]> granicus.if.org Git - apache/blob - docs/manual/mod/mod_policy.html.en
Documentation rebuild after recent commits
[apache] / docs / manual / mod / mod_policy.html.en
1 <?xml version="1.0" encoding="ISO-8859-1"?>
2 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
3 <html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"><head>
4 <meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type" />
5 <!--
6         XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
7               This file is generated from xml source: DO NOT EDIT
8         XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
9       -->
10 <title>mod_policy - Apache HTTP Server Version 2.5</title>
11 <link href="../style/css/manual.css" rel="stylesheet" media="all" type="text/css" title="Main stylesheet" />
12 <link href="../style/css/manual-loose-100pc.css" rel="alternate stylesheet" media="all" type="text/css" title="No Sidebar - Default font size" />
13 <link href="../style/css/manual-print.css" rel="stylesheet" media="print" type="text/css" /><link rel="stylesheet" type="text/css" href="../style/css/prettify.css" />
14 <script src="../style/scripts/prettify.min.js" type="text/javascript">
15 </script>
16
17 <link href="../images/favicon.ico" rel="shortcut icon" /></head>
18 <body>
19 <div id="page-header">
20 <p class="menu"><a href="../mod/">Modules</a> | <a href="../mod/quickreference.html">Directives</a> | <a href="http://wiki.apache.org/httpd/FAQ">FAQ</a> | <a href="../glossary.html">Glossary</a> | <a href="../sitemap.html">Sitemap</a></p>
21 <p class="apache">Apache HTTP Server Version 2.5</p>
22 <img alt="" src="../images/feather.png" /></div>
23 <div class="up"><a href="./"><img title="&lt;-" alt="&lt;-" src="../images/left.gif" /></a></div>
24 <div id="path">
25 <a href="http://www.apache.org/">Apache</a> &gt; <a href="http://httpd.apache.org/">HTTP Server</a> &gt; <a href="http://httpd.apache.org/docs/">Documentation</a> &gt; <a href="../">Version 2.5</a> &gt; <a href="./">Modules</a></div>
26 <div id="page-content">
27 <div id="preamble"><h1>Apache Module mod_policy</h1>
28 <div class="toplang">
29 <p><span>Available Languages: </span><a href="../en/mod/mod_policy.html" title="English">&nbsp;en&nbsp;</a></p>
30 </div>
31 <table class="module"><tr><th><a href="module-dict.html#Description">Description:</a></th><td>HTTP protocol compliance enforcement.</td></tr>
32 <tr><th><a href="module-dict.html#Status">Status:</a></th><td>Extension</td></tr>
33 <tr><th><a href="module-dict.html#ModuleIdentifier">Module Identifier:</a></th><td>policy_module</td></tr>
34 <tr><th><a href="module-dict.html#SourceFile">Source File:</a></th><td>mod_policy.c</td></tr></table>
35 <h3>Summary</h3>
36
37     <p>The HTTP protocol recommends that clients should be "liberal in
38     what they accept", and servers "strict with what they send". In some
39     cases it can be difficult to detect when a server or an application
40     has been misconfigured, is serving uncacheable content or is behaving
41     suboptimally, as an HTTP client might be compensating for the server.
