Apache mod_headers cannot unset header on a path

2.5k Views Asked by At

I am trying to set a header using mod_headers in Apache in all cases EXCEPT a certain path. I've tried each of the three variations below to do so, but none of them seem to work properly to exclude the path. In ALL cases I get the header for all requests, including those that match the example path, e.g.: http://example.com/charts/24_hour_commodity/450/300

<VirtualHost *:8200>
...
    SetEnvIfNoCase Request_URI "^/charts/.*" frameallow
    Header set X-Frame-Options SAMEORIGIN env=!frameallow
...
</VirtualHost>

Or:

<VirtualHost *:8200>
...
    Header always set X-Frame-Options SAMEORIGIN
    <LocationMatch "^/charts">
        Header always unset X-Frame-Options
    </LocationMatch>
...
</VirtualHost>

Or

<VirtualHost *:8200>
...
    Header always set X-Frame-Options SAMEORIGIN
    <Directory "/full/path/to/charts">
        Header always unset X-Frame-Options
    </Directory>
...
</VirtualHost>

#tried both with and without the 'always' in all configs

Can anyone help me figure out why the header is set in the first example or not unset in the following two? Any one working solution would be enough...

UPDATE: After reading about order of processing on the Apache site, I tried using conditional blocks instead. Neither of those work either:

<If "%{REQUEST_URI} =~ m#^/charts#">
    Header unset X-Frame-Options
</If>

Or

SetEnvIfNoCase Request_URI "^/charts" frameallow
<If "reqenv('frameallow') == 1">
    Header unset X-Frame-Options
</If>

So, still broken. Must be something about the Header statements not firing after a certain point in processing. Or the ones int he conditional somehow firing before the main one and being overridden. Cannot find a way to debug it down to the root cause though.

1

There are 1 best solutions below

0
On

Responses header with expression

Header always set Access-Control-Allow-Origin * "expr=%{REQUEST_URI} =~ m#^/specialPath$#"

this may add header wen the expr = true

http://httpd.apache.org/docs/current/mod/mod_headers.html

at the bottom of the section Header Directive