RFC 7239: Forwarded HTTP Extension
Internet Engineering Task Force (IETF) A. Petersson Request for Comments: 7239 M. Nilsson Category: Standards Track Opera Software ISSN: 2070-1721 June 2014 Forwarded HTTP Extension Abstract This document defines an HTTP extension header field that allows proxy components to disclose information lost in the proxying process, for example, the originating IP address of a request or IP address of the
RFC 5861: HTTP Cache-Control Extensions for Stale Content
Independent Submission M. Nottingham Request for Comments: 5861 Yahoo! Inc. Category: Informational May 2010 ISSN: 2070-1721 HTTP Cache-Control Extensions for Stale Content Abstract This document defines two independent HTTP Cache-Control extensions that allow control over the use of stale responses by caches. Status of This Memo This document is not an Internet Standards Track specification; it i
X-Cache and X-Cache-Lookup Headers - Lyte's Blog
I watched a discussion about X-Cache and X-Cache-Lookup headers unfold recently and it turns out a lot of people who I would have thought knew what these headers were indicating were a little muddled up. Further more, it turned out if you go looking for a good explanation, everyone seems to just link to this rather old blog post - despite being well meaning, it’s unfortunately slightly confused to
HTTP Status Cats - The original
HTTP Status Cats by Tomomi Imura. The API is also available at http.cat (Thanks, Rogério!) Tweet me at @girlie_mac if you have ideas or pics recommendations! (Updated: I am receiving overwhelming amount of comments/suggestions! Thank you so much and sorry for not replying to all of you!) HTTP Status Codes desc: en.wikipedia.org/wiki/List_of_HTTP_status_codes
10 Varnish Cache mistakes and how to avoid them
1. Caching set cookies Caching an object with a Set-Cookie header can have devastating effects, as any client requesting the object will get that same cookie set. This can potentially lead to a session transfer. In general we recommend avoiding the use of return (deliver) in vcl_fetch, to stay safe against this. If you really do need a return (deliver), be careful and check for the presence of Set
Best practices for using the Vary header
As shown above, the browser sends a lot of information along with the URL. The Accept header tells you what sort of content the browser prefers, User-Agent specifies which version of what browser it is, Accept-Language contains a list of languages (and dialects) that the user has configured, and Accept-Encoding shows which compression schemes the browser supports. For practical purposes, we only c
Device detection — Varnish version 3.0.7 documentation
Device detection¶ Device detection is figuring out what kind of content to serve to a client based on the User-Agent string supplied in a request. Use cases for this are for example to send size reduced files to mobile clients with small screens and on high latency networks, or to provide a streaming video codec that the client understands. There are a couple of strategies on what to do with such
HTTP pipelining - Wikipedia
HTTP pipelining is a feature of HTTP/1.1, which allows multiple HTTP requests to be sent over a single TCP connection without waiting for the corresponding responses.[1] HTTP/1.1 requires servers to respond to pipelined requests correctly, with non-pipelined but valid responses even if server does not support HTTP pipelining. Despite this requirement, many legacy HTTP/1.1 servers do not support pi
HTTP Strict Transport Security - Wikipedia