42     These problems can potentially lead to excessive bandwidth
43     consumption, or a server outage under load.</p>
44
45     <p>The <code class="module"><a href="../mod/mod_policy.html">mod_policy</a></code> module consists of a set of
46     filters that test servers for HTTP protocol compliance. These
47     tests allow the server administrator to log violations of, or
48     outright reject responses where certain defined conditions exist.</p>
49
50     <p>This could be used as a way to set minimum HTTP protocol compliance
51     criteria for a restful application. Alternatively, a reverse proxy or
52     cache could be configured to protect itself from misconfigured origin
53     servers or unexpectedly uncacheable content, or as a mechanism to
54     detect configuration mistakes within the server itself.</p>
55
56 </div>
57 <div id="quickview"><h3>Topics</h3>
58 <ul id="topics">
59 <li><img alt="" src="../images/down.gif" /> <a href="#actions">Actions</a></li>
60 <li><img alt="" src="../images/down.gif" /> <a href="#tests">Policy Tests</a></li>
61 <li><img alt="" src="../images/down.gif" /> <a href="#example">Example Configuration</a></li>
62 </ul><h3 class="directives">Directives</h3>
63 <ul id="toc">
64 <li><img alt="" src="../images/down.gif" /> <a href="#policyconditional">PolicyConditional</a></li>
65 <li><img alt="" src="../images/down.gif" /> <a href="#policyconditionalurl">PolicyConditionalURL</a></li>
66 <li><img alt="" src="../images/down.gif" /> <a href="#policyenvironment">PolicyEnvironment</a></li>
67 <li><img alt="" src="../images/down.gif" /> <a href="#policyfilter">PolicyFilter</a></li>
68 <li><img alt="" src="../images/down.gif" /> <a href="#policykeepalive">PolicyKeepalive</a></li>
69 <li><img alt="" src="../images/down.gif" /> <a href="#policykeepaliveurl">PolicyKeepaliveURL</a></li>
70 <li><img alt="" src="../images/down.gif" /> <a href="#policylength">PolicyLength</a></li>
71 <li><img alt="" src="../images/down.gif" /> <a href="#policylengthurl">PolicyLengthURL</a></li>
72 <li><img alt="" src="../images/down.gif" /> <a href="#policymaxage">PolicyMaxage</a></li>
73 <li><img alt="" src="../images/down.gif" /> <a href="#policymaxageurl">PolicyMaxageURL</a></li>
74 <li><img alt="" src="../images/down.gif" /> <a href="#policynocache">PolicyNocache</a></li>
75 <li><img alt="" src="../images/down.gif" /> <a href="#policynocacheurl">PolicyNocacheURL</a></li>
76 <li><img alt="" src="../images/down.gif" /> <a href="#policytype">PolicyType</a></li>
77 <li><img alt="" src="../images/down.gif" /> <a href="#policytypeurl">PolicyTypeURL</a></li>
78 <li><img alt="" src="../images/down.gif" /> <a href="#policyvalidation">PolicyValidation</a></li>
79 <li><img alt="" src="../images/down.gif" /> <a href="#policyvalidationurl">PolicyValidationURL</a></li>
80 <li><img alt="" src="../images/down.gif" /> <a href="#policyvary">PolicyVary</a></li>
81 <li><img alt="" src="../images/down.gif" /> <a href="#policyvaryurl">PolicyVaryURL</a></li>
82 <li><img alt="" src="../images/down.gif" /> <a href="#policyversion">PolicyVersion</a></li>
83 <li><img alt="" src="../images/down.gif" /> <a href="#policyversionurl">PolicyVersionURL</a></li>
84 </ul>
85 <h3>Bugfix checklist</h3><ul class="seealso"><li><a href="https://www.apache.org/dist/httpd/CHANGES_2.4">httpd changelog</a></li><li><a href="https://bz.apache.org/bugzilla/buglist.cgi?bug_status=__open__&amp;list_id=144532&amp;product=Apache%20httpd-2&amp;query_format=specific&amp;order=changeddate%20DESC%2Cpriority%2Cbug_severity&amp;component=mod_policy">Known issues</a></li><li><a href="https://bz.apache.org/bugzilla/enter_bug.cgi?product=Apache%20httpd-2&amp;component=mod_policy">Report a bug</a></li></ul><h3>See also</h3>
86 <ul class="seealso">
87 <li><a href="../filter.html">Filters</a></li>
88 <li><a href="../compliance.html">HTTP Protocol Compliance</a></li>
89 <li><a href="#comments_section">Comments</a></li></ul></div>
90 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
91 <div class="section">
92 <h2><a name="actions" id="actions">Actions</a></h2>
93     
94
95     <p>If a policy is violated, one of the following actions can be
96     taken:</p>
97
98     <dl>
99     <dt><strong>ignore</strong></dt>
100     <dd>The policy check will be ignored for the given URL space, even
101     if the filter is present.</dd>
102
103     <dt><strong>log</strong></dt>
104     <dd>The policy check will be executed, and if a violation is detected
105     a warning will be logged to the server error_log, and a
106     <code>Warning</code> header added to the response for the benefit of
107     the client.</dd>
108
109     <dt><strong>enforce</strong></dt>
110     <dd>The policy check will be executed, and if a violation is detected
111     an error will be logged to the server error_log, a
112     <code>Warning</code> header added to the response, and a <code>502
113     Bad Gateway</code> will be returned to the client. Optional links to
114     explanatory documentation can be added to each error message,
115     detailing the origin of each policy.</dd>
116
117     </dl>
118
119     <p>It is also possible to selectively disable all policies for a
120     given URL space, should the need arise, using the
121     <code class="directive"><a href="#policyfilter">PolicyFilter</a></code> directive.</p>
122
123     <p>Alternatively, the
124     <code class="directive"><a href="#policyenvironment">PolicyEnvironment</a></code>
125     directive can be used to specify an environment variable, which if
126     present, will cause the policies to be selectively downgraded or
127     bypassed.</p>
128
