refactor(meta) add meta._SERVER_TOKENS

kong/error_handlers.lua

@@ -1,3 +1,4 @@
+local meta = require "kong.meta"
 local singletons = require "kong.singletons"
 local constants = require "kong.constants"
 
@@ -31,7 +32,7 @@ local BODIES = {
   default = "The upstream server responded with %d"
 }
 
-local SERVER_HEADER = _KONG._NAME .. "/" .. _KONG._VERSION
+local SERVER_HEADER = meta._SERVER_TOKENS
 
 return function(ngx)
   local accept_header = ngx.req.get_headers()["accept"]

kong/meta.lua

@@ -14,7 +14,7 @@ return {
   _NAME = "kong",
   _VERSION = tostring(version),
   _VERSION_TABLE = version,
-
+  _SERVER_TOKENS = "kong/" .. tostring(version),
   -- third-party dependencies' required version, as they would be specified
   -- to lua-version's `set()` in the form {from, to}
   _DEPENDENCIES = {

kong/runloop/handler.lua

@@ -8,6 +8,7 @@
 -- In the `access_by_lua` phase, it is responsible for retrieving the route being proxied by
 -- a consumer. Then it is responsible for loading the plugins to execute on this request.
 local ck          = require "resty.cookie"
+local meta        = require "kong.meta"
 local utils       = require "kong.tools.utils"
 local Router      = require "kong.router"
 local ApiRouter   = require "kong.api_router"
@@ -43,7 +44,7 @@ local EMPTY_T = {}
 
 local router, router_version, router_err
 local api_router, api_router_version, api_router_err
-local server_header = _KONG._NAME .. "/" .. _KONG._VERSION
+local server_header = meta._SERVER_TOKENS
 
 
 local function get_now()

kong/tools/responses.lua

@@ -17,14 +17,14 @@
 --
 --    -- Raw send() helper:
 --    return responses.send(418, "This is a teapot")
-
+local singletons = require "kong.singletons"
+local constants = require "kong.constants"
 local cjson = require "cjson.safe"
 local meta = require "kong.meta"
 
 local type = type
 
---local server_header = _KONG._NAME .. "/" .. _KONG._VERSION
-local server_header = meta._NAME .. "/" .. meta._VERSION
+local server_header = meta._SERVER_TOKENS
 
 --- Define the most common HTTP status codes for sugar methods.
 -- Each of those status will generate a helper method (sugar)
@@ -123,7 +123,18 @@ local function send_response(status_code)
     end
 
     ngx.status = status_code
-    ngx.header["Server"] = server_header
+
+    if singletons and singletons.configuration then
+      if singletons.configuration.enabled_headers[constants.HEADERS.SERVER] then
+        ngx.header[constants.HEADERS.SERVER] = server_header
+
+      else
+        ngx.header[constants.HEADERS.SERVER] = nil
+      end
+
+    else
+      ngx.header[constants.HEADERS.SERVER] = server_header
+    end
 
     if headers then
       for k, v in pairs(headers) do

spec-old-api/02-integration/04-admin_api/01-kong_routes_spec.lua

@@ -37,7 +37,7 @@ describe("Admin API - Kong routes", function()
         path = "/"
       })
       assert.res_status(200, res)
-      assert.equal(string.format("%s/%s", meta._NAME, meta._VERSION), res.headers.server)
+      assert.equal(meta._SERVER_TOKENS, res.headers.server)
       assert.is_nil(res.headers.via) -- Via is only set for proxied requests
     end)
     it("returns 405 on invalid method", function()

spec-old-api/02-integration/05-proxy/12-server_tokens_spec.lua

@@ -1,8 +1,9 @@
+local meta = require "kong.meta"
 local helpers = require "spec.helpers"
 local constants = require "kong.constants"
 
 
-local default_server_header = _KONG._NAME .. "/" .. _KONG._VERSION
+local default_server_header = meta._SERVER_TOKENS
 
 
 local function start(config)

spec/01-unit/001-rockspec_meta_spec.lua

@@ -40,6 +40,14 @@ describe("rockspec/meta", function()
       -- suffix optional
     end)
 
+    it("has a _SERVER_TOKENS field", function()
+      assert.is_string(meta._SERVER_TOKENS)
+    end)
+
+    it("has a _SERVER_TOKENS field that equals to _NAME/_VERSION", function()
+      assert.equal(meta._NAME .. "/" .. meta._VERSION, meta._SERVER_TOKENS)
+    end)
+
     it("has a _DEPENDENCIES field", function()
       assert.is_table(meta._DEPENDENCIES)
       assert.is_table(meta._DEPENDENCIES.nginx)

spec/01-unit/009-responses_spec.lua

@@ -38,7 +38,7 @@ describe("Response helpers", function()
   it("sets the correct ngx values and call ngx.say and ngx.exit", function()
     responses.send_HTTP_OK("OK")
     assert.equal(ngx.status, responses.status_codes.HTTP_OK)
-    assert.equal(meta._NAME .. "/" .. meta._VERSION, ngx.header["Server"])
+    assert.equal(meta._SERVER_TOKENS, ngx.header["Server"])
     assert.equal("application/json; charset=utf-8", ngx.header["Content-Type"])
     assert.stub(ngx.say).was.called() -- set custom content
     assert.stub(ngx.exit).was.called() -- exit nginx (or continue to the next context if 200)
@@ -192,4 +192,33 @@ describe("Response helpers", function()
       assert.spy(s).was.called_with(ngx.ctx)
     end)
   end)
+
+  describe("server tokens", function()
+    it("are sent by default", function()
+      responses.send_HTTP_OK("OK")
+      assert.equal(ngx.status, responses.status_codes.HTTP_OK)
+      assert.equal(meta._SERVER_TOKENS, ngx.header["Server"])
+    end)
+    it("are sent when enabled", function()
+      local singletons = require "kong.singletons"
+      singletons.configuration = {
+        enabled_headers = {
+          ["server_tokens"] = true
+        },
+      },
+      responses.send_HTTP_OK("OK")
+      assert.equal(ngx.status, responses.status_codes.HTTP_OK)
+      assert.equal(meta._SERVER_TOKENS, ngx.header["Server"])
+    end)
+    it("are not sent when disabled", function()
+      local singletons = require "kong.singletons"
+      singletons.configuration = {
+        enabled_headers = {
+        },
+      },
+      responses.send_HTTP_OK("OK")
+      assert.equal(ngx.status, responses.status_codes.HTTP_OK)
+      assert.is_nil(ngx.header["Server"])
+    end)
+  end)
 end)

spec/02-integration/04-admin_api/01-kong_routes_spec.lua

@@ -48,7 +48,7 @@ describe("Admin API - Kong routes", function()
         path = "/"
       })
       assert.res_status(200, res)
-      assert.equal(string.format("%s/%s", meta._NAME, meta._VERSION), res.headers.server)
+      assert.equal(meta._SERVER_TOKENS, res.headers.server)
       assert.is_nil(res.headers.via) -- Via is only set for proxied requests
     end)
     it("returns 405 on invalid method", function()

spec/02-integration/05-proxy/13-server_tokens_spec.lua

@@ -1,9 +1,10 @@
+local meta = require "kong.meta"
 local helpers = require "spec.helpers"
 local constants = require "kong.constants"
 local cjson = require "cjson"
 
 
-local default_server_header = _KONG._NAME .. "/" .. _KONG._VERSION
+local default_server_header = meta._SERVER_TOKENS
 
 
 for _, strategy in helpers.each_strategy() do