Migrated to EA4, mod_headers not working in .htaccess

fonginator

Member
Oct 19, 2016
7
0
126
Montreal, Canada
cPanel Access Level
Root Administrator
Hi,

I took the plunge and migrated to EasyApache 4 last night. Everything mostly went smoothly, but I am noticing now that my sites' HSTS headers (which are set in their respective .htaccess files) are no longer being sent.

This is what used to work under my EasyApache 3 setup:

<IfModule mod_headers.c>
Header add Strict-Transport-Security "max-age=31536000"
</IfModule>

But no matter what I try (Header always add, Header set, Header always set...), this header never gets sent. Everything else in the .htaccess files seems to be getting parsed and I can trigger an HTTP 500 error if I create a syntax error in one of these files so I know they are being processed. Removing the <IfModule></IfModule> conditional doesn't help either, and I can confirm that mod_headers is activated in Apache.

Any ideas how to resolve this problem?
 

cPLevey

Technical Analyst Manager
Staff member
Dec 3, 2015
44
8
133
Houston, TX
cPanel Access Level
Root Administrator
Welcome to EasyApache 4!

Personally, I have HSTS headers configured on my EasyApache 4 setup, using Virtual Host Include Files. Documentation for this can be found here: Modify Apache Virtual Hosts with Include Files

For individual domains that you wish to add the HSTS headers to, you can simply add the configuration rule(s) to: /etc/apache2/conf.d/userdata/ssl/2_4/$user/$domain/$includename.conf

For example:
Code:
[/etc/apache2/conf.d/userdata/ssl/2_4/forumuser/forumuser.io]# cat hsts.conf
Header always set Strict-Transport-Security "max-age=31536000"
I hope this helps!
 

fonginator

Member
Oct 19, 2016
7
0
126
Montreal, Canada
cPanel Access Level
Root Administrator
Personally, I have HSTS headers configured on my EasyApache 4 setup, using Virtual Host Include Files. Documentation for this can be found here: Modify Apache Virtual Hosts with Include Files

For individual domains that you wish to add the HSTS headers to, you can simply add the configuration rule(s) to: /etc/apache2/conf.d/userdata/ssl/2_4/$user/$domain/$includename.conf
Hi David,

This is ultimately what I ended up having to do, but I find it to be less convenient since it requires root access (something which I don't necessarily have on all of the cPanel servers I plan to help roll out EA4 on) and breaks existing EA3 configurations.

Unless I'm missing something, putting this in the .htaccess file should work which is the most troublesome aspect of this. I wish I could understand whether this is a bug or some sort of side effect of going from mod_php/mod_ruid2 in EA3 to an fcgi setup with EA4.
 

linux4me2

Well-Known Member
Aug 21, 2015
259
79
78
USA
cPanel Access Level
Root Administrator
Unless I'm missing something, putting this in the .htaccess file should work which is the most troublesome aspect of this. I wish I could understand whether this is a bug or some sort of side effect of going from mod_php/mod_ruid2 in EA3 to an fcgi setup with EA4.
I'm using EA4 (v. 58.0.32) with Event MPM and suPHP, and I can confirm that the "set" command is working on an account's .htaccess based on the results from testing it on observatory.mozilla.org:
Code:
<IfModule mod_headers.c>
  Header set Strict-Transport-Security "max-age=15768000"
</IfModule>
 

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,904
2,237
463
Unless I'm missing something, putting this in the .htaccess file should work which is the most troublesome aspect of this. I wish I could understand whether this is a bug or some sort of side effect of going from mod_php/mod_ruid2 in EA3 to an fcgi setup with EA4.
Hello @fonginator,

Feel free to open a support ticket using the link in my signature so we can take a closer look. You can post the ticket number here so we can update this thread with the outcome.

Thank you.
 

DomineauX

Well-Known Member
PartnerNOC
Apr 12, 2003
429
11
168
Houston, TX
cPanel Access Level
Root Administrator
Was any solution ever found for this?
Seeing the same issue when trying to use the following in .htaccess files under EasyApache 4:

Header append X-FRAME-OPTIONS "SAMEORIGIN"

Works for .html files, but not .php scripts.
 

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,904
2,237
463
Was any solution ever found for this?
Seeing the same issue when trying to use the following in .htaccess files under EasyApache 4:

Header append X-FRAME-OPTIONS "SAMEORIGIN"

Works for .html files, but not .php scripts.
Hello,

Could you let us know which PHP version and handler is utilized for the accounts you are testing this with?

Thank you.
 

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,904
2,237
463
Apache/2.4.23 prefork
PHP 7.0.13
CGI Handler
This is likely due to the use of the CGI handler for PHP. You can read more about the interaction between CGI and Mod_Headers at:

mod_headers - Apache HTTP Server Version 2.4

Were you using CGI as the PHP handler before the conversion to EasyApache 4? If not, you should consider changing it back to the previously configured PHP handler. Information on changing the PHP handler is available at:

PHP Handlers - EasyApache 4 - cPanel Documentation

Let us know if this helps.

Thank you.
 

asuna123

Registered
Jan 16, 2017
2
0
1
indonesia
cPanel Access Level
Website Owner
was any solution this problem?
on .htaccess under EA4

<IfModule mod_header.c>
Header Set Cache-Control"max_age=3600"
<IfModule>

this is not work

<IfModule mod_header.c>
Header Set Cache-Control"max-age=3600"
<IfModule>
 

yaashul

Member
May 3, 2017
7
0
1
India
cPanel Access Level
Root Administrator
I am facing this problem still. Running the latest easyapache 4.

I am not able to set any header for the pages created by mod_rewrite or basically php pages. Rest of the images are showing the right headers. I am using FastCGI PHP FPM. Does anyone has ever found a solution for the same?
 

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,904
2,237
463
I am using FastCGI PHP FPM. Does anyone has ever found a solution for the same?
Hello,

Are you able to reproduce the issue when using a non-CGI handler such as DSO or suPHP?

Thank you.
 
Mar 17, 2016
18
1
3
cPanel Access Level
Root Administrator
This is likely due to the use of the CGI handler for PHP...
Hi Michael. I believe I came up with an htaccess solution and wish for you to review it in case it will help others. I see your name on many posts including some of mine in the past.

Code:
# Redirect to https
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

# Redirect to www
RewriteCond %{HTTP_HOST} ^yourdomain\.com [NC]
RewriteRule (.*) https://www.yourdomain.com/$1 [E=HTTPS,R=301,L]

# Security header
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains" env=HTTPS
The env=HTTPS environment variable wasn't working as expected. So I used the E=HTTPS flag on the www redirect to set the env=HTTPS environment variable on the next request.

My post and discussion
In Progress - htaccess Header Set doesn't set
 

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,904
2,237
463
Same problem for me, using mod_mpm_prefork. I can set headers for regular http but not https.
Does the thread linked in the post above yours help?

Thank you.
 

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,904
2,237
463
Hi @Olof,

Could you open a support ticket using the link in my signature so we can take a closer look?

Thank you.