[BUG] Verbose server banner in API response

opensearch-project / OpenSearch

🔎 Open source distributed and RESTful search engine.

https://opensearch.org/docs/latest/opensearch/index/

Apache License 2.0

9.86k stars 1.84k forks source link

[BUG] Verbose server banner in API response #4807

Open sachinpkale opened 2 years ago

sachinpkale commented 2 years ago

Describe the bug Verbose server information should be removed from all HTTP responses. This can be performed by modifying the server's configuration files or through the use and configuration of a web application firewall.

Reference:

https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/01-Information_Gathering/02-Fingerprint_Web_Server

dblock commented 2 years ago

I think you want to rename this to "Add option to turn off version in server banner." However, a lot of clients depend on that :(

andrross commented 2 years ago

@sachinpkale Is this a feature request like what dB said above? Can you provide more clarity here?