1

I am trying to set a header using mod_headers in Apache in all cases EXCEPT a certain path. I've tried each of the three variations below to do so, but none of them seem to work properly to exclude the path. In ALL cases I get the header for all requests, including those that match the example path, e.g.: http://example.com/charts/24_hour_commodity/450/300

<VirtualHost *:8200>
...
    SetEnvIfNoCase Request_URI "^/charts/.*" frameallow
    Header set X-Frame-Options SAMEORIGIN env=!frameallow
...
</VirtualHost>

Or:

<VirtualHost *:8200>
...
    Header always set X-Frame-Options SAMEORIGIN
    <LocationMatch "^/charts">
        Header always unset X-Frame-Options
    </LocationMatch>
...
</VirtualHost>

Or

<VirtualHost *:8200>
...
    Header always set X-Frame-Options SAMEORIGIN
    <Directory "/full/path/to/charts">
        Header always unset X-Frame-Options
    </Directory>
...
</VirtualHost>

#tried both with and without the 'always' in all configs

Can anyone help me figure out why the header is set in the first example or not unset in the following two? Any one working solution would be enough...

UPDATE: After reading about order of processing on the Apache site, I tried using conditional blocks instead. Neither of those work either:

<If "%{REQUEST_URI} =~ m#^/charts#">
    Header unset X-Frame-Options
</If>

Or

SetEnvIfNoCase Request_URI "^/charts" frameallow
<If "reqenv('frameallow') == 1">
    Header unset X-Frame-Options
</If>

So, still broken. Must be something about the Header statements not firing after a certain point in processing. Or the ones int he conditional somehow firing before the main one and being overridden. Cannot find a way to debug it down to the root cause though.

Alex
  • 11
  • 4
  • After much more digging, I see this is unanswered a few other places as well. Including here: http://serverfault.com/questions/792728/apache-2-4-header-unset-in-location-does-not-work and here: http://serverfault.com/questions/773913/apache-doesnt-unset-headers Looks like this is a long-standing problem of some kind, but still trying to get to the root of it. Anyone can help? – Alex Jan 23 '17 at 19:02

1 Answers1

0

Responses header with expression

Header always set Access-Control-Allow-Origin * "expr=%{REQUEST_URI} =~ m#^/specialPath$#"

this may add header wen the expr = true

http://httpd.apache.org/docs/current/mod/mod_headers.html

at the bottom of the section Header Directive

Gaurav Jeswani
  • 4,410
  • 6
  • 26
  • 47
young
  • 71
  • 7