By responding with Access-Control-Allow-Origin: *, the requested resource allows sharing with every origin. This basically means that any site can send an XHR request to your site and access the server’s response which would not be the case if you hadn’t implemented this CORS response. So any site can make a request to your site … Read more
The Content-Type header is just used as info for your application. The browser doesn’t care what it is. The browser just returns you the data from the AJAX call. If you want to parse it as JSON, you need to do that on your own. The header is there so your app can detect what … Read more
Never mind, I figured it out – I used the Set() method on Header() (doh!) My handler looks like this now: func saveHandler(w http.ResponseWriter, r *http.Request) { // allow cross domain AJAX requests w.Header().Set(“Access-Control-Allow-Origin”, “*”) } Maybe this will help someone as caffeine deprived as myself sometime 🙂
In Express >= 3.0.0rc5: app.disable(‘x-powered-by’); Here is a simple middleware that removes the header in earlier versions of Express: app.use(function (req, res, next) { res.removeHeader(“x-powered-by”); next(); });
Cache-Control: no-cache is generally used in a request header (sent from web browser to server) to force validation of the resource in the intermediate proxies. If the client doesn’t send this request to the server, intermediate proxies will return a copy of the content if it is fresh (has not expired according to Expire or … Read more
It will/may be empty when the enduser entered the site URL in browser address bar itself. visited the site by a browser-maintained bookmark. visited the site as first page in the window/tab. clicked a link in an external application. switched from a https URL to a http URL. switched from a https URL to a … Read more
When the browser puts something in its cache, it also stores the Last-Modified or ETag header from the server. The browser then sends a request with the If-Modified-Since or If-None-Match header, telling the server to send a 304 if the content still has that date or ETag. The server needs some way of calculating a … Read more
X-Powered-By is a custom header in IIS. Since IIS 7, you can remove it by adding the following to your web.config: <system.webServer> <httpProtocol> <customHeaders> <remove name=”X-Powered-By” /> </customHeaders> </httpProtocol> </system.webServer> This header can also be modified to your needs, for more information refer to http://www.iis.net/ConfigReference/system.webServer/httpProtocol/customHeaders Add this to web.config to get rid of the X-AspNet-Version … Read more
HTTP 499 in Nginx means that the client closed the connection before the server answered the request. In my experience is usually caused by client side timeout. As I know it’s an Nginx specific error code.
Pragma is the HTTP/1.0 implementation and cache-control is the HTTP/1.1 implementation of the same concept. They both are meant to prevent the client from caching the response. Older clients may not support HTTP/1.1 which is why that header is still in use.