3.5.14 http_header

The http_header keyword is a content modifier that restricts the search to the extracted Header fields of a HTTP client request or a HTTP server response (per the configuration of HttpInspect #sub:http-inspect#4584>).

As this keyword is a modifier to the previous content keyword, there must be a content in the rule before http_header is specified.

The extracted Header fields may be NORMALIZED, per the configuration of HttpInspect (see #sub:http-inspect#4587>).

3.5.14.1 Format

verbatim626#

3.5.14.2 Examples

This rule constrains the search for the pattern ;SPMquot;EFG;SPMquot; to the extracted Header fields of a HTTP client request or a HTTP server response.

verbatim627#

rawhtml155#

The http_header modifier is not allowed to be used with the rawbytes modifier for the same content.

rawhtml156#