129 </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
130 <div class="section">
131 <h2><a name="tests" id="tests">Policy Tests</a></h2>
132     
133
134     <p>The following policy filters are available:</p>
135
136     <dl>
137     <dt><strong><a href="../compliance.html#policytype">POLICY_TYPE</a>
138     </strong>: Enforce valid content types</dt>
139     <dd>Content types that are syntactically invalid or blank can be detected
140         and the request rejected. Types can be restricted to a specific list
141         containing optional wildcards ? and *.</dd>
142
143     <dt><strong><a href="../compliance.html#policylength">POLICY_LENGTH</a>
144     </strong>: Enforce the presence of a Content-Length</dt>
145     <dd>The length of responses can be specified in one of three ways, by
146     specifying an explicit length in advance, using chunked encoding to set
147     the length, or by setting no length at all and terminating the request
148     when complete. The absence of a specific content length can affect the
149     cacheability of the response, and prevents the use of keepalive during
150     HTTP/1.0 requests. This policy enforces the presence of an explicit
151     content length on the response.</dd>
152
153     <dt><strong><a href="../compliance.html#policykeepalive">POLICY_KEEPALIVE
154     </a></strong>: Enforce the option to keepalive</dt>
155     <dd>Less restrictive than the POLICY_LENGTH test, this policy enforces the
156     possibility that the response can be kept alive. If the response doesn't
157     have a protocol defined zero length, and the response isn't already an
158     error, and the response has neither a Content-Length or is declared
159     HTTP/1.1 and lacks Content-Encoding: chunked, then this response will be
160     rejected.</dd>
161
162     <dt><strong><a href="../compliance.html#policyvary">POLICY_VARY</a>
163     </strong>: Enforce the absence of certain headers within Vary headers</dt>
164     <dd>If the Vary header contains any of the headers specified, this policy
165     will reject the request. The typical case is the presence of the User-Agent
166     within Vary, which is likely to cause a denial of service condition to a
167     cache.</dd>
168
169     <dt><strong><a href="../compliance.html#policyvalidation">
170     POLICY_VALIDATION</a></strong>: Enforce the presence of Etag and/or
171     Last-Modified</dt>
172     <dd>The ability for a cache to determine whether a cached entity can be
173     refreshed is dependent on whether a valid Etag and/or Last-Modified header
174     is present to revalidate against. The absence of both headers, or the
175     invalid syntax of a header will cause this policy to be rejected.</dd>
176
177     <dt><strong><a href="../compliance.html#policyconditional">
178     POLICY_CONDITIONAL</a></strong>: Enforce correct operation of conditional
179     requests</dt>
180     <dd>When conditional headers are present in the request, a server should
181     respond with a <code>304 Not Modified</code> or <code>412 Precondition
182     Failed</code> response where appropriate. A server may ignore conditional
183     headers, and this affects the efficiency of the HTTP caching mechanism.
184     This policy rejects requests where a conditional header is present, and
185     a 304 or 412 response code was expected, but a 2xx response was seen
186     instead.</dd>
187
188     <dt><strong><a href="../compliance.html#policynocache">POLICY_NOCACHE</a>
189     </strong>: Enforce cacheable responses</dt>
190     <dd>When a response is encountered that declares itself explicitly
191     uncacheable, the request is rejected. A response is considered
192     uncacheable if it specifies any of the following:
193     <ul><li><code>Cache-Control: no-cache</code></li>
194     <li><code>Pragma: no-cache</code></li>
195     <li><code>Cache-Control: no-store</code></li>
196     <li><code>Cache-Control: private</code></li>
197     </ul></dd>
198
199     <dt><strong><a href="../compliance.html#policymaxage">POLICY_MAXAGE</a>
200     </strong>: Enforce a minimum maxage</dt>
201     <dd>When a response is encountered where the freshness lifetime is less
202     than the given value, or the freshness lifetime is heuristic, the request
203     is rejected. A response is checked in the following order:
204     <ul><li>If <code>s-maxage</code> is present but too small; or</li>
205     <li>If <code>max-age</code> is present but too small; or</li>
206     <li>If <code>Expires</code> is present and invalid; or</li>
207     <li><code>Date</code> is present and invalid; or</li>
208     <li><code>Expires</code> minus Date is too small; or</li>
209     <li>No <code>s-maxage</code>, <code>maxage</code>, or
210     <code>Expires</code>/<code>Date</code> declared at all</li>
211     </ul></dd>
212
213     <dt><strong><a href="../compliance.html#policyversion">POLICY_VERSION</a>
214     </strong>: Enforce a minimum HTTP version within a request</dt>
215     <dd>When a request is encountered with an HTTP version number less than
216     the required minimum version, the request is rejected. The following
217     version numbers are recognised:
218     <ul><li><code>HTTP/1.1</code></li>
219     <li><code>HTTP/1.0</code></li>
220     <li><code>HTTP/0.9</code></li>
221     </ul></dd>
222
223     </dl>
224
225 </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
226 <div class="section">
227 <h2><a name="example" id="example">Example Configuration</a></h2>
228     
229
230     <p>A typical configuration protecting a server serving static content
231     might be as follows:</p>
232
