4 ms·

Fun with HTTP headers

128 points by coderdude 16y ago

d_r 16y ago
E-mail headers can be fun too. For example, Facebook e-mails up to this day contain: X-Mailer: ZuckMail [version 1.00] The X-Mailer header traditionally indicates the mail client that was used to send the e-mail. Want to check if your friend who has "Sent from my iPhone" was really using an iPhone? Just look for "X-Mailer: iPhone Mail" (Of course, these headers can be arbitrarily set by a client, so this is not meant to be a definitive check.)
- n-named 16y ago
  Who makes up "Sent from my iPhone" messages, and why?
  - joeshaw 16y ago
    I like when people subtly tweak their iPhone messages. A friend for a while used "Sent from my iPhome"
acabal 16y ago
Cool article, but it's from 2005 and sadly many of those sites have dropped their funny headers. (At least most of the ones I tried myself.)
julian37 16y ago
The reason for "nnCoection" headers is explained in the replies to this bug report: https://forums.aws.amazon.com/message.jspa?messageID=81954 https://forums.aws.amazon.com/message.jspa?messageID=81954
- relix 16y ago
  Thanks, this cleared things up, especially the checksum-hack is neat. The original author's description wasn't really clear for me.
  - deleted 16y ago
    [deleted]
pepijndevos 16y ago
re: header job offerings I’m very sure Google has them. I came across it when working with one of their APIs, considered it for a while, and decided I wasn’t looking for a job at Google. I think it was Analytics, in case you want to work at Google.
- rquirk 16y ago
  Tech Crunch has one too. As well as "X-nananana: Batcache". EDIT: ah, I see that this is likely to be a Wordpress generic thing.
The_Fox 16y ago
Wordpress likes hackers: X-hacker: If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header.
tonyskn 16y ago
curl -i http://www.nextthing.org/archives/2005/08/07/fun-with-http-headers http://www.nextthing.org/archives/2005/08/07/fun-with-http-h...
dedward 16y ago
"X-Coral-Control: redirect-home headers show up. This header is used to tell Coral that if Coral can’t handle the load of requests for cached copies of your page, it should redirect these requests back to your site." This presumably makes sense if the site operator is prepared to scale or has a scaling strategy to put into play - but it might take some time. He'd rather have people bounced back to his infrastructure in order to see how to optimize than loose the visibility by coral. Also - (just a guess) some of the other headers - like the limerick - could be there to get around that IE behaviour where it won't show the real HTTP error message and instead shows you something generic and useless.
kijinbear 16y ago
Nothing beats Reddit's header. Server: '; DROP TABLE servertypes; --
wooster 16y ago
This was also on here awhile ago, with some interesting discussion: http://news.ycombinator.com/item?id=477046 http://news.ycombinator.com/item?id=477046
obeattie 16y ago
I've always been fond of Slashdot's X-Fry, X-Bender and X-Leela headers and their random quotes.

128 points by coderdude 16y ago

d_r 16y ago

E-mail headers can be fun too. For example, Facebook e-mails up to this day contain: X-Mailer: ZuckMail [version 1.00] The X-Mailer header traditionally indicates the mail client that was used to send the e-mail. Want to check if your friend who has "Sent from my iPhone" was really using an iPhone? Just look for "X-Mailer: iPhone Mail" (Of course, these headers can be arbitrarily set by a client, so this is not meant to be a definitive check.)

n-named 16y ago
Who makes up "Sent from my iPhone" messages, and why?
- joeshaw 16y ago
  I like when people subtly tweak their iPhone messages. A friend for a while used "Sent from my iPhome"

acabal 16y ago

Cool article, but it's from 2005 and sadly many of those sites have dropped their funny headers. (At least most of the ones I tried myself.)

julian37 16y ago

The reason for "nnCoection" headers is explained in the replies to this bug report: https://forums.aws.amazon.com/message.jspa?messageID=81954 https://forums.aws.amazon.com/message.jspa?messageID=81954

relix 16y ago
Thanks, this cleared things up, especially the checksum-hack is neat. The original author's description wasn't really clear for me.
- deleted 16y ago
  [deleted]

pepijndevos 16y ago

re: header job offerings I’m very sure Google has them. I came across it when working with one of their APIs, considered it for a while, and decided I wasn’t looking for a job at Google. I think it was Analytics, in case you want to work at Google.

rquirk 16y ago
Tech Crunch has one too. As well as "X-nananana: Batcache". EDIT: ah, I see that this is likely to be a Wordpress generic thing.

The_Fox 16y ago

Wordpress likes hackers: X-hacker: If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header.

tonyskn 16y ago

curl -i http://www.nextthing.org/archives/2005/08/07/fun-with-http-headers http://www.nextthing.org/archives/2005/08/07/fun-with-http-h...

dedward 16y ago

"X-Coral-Control: redirect-home headers show up. This header is used to tell Coral that if Coral can’t handle the load of requests for cached copies of your page, it should redirect these requests back to your site." This presumably makes sense if the site operator is prepared to scale or has a scaling strategy to put into play - but it might take some time. He'd rather have people bounced back to his infrastructure in order to see how to optimize than loose the visibility by coral. Also - (just a guess) some of the other headers - like the limerick - could be there to get around that IE behaviour where it won't show the real HTTP error message and instead shows you something generic and useless.

kijinbear 16y ago

Nothing beats Reddit's header. Server: '; DROP TABLE servertypes; --

wooster 16y ago

This was also on here awhile ago, with some interesting discussion: http://news.ycombinator.com/item?id=477046 http://news.ycombinator.com/item?id=477046

obeattie 16y ago

I've always been fond of Slashdot's X-Fry, X-Bender and X-Leela headers and their random quotes.