[mutate]

I looked around online, however I was unable to find a confirmation.

What I want to know is: If I'm sending an HTTP-GET Request to a web server, can the server deny the request if a certain HTTP Header isn't present in the request?
Example: a web server only accepts the request (returns an HTTP 200 'OK' response) if a header like Connection: Keep-Alive is present.

If you can block requests lacking certain headers, how does a server do this? Thanks!

-mutate

[FlashyBeach]

This is literally a search away from you knowing it.

[mutate]

This is literally a search away from you knowing it.

Then why not help? Or at least point me in the right direction? Doesn't make much sense for a comment like that. I'm very new to this, and It's possible I'm not using the right search terms. I know you can harden the processing of HTTP requests sent to a server, but the information I pulled up on this referenced XXS and clickjacking protection, etc. Not what I was curious about.

Example: If I'm sending a simple get request to Google:

Code

GET / HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 6.0; en) Opera 9.50
Content-Encoding: gzip

Is there a way Google would detect the Content-Encoding header and deny the request? For whatever reason, ofc. I'm just trying to figure out if that's possible or not. I assume it is, but I'm failing to see how that would be implemented; either at the origin server or at the CDN.

[SIM-4725719]

bro you are not thinking this logically waht is the content-encoding header used for. And yes some WAFs block requests ifhtey don't have certain headers e.g. referer header etc.

[SecuroServ]

In your .htaccess the following:

Code

RewriteEngine On
RewriteCond %{HTTP: connection} !^keep-alive$ [NC]
RewriteRule ^ - [F]

[mutate]

In your .htaccess the following:

Code

RewriteEngine On
RewriteCond %{HTTP: connection} !^keep-alive$ [NC]
RewriteRule ^ - [F]

Thank you. I'll look into this 😎