233     <pre class="prettyprint lang-config">&lt;Location "/"&gt;
234   SetOutputFilter POLICY_TYPE;POLICY_LENGTH;POLICY_KEEPALIVE;POLICY_VARY;POLICY_VALIDATION; \
235     POLICY_CONDITIONAL;POLICY_NOCACHE;POLICY_MAXAGE;POLICY_VERSION
236
237   # content type must be present and valid, but can be anything
238   PolicyType enforce */*
239
240   # reject if no explicitly declared content length
241   PolicyLength enforce
242
243   # covered by the policy length filter
244   PolicyKeepalive ignore
245
246   # reject if User-Agent appears within Vary headers
247   PolicyVary enforce User-Agent
248
249   # we want to enforce validation
250   PolicyValidation enforce
251
252   # non-functional conditional responses should be rejected
253   PolicyConditional enforce
254
255   # no-cache responses should be rejected
256   PolicyNocache enforce
257
258   # maxage must be at least a day
259   PolicyMaxage enforce 86400
260
261   # request version can be anything
262   PolicyVersion ignore HTTP/1.1
263 &lt;/Location&gt;
264
265 # suppress policy protection for server-status
266 &lt;Location "/server-status"&gt;
267   PolicyFilter off
268 &lt;/Location&gt;</pre>
269
270
271 </div>
272 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
273 <div class="directive-section"><h2><a name="PolicyConditional" id="PolicyConditional">PolicyConditional</a> <a name="policyconditional" id="policyconditional">Directive</a></h2>
274 <table class="directive">
275 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Enable the conditional request policy.</td></tr>
276 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>PolicyConditional <var>ignore|log|enforce</var></code></td></tr>
277 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>ignore</code></td></tr>
278 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host, directory</td></tr>
279 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
280 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_policy</td></tr>
281 <tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>PolicyConditional is only available in Apache 2.5.0 and
282 later.</td></tr>
283 </table>
284     <p>When logged or enforced, a response that should have been conditional
285     but wasn't will be rejected.</p>
286
287     <div class="example"><h3>Example</h3><pre class="prettyprint lang-config"># non-functional conditional responses should be rejected
288 PolicyConditional enforce</pre>
289 </div>
290
291 </div>
292 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
293 <div class="directive-section"><h2><a name="PolicyConditionalURL" id="PolicyConditionalURL">PolicyConditionalURL</a> <a name="policyconditionalurl" id="policyconditionalurl">Directive</a></h2>
294 <table class="directive">
295 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>URL describing the conditional request policy.</td></tr>
296 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>PolicyConditionalURL <var>url</var></code></td></tr>
297 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>none</code></td></tr>
298 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host, directory</td></tr>
299 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
300 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_policy</td></tr>
301 <tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>PolicyConditionalURL is only available in Apache 2.5.0 and
302 later.</td></tr>
303 </table>
304     <p>Specify the URL of the documentation describing the conditional
305     request policy, to appear within error messages.</p>
306
307 </div>
308 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
309 <div class="directive-section"><h2><a name="PolicyEnvironment" id="PolicyEnvironment">PolicyEnvironment</a> <a name="policyenvironment" id="policyenvironment">Directive</a></h2>
310 <table class="directive">
311 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Override policies based on an environment variable.</td></tr>
312 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>PolicyEnvironment <var>variable</var> <var>log-value</var> <var>ignore-value</var></code></td></tr>
313 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>none</code></td></tr>
314 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host, directory</td></tr>
315 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
316 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_policy</td></tr>
317 <tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>PolicyEnvironment is only available in Apache 2.5.0 and
318 later.</td></tr>
319 </table>
320     <p>Downgrade policies to logging only or ignored based on the presence
321     of an environment variable. If the given variable is present and equal
322     to the log-value, enforced policies will be logged instead. If the given
323     variable is present and equal to the ignore-value, all policies will
324     be ignored.</p>
325
326     <div class="example"><h3>Example</h3><pre class="prettyprint lang-config"># downgrade if POLICY_CONTROL was present
327 PolicyEnvironment POLICY_CONTROL log ignore</pre>
328 </div>
329
330 </div>
331 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
332 <div class="directive-section"><h2><a name="PolicyFilter" id="PolicyFilter">PolicyFilter</a> <a name="policyfilter" id="policyfilter">Directive</a></h2>
333 <table class="directive">
334 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Enable or disable policies for the given URL space.</td></tr>
335 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>PolicyFilter <var>on|off</var></code></td></tr>
336 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>on</code></td></tr>
