http-headers

Return a PHP page as an image

The PHP Manual has this example: <?php // open the file in a binary mode $name=”./img/ok.png”; $fp = fopen($name, ‘rb’); // send the right headers header(“Content-Type: image/png”); header(“Content-Length: ” . filesize($name)); // dump the picture and stop the script fpassthru($fp); exit; ?> The important points is that you must send a Content-Type header. Also, you … Read more

‘Refresh’ HTTP header

As far as I know, Refresh (along with Set-Cookie and possibly some other proprietary pseudo-headers) were created by Netscape in the very early days of the internet and have been basically (but not quite) standard since then. Because just about every browser supports it, Refresh is pretty safe to use — and commonly is. I … Read more

What security risks exist when setting Access-Control-Allow-Origin to accept all domains?

By responding with Access-Control-Allow-Origin: *, the requested resource allows sharing with every origin. This basically means that any site can send an XHR request to your site and access the server’s response which would not be the case if you hadn’t implemented this CORS response. So any site can make a request to your site … Read more

Force file download with php using header()

I’m pretty sure you don’t add the mime type as a JPEG on file downloads: header(‘Content-Type: image/png’); These headers have never failed me: $quoted = sprintf(‘”%s”‘, addcslashes(basename($file), ‘”\\’)); $size = filesize($file); header(‘Content-Description: File Transfer’); header(‘Content-Type: application/octet-stream’); header(‘Content-Disposition: attachment; filename=” . $quoted); header(“Content-Transfer-Encoding: binary’); header(‘Connection: Keep-Alive’); header(‘Expires: 0’); header(‘Cache-Control: must-revalidate, post-check=0, pre-check=0’); header(‘Pragma: public’); header(‘Content-Length: ‘ … Read more

How do I read any request header in PHP

IF: you only need a single header, instead of all headers, the quickest method is: <?php // Replace XXXXXX_XXXX with the name of the header you need in UPPERCASE (and with ‘-‘ replaced by ‘_’) $headerStringValue = $_SERVER[‘HTTP_XXXXXX_XXXX’]; ELSE IF: you run PHP as an Apache module or, as of PHP 5.4, using FastCGI (simple … Read more