I think the doors were opened up too far with this fix, which was
apparently intended to respect Server as set by the origin server for a
proxy request:
http://cvs.apache.org/viewcvs.cgi/httpd-2.0/modules/http/http_protocol.c.diff?r1=1.399&r2=1.400
Attached is an alternate, which matches 1.3 AF
Jeff Trawick wrote:
Attached is an alternate, which matches 1.3 AFAICT. I need to test it
with proxy to make sure proxyreq is set properly, but I have at least
confirmed that a CGI script can't decide what Server we should report.
Any concerns before I test further and commit?
In concept +1.
Graham Leggett wrote:
Jeff Trawick wrote:
Attached is an alternate, which matches 1.3 AFAICT. I need to test it
with proxy to make sure proxyreq is set properly, but I have at least
confirmed that a CGI script can't decide what Server we should report.
Any concerns before I test further and co
Jeff Trawick wrote:
Thanks for the feedback. I tried to see an indication that the more
liberal acceptance of Server was desired. Its good to see for sure that
it wasn't.
The problem of Server being overwritten during proxy operation has been
logged as an HTTP compliance violation in bugzilla