337 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host, directory</td></tr>
338 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
339 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_policy</td></tr>
340 <tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>PolicyFilter is only available in Apache 2.5.0 and
341 later.</td></tr>
342 </table>
343     <p>Master switch to enable or disable policies for a given URL space.</p>
344
345     <div class="example"><h3>Example</h3><pre class="prettyprint lang-config"># enabled by default
346 &lt;Location "/"&gt;
347   PolicyFilter on
348 &lt;/Location&gt;
349
350 # suppress policy protection for server-status
351 &lt;Location "/server-status"&gt;
352   PolicyFilter off
353 &lt;/Location&gt;</pre>
354 </div>
355
356 </div>
357 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
358 <div class="directive-section"><h2><a name="PolicyKeepalive" id="PolicyKeepalive">PolicyKeepalive</a> <a name="policykeepalive" id="policykeepalive">Directive</a></h2>
359 <table class="directive">
360 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Enable the keepalive policy.</td></tr>
361 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>PolicyKeepalive <var>ignore|log|enforce</var></code></td></tr>
362 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>ignore</code></td></tr>
363 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host, directory</td></tr>
364 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
365 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_policy</td></tr>
366 <tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>PolicyKeepalive is only available in Apache 2.5.0 and
367 later.</td></tr>
368 </table>
369     <p>When logged or enforced, a response that lacks both an explicit
370     <code>Content-Length</code> header and a <code>Transfer-Encoding</code>
371     of <code>chunked</code> will be rejected.</p>
372
373     <div class="example"><h3>Example</h3><pre class="prettyprint lang-config"># missing Content-Length or Transfer-Encoding should be rejected
374 PolicyKeepalive enforce</pre>
375 </div>
376
377 </div>
378 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
379 <div class="directive-section"><h2><a name="PolicyKeepaliveURL" id="PolicyKeepaliveURL">PolicyKeepaliveURL</a> <a name="policykeepaliveurl" id="policykeepaliveurl">Directive</a></h2>
380 <table class="directive">
381 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>URL describing the keepalive policy.</td></tr>
382 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>PolicyKeepaliveURL <var>url</var></code></td></tr>
383 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>none</code></td></tr>
384 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host, directory</td></tr>
385 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
386 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_policy</td></tr>
387 <tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>PolicyKeepaliveURL is only available in Apache 2.5.0 and
388 later.</td></tr>
389 </table>
390     <p>Specify the URL of the documentation describing the keepalive
391     policy, to appear within error messages.</p>
392
393 </div>
394 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
395 <div class="directive-section"><h2><a name="PolicyLength" id="PolicyLength">PolicyLength</a> <a name="policylength" id="policylength">Directive</a></h2>
396 <table class="directive">
397 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Enable the content length policy.</td></tr>
398 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>PolicyLength <var>ignore|log|enforce</var></code></td></tr>
399 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>ignore</code></td></tr>
400 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host, directory</td></tr>
401 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
402 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_policy</td></tr>
403 <tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>PolicyLength is only available in Apache 2.5.0 and
404 later.</td></tr>
405 </table>
406     <p>When logged or enforced, a response that lacks an explicit
407     <code>Content-Length</code> header will be rejected.</p>
408
409     <div class="example"><h3>Example</h3><pre class="prettyprint lang-config"># missing Content-Length header should be rejected
410 PolicyLength enforce</pre>
411 </div>
412
413 </div>
414 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
415 <div class="directive-section"><h2><a name="PolicyLengthURL" id="PolicyLengthURL">PolicyLengthURL</a> <a name="policylengthurl" id="policylengthurl">Directive</a></h2>
416 <table class="directive">
417 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>URL describing the content length policy.</td></tr>
418 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>PolicyLengthURL <var>url</var></code></td></tr>
419 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>none</code></td></tr>
420 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host, directory</td></tr>
421 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
422 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_policy</td></tr>
423 <tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>PolicyLengthURL is only available in Apache 2.5.0 and
424 later.</td></tr>
425 </table>
426     <p>Specify the URL of the documentation describing the content length
427     policy, to appear within error messages.</p>
428
429 </div>
430 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
