Pylons / waitress

Waitress - A WSGI server for Python 3
https://docs.pylonsproject.org/projects/waitress/en/latest/
Other
1.44k stars 164 forks source link

Via header cannot be removed if the application sets the Server header #416

Closed serkonda7 closed 1 year ago

serkonda7 commented 1 year ago

My app adds a custom Server header. However when serving with waitress, a Via header is added.

I have removed the default value of Server in the following line and do not want the Via header either.

serve(app, host='127.0.0.1', port=8000, ident="")

In the docs I haven't found such config option. How to remove Via?

kgaughan commented 1 year ago

You'd need to patch Waitress, I'm afraid. Here's the relevant piece of code: https://github.com/Pylons/waitress/blob/455f2a5fd38cafab95893ca170c7504e4239d985/src/waitress/task.py#L258 Changing the code to this would do the trick:

        if ident:
            if not server_header:
                response_headers.append(("Server", ident))
            else:
                response_headers.append(("Via", ident))

You could supply this change as a PR, if you think it's worth merging.

serkonda7 commented 1 year ago

Thank you for this extensive answer. I don't think this is worthwhile a PR tho.

mmerickel commented 1 year ago

Why not just set ident to something you’re comfortable with?

serkonda7 commented 1 year ago

Weird requirements doe not allow to set a static Value for the Server header

mmerickel commented 1 year ago

What is your proposal if a PR is not worthwhile? You can always overwrite the header in your reverse proxy (waitress should never be exposed directly to the public internet).

serkonda7 commented 1 year ago

Exactly your stated solution. Reverse Proxy stripping the Via header

mmerickel commented 1 year ago

Alright, I'll close this then but thank you for pointing out this issue. Will think about it if more use cases come up.