<commit_before>+++
title = "Shadow Daemon and Client Headers"
description = ""
tags = [
    "shadowd",
    "configuration",
]
date = "2020-09-02"
categories = [
    "Development",
    "Shadow Daemon",
]
menu = "main"
url = "/shadowd_client_headers/"
aliases = [
    "/post/shadowd_client_headers/",
]
author = "<NAME>"
+++

It is now recommended to disable whitelist checks of client HTTP headers in Shadow Daemon to prevent false-positives.

<!--more-->

## Background

A HTTP client header is additional data that is passed to the web server by the client in a key-value format, for example self-identification as a specific browser through the user agent.
Historically the used headers were well defined and custom headers prefixed with `X-`.
This changed in 2012 when [RFC 6648 deprecated the `X-` prefix and similar constructs](https://tools.ietf.org/html/rfc6648).

Additionally, new headers are established by changes in the specification like [Cross-Origin Resource Sharing](https://developer.mozilla.org/de/docs/Web/HTTP/CORS), i.e. new clients may include new headers.
It is expected that the servers ignore headers that they do not know and need.<commit_msg>Change URL of last blog post<commit_after>+++
title = "Shadow Daemon and Client Headers"
description = ""
tags = [
    "shadowd",
    "configuration",
]
date = "2020-09-02"
categories = [
    "Development",
    "Shadow Daemon",
]
menu = "main"
url = "/shadowd-client-headers/"
aliases = [
    "/post/shadowd_client_headers/",
    "/shadowd_client_headers/"
]
author = "<NAME>"
+++

It is now recommended to disable whitelist checks of client HTTP headers in Shadow Daemon to prevent false-positives.

<!--more-->

## Background

A HTTP client header is additional data that is passed to the web server by the client in a key-value format, for example self-identification as a specific browser through the user agent.
Historically the used headers were well defined and custom headers prefixed with `X-`.
This changed in 2012 when [RFC 6648 deprecated the `X-` prefix and similar constructs](https://tools.ietf.org/html/rfc6648).

Additionally, new headers are established by changes in the specification like [Cross-Origin Resource Sharing](https://developer.mozilla.org/de/docs/Web/HTTP/CORS), i.e. new clients may include new headers.
It is expected that the servers ignore headers that they do not know and need.
{'fraction_non_alphanumeric': 0.09899328859060402, 'fraction_numerical': 0.016778523489932886, 'mean_word_length': 4.196078431372549, 'pattern_counts': {'":': 0, '<': 7, '<?xml version=': 0, '>': 7, 'https://': 4, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 2, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '115270', 'n_tokens_mistral': 705, 'n_tokens_neox': 652, 'n_words': 285}