431 <div class="directive-section"><h2><a name="PolicyMaxage" id="PolicyMaxage">PolicyMaxage</a> <a name="policymaxage" id="policymaxage">Directive</a></h2>
432 <table class="directive">
433 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Enable the caching minimum max-age policy.</td></tr>
434 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>PolicyMaxage <var>ignore|log|enforce</var> <var>age</var></code></td></tr>
435 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>ignore</code></td></tr>
436 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host, directory</td></tr>
437 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
438 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_policy</td></tr>
439 <tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>PolicyMaxage is only available in Apache 2.5.0 and
440 later.</td></tr>
441 </table>
442     <p>When logged or enforced, a response that lacks an explicit freshness
443     lifetime defined with <code>max-age</code>, <code>s-maxage</code> or an
444     <code>Expires</code> header, or where the explicit freshness lifetime is
445     smaller than the given value, will be rejected.</p>
446
447     <div class="example"><h3>Example</h3><pre class="prettyprint lang-config"># reject responses with a freshness lifetime shorter than a day
448 PolicyMaxage enforce 86400</pre>
449 </div>
450
451
452 </div>
453 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
454 <div class="directive-section"><h2><a name="PolicyMaxageURL" id="PolicyMaxageURL">PolicyMaxageURL</a> <a name="policymaxageurl" id="policymaxageurl">Directive</a></h2>
455 <table class="directive">
456 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>URL describing the caching minimum freshness lifetime policy.</td></tr>
457 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>PolicyMaxageURL <var>url</var></code></td></tr>
458 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>none</code></td></tr>
459 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host, directory</td></tr>
460 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
461 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_policy</td></tr>
462 <tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>PolicyMaxageURL is only available in Apache 2.5.0 and
463 later.</td></tr>
464 </table>
465     <p>Specify the URL of the documentation describing the caching minimum
466     freshness lifetime policy, to appear within error messages.</p>
467
468 </div>
469 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
470 <div class="directive-section"><h2><a name="PolicyNocache" id="PolicyNocache">PolicyNocache</a> <a name="policynocache" id="policynocache">Directive</a></h2>
471 <table class="directive">
472 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Enable the caching no-cache policy.</td></tr>
473 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>PolicyNocache <var>ignore|log|enforce</var></code></td></tr>
474 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>ignore</code></td></tr>
475 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host, directory</td></tr>
476 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
477 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_policy</td></tr>
478 <tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>PolicyNocache is only available in Apache 2.5.0 and
479 later.</td></tr>
480 </table>
481     <p>When logged or enforced, a response that defines itself uncacheable
482     using the <code>Cache-Control</code> or <code>Pragma</code> headers will
483     be rejected.</p>
484
485     <div class="example"><h3>Example</h3><pre class="prettyprint lang-config"># Cache-Control: no-cache will be rejected
486 PolicyNocache enforce</pre>
487 </div>
488
489
490 </div>
491 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
492 <div class="directive-section"><h2><a name="PolicyNocacheURL" id="PolicyNocacheURL">PolicyNocacheURL</a> <a name="policynocacheurl" id="policynocacheurl">Directive</a></h2>
493 <table class="directive">
494 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>URL describing the caching no-cache policy.</td></tr>
495 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>PolicyNocacheURL <var>url</var></code></td></tr>
496 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>none</code></td></tr>
497 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host, directory</td></tr>
498 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
499 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_policy</td></tr>
500 <tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>PolicyNocacheURL is only available in Apache 2.5.0 and
501 later.</td></tr>
502 </table>
503     <p>Specify the URL of the documentation describing the caching no-cache
504     policy, to appear within error messages.</p>
505
506 </div>
507 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
508 <div class="directive-section"><h2><a name="PolicyType" id="PolicyType">PolicyType</a> <a name="policytype" id="policytype">Directive</a></h2>
509 <table class="directive">
510 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Enable the content type policy.</td></tr>
511 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>PolicyType <var>ignore|log|enforce</var> <var>type</var> [ <var>type</var> [ ... ]]</code></td></tr>
512 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>ignore</code></td></tr>
513 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host, directory</td></tr>
514 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
515 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_policy</td></tr>
