Read HTTP request headers in Classic ASP

Classic ASP exposes request metadata through the Request.ServerVariables collection. It includes server values plus selected HTTP request headers such as user agent, host, cookie and referrer information.

Do not treat client-supplied headers as trusted identity or authorization data. Many headers can be missing, modified by privacy features, or supplied by the client itself.

To get the http headers we will be using ServerVariables collection of Request object in ASP. To display the value of a particular header we have to use the header name like this .

<%= Request.ServerVariables("HTTP_USER_AGENT")%>

On this page — Show page sectionsHide page sections

The value is a user-agent string supplied with the request. The following output is a historical example; modern browsers send different user-agent values.

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.8) Gecko/20061025 Firefox/1.5.0.8

We can display all the header information in one go without calling one by one by using its name. Here we have to use ALL_RAW

<%= Request.ServerVariables("ALL_RAW")%>

If we need formatted output with the list of headers (name ) then we have to use ALL_HTTP

<%= Request.ServerVariables("ALL_HTTP")%>

We can display all the name value pairs for all the header information like this

Dim var 
For Each var in Request.ServerVariables 
 Response.Write "<B>" & var & "</B>:" 
 Response.Write  Request.ServerVariables(var) 
Response.Write "<br>"

Next

The loop displays the available server-variable names and values. The long outputs below are retained as historical samples from an older local IIS/browser environment; use your own server output when testing today.

ALL_HTTP :

HTTP_ACCEPT:*/* 
  
HTTP_ACCEPT_LANGUAGE:en-us 
  
HTTP_CONNECTION:Keep-Alive 
  
HTTP_HOST:127.0.0.1 
  
HTTP_REFERER:https://127.0.0.1/a/request/ 
  
HTTP_USER_AGENT:Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1;
 Trident/4.0; GTB6.6; InfoPath.2; .NET CLR 1.1.4322;
 .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) 
  
HTTP_COOKIE:__utmc=96992031; ASPSESSIONIDAQSACAQC=FHOPPKJCEMKILAHMPECCIAJJ;
 __utma=96992031.1294834349.1272246700.1286419100.1286425811.117;
 __utmz=96992031.1272246700.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmb=96992031 
  
HTTP_ACCEPT_ENCODING:gzip, deflate

ALL_RAW :

Accept: */* 
  
Accept-Language: en-us 
  
Connection: Keep-Alive 
  
Host: 127.0.0.1 
  
Referer: https://127.0.0.1/a/request/ 
  
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1;
 Trident/4.0; GTB6.6; InfoPath.2; .NET CLR 1.1.4322;
 .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) 
  
Cookie: __utmc=96992031; ASPSESSIONIDAQSACAQC=FHOPPKJCEMKILAHMPECCIAJJ;
 __utma=96992031.1294834349.1272246700.1286419100.1286425811.117;
 __utmz=96992031.1272246700.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmb=96992031 
  
Accept-Encoding: gzip, deflate

APPL_MD_PATH	/LM/W3SVC/1/ROOT
APPL_PHYSICAL_PATH	I:\FL\
AUTH_PASSWORD
AUTH_TYPE
AUTH_USER
CERT_COOKIE
CERT_FLAGS
CERT_ISSUER
CERT_KEYSIZE
CERT_SECRETKEYSIZE
CERT_SERIALNUMBER
CERT_SERVER_ISSUER
CERT_SERVER_SUBJECT
CERT_SUBJECT
CONTENT_LENGTH	0
CONTENT_TYPE
GATEWAY_INTERFACE	CGI/1.1
HTTPS	off
HTTPS_KEYSIZE
HTTPS_SECRETKEYSIZE
HTTPS_SERVER_ISSUER
HTTPS_SERVER_SUBJECT
INSTANCE_ID	1
INSTANCE_META_PATH	/LM/W3SVC/1
LOCAL_ADDR	127.0.0.1
LOGON_USER
PATH_INFO	/a/request/header.asp
PATH_TRANSLATED	I:\FL\a\ request\header.asp
QUERY_STRING
REMOTE_ADDR	127.0.0.1
REMOTE_HOST	127.0.0.1
REMOTE_USER
REQUEST_METHOD	GET
SCRIPT_NAME	/a/request/header.asp
SERVER_NAME	127.0.0.1
SERVER_PORT	80
SERVER_PORT_SECURE	0
SERVER_PROTOCOL	HTTP/1.1
SERVER_SOFTWARE	Microsoft-IIS/5.1
URL	/a/request/header.asp
HTTP_ACCEPT	/
HTTP_ACCEPT_LANGUAGE	en-us
HTTP_CONNECTION	Keep-Alive
HTTP_HOST	127.0.0.1
HTTP_REFERER	https://127.0.0.1/a/ request/
HTTP_ACCEPT_ENCODING	gzip, deflate

HTTP_USER_AGENT:

Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; 
Trident/4.0; GTB6.6; InfoPath.2; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152;
 .NET CLR 3.5.30729)

HTTP_COOKIE

__utmc=96992031;
 ASPSESSIONIDAQSACAQC=FHOPPKJCEMKILAHMPECCIAJJ; 
__utma=96992031.1294834349.1272246700.1286419100.1286425811.117;
 __utmz=96992031.1272246700.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);
 __utmb=96992031

Referrer IP address Cookies

Display a request header safely

Dim agent
agent = Request.ServerVariables("HTTP_USER_AGENT")
Response.Write Server.HTMLEncode(agent)

The user-agent string can be missing or controlled by the client. Encode it if you display it in an HTML page.

Request headers are not trustworthy identities

Browsers and intermediaries may omit or modify headers. Never authorize a request based only on User-Agent, Referer or a forwarded-IP header. Avoid displaying raw cookie/authorization header values in production.

ASP Home

Subhendu Mohapatra

Author & Instructor at plus2net

I write and maintain practical tutorials on Python, PHP, SQL, JavaScript, HTML, jQuery, and web development at plus2net. The tutorials focus on clear explanations, working examples, and code that readers can test and adapt while learning.

About the author Watch on YouTube

Connect:

Getting all the header data of browser by using Request object ServerVariable in ASP

Display a request header safely

Request headers are not trustworthy identities

Further Reading

Subhendu Mohapatra