Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Appearance settings
Discussion options

Describe the feature you'd like to add to nginx

Make off the default value for the directive server_tokens.

Describe the problem this feature solves

Currently, the directive server_tokens defaults to on. From a security perspective, this exposes an additional attack surface, as this emits the build version.

By default the configuration should be as secure as possible. Using off as default value would help to make the default configuration more secure.

Additional context

I'm fully aware that the server header in the open-source version also exposes the version. I would be useful to patch this behaviour at the same time.

If needed, I would provide the necessary patches to help bring this live as soon as possible

You must be logged in to vote

Replies: 2 comments

Comment options

Attitudes toward server version disclosure are not unequivocal. Today it's easier to run a scanner for all possible vulnerabilities for all kinds of servers, versions and backends hiding behind proxies. To be clear, you are not hiding by hiding the version of nginx.
On the other hand, the Server header allows public services to collect statistics about the products used on the Internet. This also allows you to track the version of your nginx if you have multiple copies running.
In addition, this directive can be changed to suit the needs. Therefore, I would say that this question is more relevant to the discussions instead of the issues.

You must be logged in to vote
0 replies
Comment options

Thanks for converting it to a discussion.

Today it's easier to run a scanner for all possible vulnerabilities for all kinds of servers, versions and backends hiding behind proxies. To be clear, you are not hiding by hiding the version of nginx.

I agree with you in this point, there is always a way to gather information. Completely hiding the server version, takes away a lot of important information though. I'm fully aware that there are other fingerprinting methods but the most common fingerprinting methods are somewhat defeated.

Removing this information likely would make a lot of setups somewhat harder to check for vulnerabilities based on the version.

On the other hand, the Server header allows public services to collect statistics about the products used on the Internet.

Without you mentioning it, I would not have it considered it to be so important. Thanks for pointing this out.

This also allows you to track the version of your nginx if you have multiple copies running.

In my opinion, if you have multiple versions running, may it A/B-testing, load-balancing to an older infrastructure, etc. people should be experienced enough to be aware that some configurations need to be adapted.

You must be logged in to vote
0 replies
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Category
💡
Ideas
Labels
2 participants
Converted from issue

This discussion was converted from issue #661 on May 01, 2025 12:10.

Morty Proxy This is a proxified and sanitized view of the page, visit original site.