516 <tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>PolicyType is only available in Apache 2.5.0 and
517 later.</td></tr>
518 </table>
519     <p>When logged or enforced, a response that lacks a <code>Content-Type</code>
520     header, where the <code>Content-Type</code> header is malformed, or where the
521     header does not match the given pattern or patterns will be rejected.</p>
522
523     <div class="example"><h3>Example</h3><pre class="prettyprint lang-config"># enforce json or XML
524 PolicyType enforce application/json text/xml</pre>
525 </div>
526
527     <div class="example"><h3>Example</h3><pre class="prettyprint lang-config"># malformed content type should be rejected
528 PolicyType enforce */*</pre>
529 </div>
530
531
532 </div>
533 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
534 <div class="directive-section"><h2><a name="PolicyTypeURL" id="PolicyTypeURL">PolicyTypeURL</a> <a name="policytypeurl" id="policytypeurl">Directive</a></h2>
535 <table class="directive">
536 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>URL describing the content type policy.</td></tr>
537 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>PolicyTypeURL <var>url</var></code></td></tr>
538 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>none</code></td></tr>
539 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host, directory</td></tr>
540 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
541 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_policy</td></tr>
542 <tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>PolicyTypeURL is only available in Apache 2.5.0 and
543 later.</td></tr>
544 </table>
545     <p>Specify the URL of the documentation describing the content type
546     policy, to appear within error messages.</p>
547
548 </div>
549 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
550 <div class="directive-section"><h2><a name="PolicyValidation" id="PolicyValidation">PolicyValidation</a> <a name="policyvalidation" id="policyvalidation">Directive</a></h2>
551 <table class="directive">
552 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Enable the validation policy.</td></tr>
553 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>PolicyValidation <var>ignore|log|enforce</var></code></td></tr>
554 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>ignore</code></td></tr>
555 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host, directory</td></tr>
556 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
557 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_policy</td></tr>
558 <tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>PolicyValidation is only available in Apache 2.5.0 and
559 later.</td></tr>
560 </table>
561     <p>When logged or enforced, a response that lacks either a valid
562     <code>ETag</code> header or a <code>Last-Modified</code> header, or where
563     either header is syntactically incorrect, will be rejected.</p>
564
565     <div class="example"><h3>Example</h3><pre class="prettyprint lang-config"># no ETag or Last-Modified will be rejected
566 PolicyValidation enforce</pre>
567 </div>
568
569
570 </div>
571 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
572 <div class="directive-section"><h2><a name="PolicyValidationURL" id="PolicyValidationURL">PolicyValidationURL</a> <a name="policyvalidationurl" id="policyvalidationurl">Directive</a></h2>
573 <table class="directive">
574 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>URL describing the content type policy.</td></tr>
575 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>PolicyValidationURL <var>url</var></code></td></tr>
576 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>none</code></td></tr>
577 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host, directory</td></tr>
578 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
579 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_policy</td></tr>
580 <tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>PolicyValidationURL is only available in Apache 2.5.0 and
581 later.</td></tr>
582 </table>
583     <p>Specify the URL of the documentation describing the validation policy, to
584     appear within error messages.</p>
585
586 </div>
587 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
588 <div class="directive-section"><h2><a name="PolicyVary" id="PolicyVary">PolicyVary</a> <a name="policyvary" id="policyvary">Directive</a></h2>
589 <table class="directive">
590 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Enable the Vary policy.</td></tr>
591 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>PolicyVary <var>ignore|log|enforce</var> <var>header</var> [ <var>header</var> [ ... ]]</code></td></tr>
592 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>ignore</code></td></tr>
593 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host, directory</td></tr>
594 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
595 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_policy</td></tr>
596 <tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>PolicyVary is only available in Apache 2.5.0 and
597 later.</td></tr>
598 </table>
599     <p>When logged or enforced, a response that contains a <code>Vary</code>
600     header which in turn contains one of the headers listed, will be
601     rejected.</p>
602
603     <div class="example"><h3>Example</h3><pre class="prettyprint lang-config"># reject reponses with "User-Agent" listed in the Vary header
604 PolicyVary enforce User-Agent</pre>
605 </div>
606
607
608 </div>
609 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
