Why is Apache sending a “X-Pad” header?

Apache sometimes sends an HTTP header “X-Pad: avoid browser bug” for reasons that aren’t entirely clear. There isn’t a lot of searchable information about this header, so my coworker Matt dug into the source code and found out what’s going on.
The header was added to deal with a bug Netscape versions 2 through 4.0b2. The bug was that Netscape would hang if a linefeed character was sent as the 256 or 257 byte. Apache checks to see if it’s about to hit the bug and, if so, sends this header to pad the output.
The fix is from April of 1997. If they had waited a few months to report it, they might have earned $1,000 with Netscape’s Bug Bounty.
Hopefully this blog post will make the X-Pad header show up in Google and save future people from wondering what it is.

Continue reading “Why is Apache sending a “X-Pad” header?”