Replies: 2 comments
-
Attitudes toward server version disclosure are not unequivocal. Today it's easier to run a scanner for all possible vulnerabilities for all kinds of servers, versions and backends hiding behind proxies. To be clear, you are not hiding by hiding the version of nginx. |
Beta Was this translation helpful? Give feedback.
-
Thanks for converting it to a discussion.
I agree with you in this point, there is always a way to gather information. Completely hiding the server version, takes away a lot of important information though. I'm fully aware that there are other fingerprinting methods but the most common fingerprinting methods are somewhat defeated. Removing this information likely would make a lot of setups somewhat harder to check for vulnerabilities based on the version.
Without you mentioning it, I would not have it considered it to be so important. Thanks for pointing this out.
In my opinion, if you have multiple versions running, may it A/B-testing, load-balancing to an older infrastructure, etc. people should be experienced enough to be aware that some configurations need to be adapted. |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
-
Describe the feature you'd like to add to nginx
Make
off
the default value for the directiveserver_tokens
.Describe the problem this feature solves
Currently, the directive
server_tokens
defaults toon
. From a security perspective, this exposes an additional attack surface, as this emits the build version.By default the configuration should be as secure as possible. Using
off
as default value would help to make the default configuration more secure.Additional context
I'm fully aware that the server header in the open-source version also exposes the version. I would be useful to patch this behaviour at the same time.
If needed, I would provide the necessary patches to help bring this live as soon as possible
Beta Was this translation helpful? Give feedback.
All reactions