http-headers

How to delete IIS custom headers like X-Powered-By: ASP.NET from response?

by

You can add this to your Web.Config: <system.webServer> <httpProtocol> <customHeaders> <remove name=”X-Powered-By” /> </customHeaders> </httpProtocol> </system.webServer> Update: if you’re using the MVC framework I would also recommend removing the X-AspNetMvc-Version and X-AspNet-Version headers as well. This is accomplished by setting MvcHandler.DisableMvcResponseHeader = true in your Global.asax file and <system.web><httpRuntime enableVersionHeader=”false” /></system.web> in your Web.config respectively.

Expires vs max-age, which one takes priority if both are declared in a HTTP response?

by

See this answer: Difference between three .htaccess expire rules If a response includes both an Expires header and a max-age directive, the max-age directive overrides the Expires header, even if the Expires header is more restrictive. This rule allows an origin server to provide, for a given response, a longer expiration time to an HTTP/1.1 … Read more

Stop browser to make HTTP requests for images that should stay cached – mod_expires

by

The behavior you are seeing is the intended (see RFC7234 for more details), specified behavior: All modern browsers will send HTTP requests to the server for every page element displayed, regardless of cache status. This was a design decision made at the request of web services (especially advertising networks) to ensure that HTTP servers were … Read more

Are HTTP headers (Content-Type, &c.) case-sensitive? [duplicate]

by

Case-insensitive. Hypertext Transfer Protocol — HTTP/1.1: 4.2 Message Headers HTTP header fields, which include general-header (section 4.5), request-header (section 5.3), response-header (section 6.2), and entity-header (section 7.1) fields, follow the same generic format as that given in Section 3.1 of RFC 822 [9]. Each header field consists of a name followed by a colon (“:”) … Read more

Sending multipart/mixed content with Postman Chrome extension

by

I was facing this problem too. Short answer: remove the Content-Type header from your Postman request. The long story is that the Content-Type for a multipart request should be rather special — it should look kind of like this: multipart/form-data; boundary=—-WebKitFormBoundaryzeZR8KqAYJyI2jPL The problem is that the boundary is important and it needs to exactly match … Read more

Hiding PHP’s X-Powered-By header

by

You can set expose_php = Off in your php.ini if you don’t want it to send X-Powered-By header. PHP first compiles everything (including which headers have which values ) and then start the output, not vice-versa. PHP is also detectable with its own easter eggs, you can read about this topic here : PHP Easter … Read more