Website broken due to incorrect double quote

laszlogo
(@laszlogo)

1 week, 5 days ago

Today a website from one of our customers broke down.
There appeared to be a misplaced quote in the .htaccess, the log error:

…/.htaccess: Header has too many arguments

When checking the file, I noticed this incorrect line, made by the W3TC plugin:

Header set Public-Key-Pins "pin-sha256="$pin"; pin-sha256="$pinbak"; max-age=31536000"

As you can see, there is a double quote before the pin-sha and a double quote missing after max-age=

We were running version 2.8.6 so not the latest. I checked the changelog and found no fixes mentioning this issue.

Viewing 4 replies - 1 through 4 (of 4 total)

Plugin Contributor Marko Vasiljevic
(@vmarko)

1 week, 3 days ago

Hello @laszlogo

Thank you for reaching out and I am happy to help!
Can you please sahre which setting are you usng for Public-Key-Pins in the W3 Total Cache?

Thanks!

Thread Starter laszlogo
(@laszlogo)

1 week, 3 days ago

Hello @vmarko, where can I find these settings?

Plugin Contributor Marko Vasiljevic
(@vmarko)

1 week, 1 day ago

Hello @laszlogo

Thank you for your feedback.
Well, this would be my question. Is the rule in the .htaccess file Header set Public-Key-Pins "pin-sha256="$pin"; pin-sha256="$pinbak"; max-age=31536000" Within the W3TC block?

Thanks!
Thread Starter laszlogo
(@laszlogo)

6 days, 1 hour ago
Hello @vmarko,

Now your question is clear, yes it was in de W3TC block, to be more specific in between the #BEGIN W3TC Browser Cache and #END W3TC Browser Cache tags, all the way at the end.
Here is the entire piece in between a IfModule check:
```
<IfModule mod_headers.c>
    Header always set Strict-Transport-Security "max-age=31536000"
    Header set X-XSS-Protection "1; mode=block"
    Header set X-Content-Type-Options "nosniff"
    Header set Public-Key-Pins "pin-sha256="$pin"; pin-sha256="$pinbak"; max-age=31536000"
    Header set Referrer-Policy "no-referrer-when-downgrade"
</IfModule>
```
We have a back-up service, where i noticed it was written differently, without breaking:
```
<IfModule mod_headers.c>
    Header always set Strict-Transport-Security "max-age=31536000"
    Header set X-XSS-Protection "1; mode=block"
    Header set X-Content-Type-Options "nosniff"
    Header set Public-Key-Pins "pin-sha256=\"\"; pin-sha256=\"\"; max-age=31536000"
    Header set Referrer-Policy "no-referrer-when-downgrade"
</IfModule>
```
Hope this clears the air and gives enough info to debug the situation and come with a solution/fix!
- This reply was modified 6 days ago by laszlogo.

Viewing 4 replies - 1 through 4 (of 4 total)

You must be logged in to reply to this topic.

Tags