Hack Forums
Question about HTTP headers - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: Question about HTTP headers (/showthread.php?tid=6129494)

Question about HTTP headers - mutate - Dec 25, 2020

I looked around online, however I was unable to find a confirmation.

What I want to know is: If I'm sending an HTTP-GET Request to a web server, can the server deny the request if a certain HTTP Header isn't present in the request?
Example: a web server only accepts the request (returns an HTTP 200 'OK' response) if a header like Connection: Keep-Alive is present.

If you can block requests lacking certain headers, how does a server do this? Thanks!

-mutate

RE: Question about HTTP headers - FlashyBeach - Dec 25, 2020

This is literally a search away from you knowing it.

RE: Question about HTTP headers - mutate - Dec 25, 2020

(Dec 25, 2020 01:45 PM)FlashyBeach Wrote:  This is literally a search away from you knowing it.

Then why not help? Or at least point me in the right direction? Doesn't make much sense for a comment like that. I'm very new to this, and It's possible I'm not using the right search terms. I know you can harden the processing of HTTP requests sent to a server, but the information I pulled up on this referenced XXS and clickjacking protection, etc. Not what I was curious about.

Example: If I'm sending a simple get request to Google:
Code
GET / HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 6.0; en) Opera 9.50
Content-Encoding: gzip

Is there a way Google would detect the Content-Encoding header and deny the request? For whatever reason, ofc. I'm just trying to figure out if that's possible or not. I assume it is, but I'm failing to see how that would be implemented; either at the origin server or at the CDN.

RE: Question about HTTP headers - SIM-4725719 - Dec 25, 2020

bro you are not thinking this logically waht is the content-encoding header used for. And yes some WAFs block requests ifhtey don't have certain headers e.g. referer header etc.

RE: Question about HTTP headers - SecuroServ - Dec 25, 2020

In your .htaccess the following:

Code
RewriteEngine On
RewriteCond %{HTTP: connection} !^keep-alive$ [NC]
RewriteRule ^ - [F]


RE: Question about HTTP headers - mutate - Dec 25, 2020

(Dec 25, 2020 03:22 PM)SecuroServ Wrote:  In your .htaccess the following:

Code
RewriteEngine On
RewriteCond %{HTTP: connection} !^keep-alive$ [NC]
RewriteRule ^ - [F]

Thank you. I'll look into this 😎