[BUG] Verbose server banner in API response

opensearch-project / OpenSearch

🔎 Open source distributed and RESTful search engine.

https://opensearch.org/docs/latest/opensearch/index/

Apache License 2.0

9.62k stars 1.76k forks source link

[BUG] Verbose server banner in API response #4807

Open sachinpkale opened 1 year ago

sachinpkale commented 1 year ago

Describe the bug Verbose server information should be removed from all HTTP responses. This can be performed by modifying the server's configuration files or through the use and configuration of a web application firewall.

Reference:

https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/01-Information_Gathering/02-Fingerprint_Web_Server

dblock commented 1 year ago

I think you want to rename this to "Add option to turn off version in server banner." However, a lot of clients depend on that :(

andrross commented 1 year ago

@sachinpkale Is this a feature request like what dB said above? Can you provide more clarity here?