[urquhartfe]

I think you are the one who doesn't know what they are on about.

First, the header must be added to the response, not the request.

Second, in many environments (managed hosting etc.) there is not an easy way (or indeed a way at all) of adding headers to responses.

[KTibow]

> Second, in many environments (managed hosting etc.) there is not an easy way (or indeed a way at all) of adding headers to responses.

It's getting better. Most serverless hosts (including Cloudflare, which this site uses) follow the (req: Request) => Response pattern, which by definition allows sending headers.

[bapak]

What are you talking about. Any non-static hosting will let you specify headers with a plain php function. Any baseline shared hosting offers that kind of control and has done so for the past 20+ years.

[dylan604]

is that something that could have be done in the dot file for server override? what was it, .htaccess or something?

[throwanem]

Sure, if you wanted to deal with configuring Apache. Or getting your hosting provider to do that. If you knew to ask, and didn't mind waiting, and your hosting provider knew how...and was willing to do it, a condition I forgot to add in my last comment here, but which applies equally there. (User-provided .htaccess files were the source of a number of relatively high-profile early CVEs, as I recall. Apache grew a number of options for trusting their content, and I want to say before very long you could not rely on anything working past simple HTTP-Basic credential management.)

Oldschool shared web hosting was a shockingly deprived environment by modern standards, which is why my Linode account turned old enough a few months ago to buy a drink in a bar: $20 a month in 2004 was amply worth gaining a degree of control over web server configuration which is broadly the default assumption now.

Since I was also administering some shared web hosting in my own right at the time - partially overlapping with my web design work targeting shared hosting, since some customers preferred to BYO - I don't blame admins for being difficult to work with; we all had good reason to be, with the afterthought security typically was everywhere in those days. But you begin perhaps to see why bypassing the whole rigamarole with a hint to the client was attractive.

[dylan604]

but that was the point of the dot file to allow vhosts to change the default server settings without needing access to the root config. maybe they weren't designed specifically for vhosts, but that was my main use of them.

[throwanem]

Yes. If the main Apache config was set up to allow it to read a dotfile, and if configured not to ignore the options you wanted to use, that is what the dotfile did. That's why, if you wanted an option easily portable across hosting providers, you used the meta tag instead. Which is my point, and my only point, and not really up for debate by some pettifogging rando with nothing better to fill a Saturday night.

[dylan604]

Wtf, seriously. I was just asking. Sorry if that resulted in me pissing in your cheerios. Just because a question was asked doesn’t mean it was challenging your knowledge. I was just asking to clarify based on personal experience. If you don’t have time for questions or feel personally slighted that someone would have the gall to question the written word of the almighty throwanem, then posting on the internet is probably something you stop doing

[throwanem]

It isn't a question of "challenging [my] knowledge," it's a question of you acting like kind of a jerk. I realize you don't see yourself as the one starting an argument here, and I have observed your manners likewise lacking on many occasions on this website before. Your opinion of the matter is not well qualified. You're being an ass. Knock it off.

I realize you're probably not accustomed to being called on your lousy behavior. I doubt you will need to become so. But just for once, here we are. You don't bother to find out what you're talking about before you speak and then you want your hand held on points that were already clarified, had you but bothered to catch up. I don't tolerate that in candidates, I won't tolerate it in colleagues, and I see no very pressing reason to tolerate it here.

[astrange]

Ever tried doing it in nginx? You'll find `add_header` doesn't work at all the way you think it does.

And it doesn't allow overrides in dotfiles since that's not performant or secure.