Can all HTTP headers be changed at the code level?

Question

PHP

Dear Khabrovites!

A practical question arose - is it absolutely possible to change all HTTP 1.1 headers at the code level ( PHP: header ), or are there those that are only returned by the server? If so, which ones.

Thanks in advance for your answers!

PS Dear minus and draining karma, please indicate the reason for downvoting and draining :) Thank you! ;)

Answer 1

The answer is everything. Some can be overridden or added by PHP itself, some by the server (see settings).
In the request, those headers that came from the user are marked with the HTTP_ prefix in the $_SERVER array (they cannot be trusted, such as REMOTE_ADDR).

Answer 2

Depends on SAPI implementation, as a call to header() eventually results in a call to the SAPI function header_handler. In PHP itself, there is nothing special about filtering ( here , here and here ).
And no one prevents frontend'u before php to influence the headers. For example in nginx .

Answer 3

As far as I remember, all headers are under the programmer's control.