap-sess-cookie-hdr Her are some examples:
x-incap-sess-cookie-hdr: IfBmOyLQ2RLSl9UHsx97BvdpPGUAAAAAWwDOZlrDvW75HkdClD+7bQ== x-incap-sess-cookie-hdr: xOY/...
0
votes
0
answers
30
views
Adding X-Content-Type-Options to web.config causes page source to be returned?
My apologies if this is a basic question, but here goes:
I'm seeing a confusing issue when setting HTTP headers in my .NET Core website's web.config
In the "customHeaders" element, I've ...
0
votes
0
answers
32
views
Server sent a too long line error, while trying to connect ssh through Http Custom ssh client for Android
Im facing a problem, while trying to connect ssh with custom request/payload
I'm using HTTP CUSTOM ssh client for Android.
I'm using:-
jep-asset.akamaized.net as sni
And
49.44.112.166:443 as proxy:...
1
vote
0
answers
32
views
Making Angular add X-XSRF-TOKEN header despite having not root cookie
In our application (frontend is in angular, backend in java) there's the problem of not adding the X-XSRF-TOKEN header on a request, resulting in backend returning 403 (forbidden).
The xsrf mechanism ...
0
votes
1
answer
43
views
Request and Http Work on Postman but fails in Python
I have the following code:
import http.client
conn = http.client.HTTPSConnection("www.williams-sonoma.com")
payload = ''
headers = {
'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)...
-1
votes
1
answer
74
views
How do I add my own custom header key/value on TWebHttpRequest?
I've placed a non-visual TWebHttpRequest component onto my form and there is a Headers property where I can see and change some of the default headers:
But there doesn't seem to be a way to add my ...
0
votes
0
answers
39
views
Why are these headers not working? Steam login
I want to understand why the headers from the browser do not work. The authorization method has changed in Steam. Previously, everything worked on headers from the browser, but now.. The first thing ...