what the hell is HTTP_AAAAAAAAAAAAAAA

sneakyimp

i found the ini setting under apache environment.

HTTP_AAAAAAAAAAAAAAA : +++++++++++++

thorpe

Read the link in my signiture.

sneakyimp

ok, i've googled for the setting specifically (and it's a very specific search) and not a single result in english was any help. all 9 of them. try it!
http://www.google.com/search?hl=en&q=HTTP_AAAAAAAAAAAAAAA&btnG=Google+Search

I looked in my php.ini and didn't even find it there. Maybe that's question part b: how did that setting get into php without first being in the PHP.ini file?

Your post is not particularly informative for the question at hand, so i'll try again (let me know if this forum is totally inappropriate) so i'll try again according to Eric Steven Raymond's seminal FAQ, "How to Ask Questions the Smart Way."

Again, please do let me know if there is a better forum, if the header is not meaningful or specific, if my grammar or spelling is wrong, or if i'm groveling here.

Ahem:

I was looking at my phpinfo() output on my server (linux/apache 2.0/php 5.1.2) and noticed that there are a considerable number of enable directives There is one in particular which seemed a bit suspect. It was (and is) suspicious enough, in fact, that It occurred to me to ask what it might be for.

Can anyone tell me what the PHP ini setting for 'HTTP_AAAAAAAAAAAAAAA' is doing? The value it is set to on my machine is +++++++++ (that's 9 pluses).

MarkR

What's happening is, some cheap and ropey firewalls, are doing content modification on outgoing packets.

It's really tricky for them to change the size of a packet, so they simply replace HTTP headers that they don't like, with AAAAA or ++++.

These ropey misguided firewalls whose authors (or their management) believe that it improves security, usually block HTTP_REFERER and/or USER_AGENT. So it's probably one of those, but could be something else the firewall has simply decided to block for its own arbitrary reasons.

Remember that windows users are more likely to buy the box if it says something like

"Shitetech personal firewall 2006 blocks all HTTP_REFERER AND HTTP_USER_AGENT header s automatically"

Even though they won't know what they are and what purpose they serve.

Mark

sneakyimp

thanks mark! but i'm still a bit unclear on the relation of my server's apache/php config to these ropey firewalls. Neither HTTP_REFERER nor HTTP_USER_AGENT are emptied on my machine.

i'm guessing that apache or php has some facility to deal with ropey firewalls?

MarkR

Basically these weird headers aren't supplied by the browser, or a proxy, but rather some funny packet modification that is done by some software somewhere along the way (probably on the originating host in a software firewall).

The headers WERE supplied by the browser, but something decided to obliterate them. In order to determine what they were, you can sometimes check the length of them and guess.

If user-agent and referer are both supplied, but you're still getting HTTP_AAAAA etc, then it may be some other header. The only real way of determining this is to try it out on your LAN, comparing headers sent with various dodgy firewall products turned on / off on a test box.

Really, really, do this on a test box not your valuable development machine 🙂

There is no way of detecting what these headers were, or what the software product is which is causing them to be obliterated in this manner.

Mark

sneakyimp

thanks again. sorry if i sound like a dunce here but i just want to make sure i understand.

i was asking about these values that i saw in the output of php_info. in particular, the section titled 'Apache Environment'. I am not looking at some particular header. This is in the content of the page.

phpinfo is echoing back certain name/value pairs that it has extracted from the HTTP headers that we are exchanging. In other words

My Browser sends header/request to the server
SOMETHING GARBLES NAME/VALUE PAIR IN HEADER/REQUEST ALONG THE WAY
php receives now garbled request/header and echoes it to me in the body of an html document which is not garbled but at all truly reflects what PHP sees in the header i originally sent.

is that correct?

XPertMailer

header('AAAAAAAAAAAAAAA: something');