Skip to the content
Documentation
Version 6.x Supported

[HTTPHeaderSettings]

Written by Svitlana Shatokhina, Updated by Graham Brookins
No ratings yet
Setting Summary
ClientIpByCustomHTTPHeader To specify http header containing ip address when behind trusted proxy
CustomHeader Setting to enable/disable custom HeaderList globally
HeaderList Contains all HTTP which should override standard ones.
OnlyForAnonymous Setting to set custom HeaderList for anonymous users only
OnlyForContent Setting to set custom HeaderList matching root url to only match content url's

Changed in Exponential 6.0.15

Settings of this group in the settings files of Exponential 6.0.15 that this page does not describe:

Setting File Default Description
Cache-Control settings/site.ini /=no-cache, must-revalidate Cache-Control values are set directly
Pragma settings/site.ini /=no-cache Pragma values are set directly
Expires settings/site.ini /=-7200 Expires specifies time offset compared to current time Default expired 2 hours ago ( no caching )
TrustedProxies settings/site.ini 127.0.0.1; ::1 The reverse proxies and load balancers in front of this site whose forwarded headers can be believed: X-Forwarded-For (with ClientIpByCustomHTTPHeader), X-Forwarded-Proto, X-Forwarded-Port, X-Forwarded-Server and X-Forwarded-Host. They are request headers any visitor can send, so they count only when the connection comes from one of these addresses (REMOTE_ADDR). Addresses and address/prefix ranges, IPv4 and IPv6, e.g. TrustedProxies[]=10.0.0.0/8 TrustedProxies[]=192.0.2.10 TrustedProxies[]=2001:db8::/32 The default trusts a proxy on this machine only. A trusted proxy must set these headers itself, not pass on what the visitor sent. An override that starts with "TrustedProxies[]" alone replaces the list; leave it empty to trust no proxy at all. See doc/eng-us/bc/6.0/trusted-proxies.md.
SecurityHeaders settings/site.ini X-Content-Type-Options=nosniff; X-Frame-Options=SAMEORIGIN; Content-Security-Policy=frame-ancestors 'self'; Referrer-Policy=strict-origin-when-cross-origin; Permissions-Policy=camera=(), microphone=(), payment=(), usb=(); Strict-Transport-Security= Security headers sent with every page, SecurityHeaders[<header>]=<value>. Set a value empty in an override to drop that header. HeaderList above still overrides these per path. - frame-ancestors / X-Frame-Options: pages may only be framed by the same site (clickjacking); allow a trusted editor host explicitly, e.g. SecurityHeaders[Content-Security-Policy]=frame-ancestors 'self' https://edit.example.com - Strict-Transport-Security is only sent over HTTPS and is off by default: enable it once the whole site is HTTPS-only, e.g. SecurityHeaders[Strict-Transport-Security]=max-age=31536000

In this section

Contributors

Comments

Add a comment

Comments are read by a moderator before they appear.