search

NCIOCPL / glossary-api

API for Dictionary of Cancer Terms, Dictionary of Genetics Terms, and other Glossary documents.
0 stars 5 forks source link

Remove sensitive IIS headers #145

Open blairlearn opened 3 years ago

blairlearn commented 3 years ago

Issue description

IIS likes to "advertise" itself via the "Server" and "X-Powered-By" headers. This becomes a security concern, particularly when the "Server" header contains a version number.

ESTIMATE TBD

Steps to reproduce the issue

  1. Open the browser's developer tools to the network tab.
  2. Browse to a non-existent url in the API directory structure e.g. https://webapis.cancer.gov/glossary/v1/%2522ns%253D%2522netsparker%25280x0084D8%2529
  3. In the developer tools, click on the request

What's the expected result?

What's the actual result?

Additional details / screenshot

blairlearn commented 1 year ago

Dependent on upgrading to IIS 10/Windows Server 2019.