11

I sense I'm going to end up embarrassed for asking such a simple question, but I've been researching for days and can't any useful information.

What determines the HTTP response header that a server sends? If I control the server (if we need concreteness, let's say Apache), then what file can I edit to change the response header? For example, to set it to include Content-Length instead of Transfer-Encoding: chunked?

I'm aware that PHP and Java Servlets can be used to manipulate headers. The existence and content of response headers is fundamental to HTTP, though, so there ought to exist a way to edit these without using outside technology, no?

JonahHuron
  • 297
  • 1
  • 2
  • 12
  • 2
    You can edit the `httpd.conf` or `.htaccess` to add/modify http headers. – CollinD Feb 22 '16 at 21:58
  • @CollinD: I thought that this must be true for apache2.conf (in my case), but I couldn't find anything in the file that seemed to deal with headers. And any information that might exist online about how to do this is drowned out by the assumption that I'm using mod_headers. Thanks! – JonahHuron Feb 23 '16 at 15:28
  • 1
    The last comment from @JonahHuran went unanswered for several years, but I'm responding here because it does trip people up when learning Apache. Many of the examples and advice about configuring Apache fail to mention that most of these configuration options might be found in a vhost config file rather than httpd.conf because they can be set on a per-site basis. With Apache 2 those conf files typically live in some place like /usr/local/etc/httpd/vhosts/ (this location is configured in httpd.conf with an Include under the comment "Virtual hosts"). – Gary W. Longsine Jul 11 '21 at 02:04

1 Answers1

18

Certain headers are set automatically. They are part of the HTTP spec and the server takes care of them for you. That’s what a web server is for and why it differs from, say, an FTP server or a fileshare. For example Content-Length is easily calculated by the webserver and needs to be set so the server just does it.

Certain other headers are set based on config. Apache usually loads a main config file (often called httpd.conf or apache2.conf) but then, to save this file getting into a big unwieldy mess it often loads other files from within that. Those files are just text files with lines of configuration text to change behaviour of the server. Other web servers may use XML configuration files and may have a GUI to control the config (e.g. IIS)

So, for some of the headers, you might not explicitly set the header value but you basically configure the server and it then uses that config to figure out the appropriate headers to send. For example you can configure the server to gzip certain files (e.g. text files but not jpgs which are already compressed). In Apache this is handled by the mod_deflate module and the config options it gives you. Once the appropriate config is added to the server config, the server will do the necessarily processing (e.g. gzip the file or not depending on type) and then automatically add the headers. So an Apache module is basically something that changes how the server works and this may or may not the also set headers. Another example is for sending caching headers to tell the browser how long to cache files for. This is controlled by adding the mod_expiries module and all the config options it allows. While some of these headers could be hardcoded (e.g. Cache-Control) others depend on Apache doing calculations (e.g. Expires) so better to use the module to do this for you based on your config.

And finally you can explicitly set headers in your server (in Apache this is done using the mod_headers module). This is useful for new features added to browsers for example (e.g. HSTS, CSP or HPKP) where the server doesn't need to do anything but just add the header and the client (e.g. the web browser) knows what to do with them. You could add a JonahHuron header for example by adding this config to httpd.conf:

Header always set JonahHuron "Some Value"

As to whether that header is used depends entirely on the program receiving the response.

Barry Pollard
  • 40,655
  • 7
  • 76
  • 92