610 <div class="directive-section"><h2><a name="PolicyVaryURL" id="PolicyVaryURL">PolicyVaryURL</a> <a name="policyvaryurl" id="policyvaryurl">Directive</a></h2>
611 <table class="directive">
612 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>URL describing the content type policy.</td></tr>
613 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>PolicyVaryURL <var>url</var></code></td></tr>
614 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>none</code></td></tr>
615 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host, directory</td></tr>
616 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
617 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_policy</td></tr>
618 <tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>PolicyVaryURL is only available in Apache 2.5.0 and
619 later.</td></tr>
620 </table>
621     <p>Specify the URL of the documentation describing the vary policy, to
622     appear within error messages.</p>
623
624 </div>
625 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
626 <div class="directive-section"><h2><a name="PolicyVersion" id="PolicyVersion">PolicyVersion</a> <a name="policyversion" id="policyversion">Directive</a></h2>
627 <table class="directive">
628 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Enable the version policy.</td></tr>
629 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>PolicyVersion <var>ignore|log|enforce</var> <var>HTTP/0.9|HTTP/1.0|HTTP/1.1</var></code></td></tr>
630 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>ignore</code></td></tr>
631 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host, directory</td></tr>
632 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
633 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_policy</td></tr>
634 <tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>PolicyVersion is only available in Apache 2.5.0 and
635 later.</td></tr>
636 </table>
637     <p>When logged or enforced, a request with a version lower than specified
638     will be rejected.</p>
639
640     <div class="example"><h3>Example</h3><pre class="prettyprint lang-config"># reject requests with an HTTP version older than HTTP/1.1
641 PolicyVersion enforce HTTP/1.1</pre>
642 </div>
643
644
645 </div>
646 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
647 <div class="directive-section"><h2><a name="PolicyVersionURL" id="PolicyVersionURL">PolicyVersionURL</a> <a name="policyversionurl" id="policyversionurl">Directive</a></h2>
648 <table class="directive">
649 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>URL describing the minimum request HTTP version policy.</td></tr>
650 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>PolicyVersionURL <var>url</var></code></td></tr>
651 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>none</code></td></tr>
652 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host, directory</td></tr>
653 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
654 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_policy</td></tr>
655 <tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>PolicyVersionURL is only available in Apache 2.5.0 and
656 later.</td></tr>
657 </table>
658     <p>Specify the URL of the documentation describing the minimum request
659     HTTP version policy, to appear within error messages.</p>
660
661 </div>
662 </div>
663 <div class="bottomlang">
664 <p><span>Available Languages: </span><a href="../en/mod/mod_policy.html" title="English">&nbsp;en&nbsp;</a></p>
665 </div><div class="top"><a href="#page-header"><img src="../images/up.gif" alt="top" /></a></div><div class="section"><h2><a id="comments_section" name="comments_section">Comments</a></h2><div class="warning"><strong>Notice:</strong><br />This is not a Q&amp;A section. Comments placed here should be pointed towards suggestions on improving the documentation or server, and may be removed again by our moderators if they are either implemented or considered invalid/off-topic. Questions on how to manage the Apache HTTP Server should be directed at either our IRC channel, #httpd, on Freenode, or sent to our <a href="http://httpd.apache.org/lists.html">mailing lists</a>.</div>
666 <script type="text/javascript"><!--//--><![CDATA[//><!--
667 var comments_shortname = 'httpd';
668 var comments_identifier = 'http://httpd.apache.org/docs/trunk/mod/mod_policy.html';
669 (function(w, d) {
670     if (w.location.hostname.toLowerCase() == "httpd.apache.org") {
671         d.write('<div id="comments_thread"><\/div>');
672         var s = d.createElement('script');
673         s.type = 'text/javascript';
674         s.async = true;
675         s.src = 'https://comments.apache.org/show_comments.lua?site=' + comments_shortname + '&page=' + comments_identifier;
676         (d.getElementsByTagName('head')[0] || d.getElementsByTagName('body')[0]).appendChild(s);
677     }
678     else {
679         d.write('<div id="comments_thread">Comments are disabled for this page at the moment.<\/div>');
680     }
681 })(window, document);
682 //--><!]]></script></div><div id="footer">
683 <p class="apache">Copyright 2016 The Apache Software Foundation.<br />Licensed under the <a href="http://www.apache.org/licenses/LICENSE-2.0">Apache License, Version 2.0</a>.</p>
684 <p class="menu"><a href="../mod/">Modules</a> | <a href="../mod/quickreference.html">Directives</a> | <a href="http://wiki.apache.org/httpd/FAQ">FAQ</a> | <a href="../glossary.html">Glossary</a> | <a href="../sitemap.html">Sitemap</a></p></div><script type="text/javascript"><!--//--><![CDATA[//><!--
685 if (typeof(prettyPrint) !== 'undefined') {
686     prettyPrint();
687 }
688 //--><!]]></script>
689 </body></html>