Returning server name in HTTP response headers
This particular problem has been bugging me for some time now: How does one track down a problematic web server behind a load balancer?
In the past, we’ve hidden HTML elements in the document body to indicate the server that generated the response. (For an example of this, go to a page on friendster and view source, search for "phpapp" and you’ll see one.) This has a couple drawbacks. The server name is not returned if:
- Apache is segfaulting or otherwise fucking around on you.
- You are viewing non-dynamic content such as static HTML.
- You are requesting images
Initially I tried using the PassEnv directive (See Docs) to pass in the $HOSTNAME variable from the system by adding the following to my apache config.
# Note - this config will not work
PassEnv HOSTNAME
Header set hostname %{HOSTNAME}
However, for the life of me, I could not figure out how to make apache properly interpret the HOSTNAME variable. Every time I looked at the response header, I would just get the following header:
hostname: %{HOSTNAME}
If someone reading this knows why this is, please reply and let me know where my error is.
The workaround:
I modified my /etc/init.d/apache start script with the following lines. (You’ll need to modify these a bit depending on your distro.)
HTTPD_OPT="-c header set Hostname $HOSTNAME"
…
startproc -t $HTTPD_START_TIMEOUT $HTTPD_BIN "$HTTPD_OPT
(Don’t forget to enable the mod_headers module in your httpd.conf as well.)
Now, whenever you make a request from the outside, you’ll see a response like this one:
HTTP/1.x 302 Found
Date: Tue, 10 Jan 2006 22:31:09 GMT
Server: Apache/1.3.31 (Unix) PHP/4.3.8
Hostname: phpapp64
X-Powered-By: PHP/4.3.8
Location: /home.php
Cneonction: close
Transfer-Encoding: chunked
Content-Type: text/html; charset=iso-8859-1
X-Pad: avoid browser bug
If you don’t already have it, I suggest checking out LiveHTTPHeaders for Mozilla FireFox which will display request/response headers as you use your browser.
July 10th, 2006 at 1:59 pm
a h r e f = ” h t t p : / / w w w . w i n - 8 8 8 - c a s i n o . c o m / ” C A S I N O S J A C K P O T S : g u i d e c o n s e i l d u c a s i n o e n l i g n e , p o k e r , b l a c k j a c k
February 3rd, 2008 at 7:38 pm
Hello. I found you on Friendster’s WHOIS data; it says you are the technical contact for Friendster. I’m writing to you because someone there has opened an account using my email address, and now I am getting all of that person’s friendster stuff. I would like to get my email address removed from the site, as it is not with my permission. Can you help?