You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Remove X-Powered-By: React/alpha or make optional #36
I'm in favor of this by passing an option array to the Server which passes a default headers array into the Response constructor. Any opinions on this @jsor@clue@cboden?
@clue tbh I agree with @andyfleming here, we're disclosing information we probably shouldn't from a security perspective. I know PHP, Nginx, Apache, Varnish etc etc all expose that but I won't consider that a good security practice. And while we're making breaking changes for 0.5.0 and 0.6.0 I wouldn't mind fixing this.
Most (if not all) of those have options to turn off the powered by header. It's a recommended best practice to not expose the service and version. It's to avoid revealing that a server is running an vulnerable (unpatched) version of a service.
Most (if not all) of those have options to turn off the powered by header.
So does this component?
I'm really not saying I disagree here, but what do you suggest? Can you file a PR that addresses the issue you're seeing? Thanks!
@WyriHaximus Sounds like a reasonable plan! I suppose we'll likely have to resolve this once #28 lands anyway, because creating the response object will likely be left up to the user anyway, so there's little chance for us to add any "default headers".
Activity
WyriHaximus commentedon Aug 14, 2015
I'm in favor of this by passing an option array to the
Serverwhich passes a default headers array into theResponseconstructor. Any opinions on this @jsor @clue @cboden?clue commentedon Aug 14, 2015
I agree that we should add an option to turn this off (though I'm not considering this to be security feature) 👍
jsor commentedon Aug 14, 2015
👍
clue commentedon Feb 10, 2017
I stumbled upon this while preparing a fix for #51.
You can actually omit sending the
X-Powered-Byheader by explicitly setting an empty header value like this:I believe this should answer this ticket, but I'll leave this open until I've filed my upcoming PR that adds some documentation for this 👍
andyfleming commentedon Feb 15, 2017
It's a form of information disclosure and should be off by default.
clue commentedon Feb 15, 2017
This is now documented behavior via #107, do you feel this needs further changes?
FWIW, PHP also exposes a similar header by default, unless configured otherwise: http://php.net/manual/en/ini.core.php#ini.expose-php
WyriHaximus commentedon Feb 15, 2017
@clue tbh I agree with @andyfleming here, we're disclosing information we probably shouldn't from a security perspective. I know PHP, Nginx, Apache, Varnish etc etc all expose that but I won't consider that a good security practice. And while we're making breaking changes for
0.5.0and0.6.0I wouldn't mind fixing this.andyfleming commentedon Feb 15, 2017
Most (if not all) of those have options to turn off the powered by header. It's a recommended best practice to not expose the service and version. It's to avoid revealing that a server is running an vulnerable (unpatched) version of a service.
clue commentedon Feb 15, 2017
So does this component?
I'm really not saying I disagree here, but what do you suggest? Can you file a PR that addresses the issue you're seeing? Thanks!
@WyriHaximus Sounds like a reasonable plan! I suppose we'll likely have to resolve this once #28 lands anyway, because creating the response object will likely be left up to the user anyway, so there's little chance for us to add any "default headers".
andyfleming commentedon Feb 15, 2017
I'm not seeing any issue, per se, just suggesting we be Secure by Default.
It's not a big deal at all. Just advocating for best practices.
WyriHaximus commentedon Feb 15, 2017
@clue agreed, all they have to do is return a response anyway after #28 landed. No need for us to provide that anymore 😄
ethernidee commentedon Dec 10, 2019
Unhandled exception may still result in error 500 + revealed X-Powered-By. It must be secure by default without crutches.
WyriHaximus commentedon Dec 11, 2019
@ethernidee I'm open for a PR that respects the
expose_phpini setting like we done at several other places