HTTP Strict Transport Security (HSTS) is a policy mechanism that helps to protect websites against man-in-the-middle attacks such as protocol downgrade attacks[1] and cookie hijacking. It allows web servers to declare that web browsers (or other complying user agents) should automatically interact with it using only HTTPS connections, which provide Transport Layer Security (TLS/SSL), unlike the in
Webサイト常時SSL化のススメ － ＠IT
2012/03/28 ログインや入力フォームなどが含まれないページも含め、Webサイト全体のSSL化を検討してほしい――日本ベリサインは3月28日、常時SSL（Always-on SSL）に関する説明会を開催した。 米シマンテック シマンテックトラストサービシズ プロダクトマーケティング シニアディレクターのロブ・グリックマン氏は、「Webサイトのセキュリティはクリティカルな問題になっている」と述べ、主に2つの攻撃シナリオがあると説明した。 1つは、正規のWebサイトが攻撃者に乗っ取られて、アクセスしてきたユーザーにマルウェアを仕込んでしまうケース。もう1つは、通信経路で盗聴した情報によるなりすまし（セッションハイジャック）だ。 特に後者の問題に対する「簡単かつコスト効率に優れた解決策が、常時SSLだ」（グリックマン氏）という。すでに、FacebookやTwitter、Google、Pay
HAProxy - The Reliable, High Perf. TCP/HTTP Load Balancer
Quick News Dec, 5th, 2023 : HAProxy 2.9.0 release This release has received a lot of small changes that are difficult to summarize. Most of them were aimed at improving performance and resource usage in general (zero-copy forwarding, QUIC's smaller footprint for closed connections, improved scalability), others focusing on better integration with other components (support for the AWS-LC crypto lib
Requests: HTTP for Humans — Requests 2.4.3 documentation
Requests: HTTP for Humans™¶ Release v2.32.0. (Installation) Requests is an elegant and simple HTTP library for Python, built for human beings. Behold, the power of Requests: >>> r = requests.get('https://api.github.com/user', auth=('user', 'pass')) >>> r.status_code 200 >>> r.headers['content-type'] 'application/json; charset=utf8' >>> r.encoding 'utf-8' >>> r.text '{"type":"User"...' >>> r.json()
5. オープンソースWAF「ModSecurity」導入事例 ～ IPA はこう考えた ～
Copyright © 2010 独立行政法人 情報処理推進機構 ウェブサイト運営者向けセキュリティ対策セミナー 1 5. オープンソースWAF「ModSecurity」導入事例 ～ IPA はこう考えた ～ 独立行政法人 情報処理推進機構 (IPA) セキュリティセンター 情報セキュリティ技術ラボラトリー 2010年12月6日公開 目次 Copyright © 2010 独立行政法人 情報処理推進機構 ウェブサイト運営者向けセキュリティ対策セミナー 2 1. 背景・目的 2. JVN iPedia へのWAF導入 1. 事前検討 2. 導入 3. 運用 3. まとめ 背景 Copyright © 2010 独立行政法人 情報処理推進機構 ウェブサイト運営者向けセキュリティ対策セミナー 3 「WAF」の認知度が低い 理由：WAFについて、日本語で紹介している文献があまりない 「WAF」の
Top 8 Open Source WAF (Web Application Firewalls) for Web App Security - FROMDEV
Web application firewalls provide security at the application layer. Essentially, WAF provides all your web applications a secure solution which ensures the data and web applications are safe. A web application firewall applies a set of rules to HTTP conversation to identify and restrict the attacks of cross site scripting, SQL injections etc. You can also get web application framework and web bas
Bugtraq: a cheesy Apache / IIS DoS vuln (+a question)
a cheesy Apache / IIS DoS vuln (+a question) From: Michal Zalewski <lcamtuf () dione ids pl> Date: Thu, 4 Jan 2007 00:27:11 +0100 (CET) I feel silly for reporting this, but I couldn't help but notice that Apache and IIS both have a bizarro implementation of HTTP/1.1 "Range" header functionality (as defined by RFC 2616). Their implementations allow the same fragment of a file to be requested an arb
ウノウラボ Unoh Labs: Tips for nginx
何を今更と思うかもしれませんが、最近、英語圏に住んでいようがいまいが ソフトウェア開発で英語は必須だと改めて実感したbokkoです。 英語の技術書を読んでいる 日本人の開発者が作ったソフトウェアに付属している仕様書を読んだら英語で書かれていた 日本人の開発者宛に英語でバグレポートを書いていることに気付く(フォーラム全体が英語だった！) 私も自分の書いたライブラリのドキュメントを書き始めましたが、 全部英語だったりします。(少し前に海外の方からライセンスに関する質問を「英語」で受けました) そして、今日紹介するnginxも開発元はロシアですが、英語のドキュメントが充実しています。 nginxとは nginxは高速軽量なWebサーバです。 基本的なHTTPとしての機能に加えてSSLやFastCGIのサポート、 リバースプロキシ、バーチャルホスト、メールプロキシといった 便利な機能も
リリース、障害情報などのサービスのお知らせ
最新の人気エントリーの配信
j次のブックマーク
k前のブックマーク
lあとで読む
eコメント一覧を開く
oページを開く
RFC 7239 – Forwarded HTTP Header | c960657.github.io
HTTP2とHTTPヘッダインジェクションについて
Can I log HTTP 400s to a different log file instead of my default access logs
Nginx & PHP via FastCGI important security issue