Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove serverHeader #591

Merged
merged 6 commits into from Aug 7, 2021
Merged

Remove serverHeader #591

merged 6 commits into from Aug 7, 2021

Conversation

thornjad
Copy link
Member

@thornjad thornjad commented Dec 20, 2019

The server header was being served all the time by http-server to identify itself. While not usually a big deal, this is unnecessary and potentially reveals security vulnerabilities. Taking a page from engineering, I ask, why do we even need it? This PR removes the server header.

Fixes #237

@thornjad thornjad added feature:http minor version non-breaking, non-trivial change labels Dec 20, 2019
@thornjad thornjad added this to the v0.13.0 milestone Dec 20, 2019
@thornjad thornjad changed the title Add no-server-headers option to hide ecstatic header Remove serverHeader Aug 5, 2021
@thornjad
Copy link
Member Author

thornjad commented Aug 5, 2021

Hey @zbynek you've been super active lately, what do you think of this PR?

Copy link
Contributor

@zbynek zbynek left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good. If I understand it correctly, the API still allows setting this via headers option in case someone needs it.

@thornjad
Copy link
Member Author

thornjad commented Aug 7, 2021

Yup, so I'm not so worried about the use case that requires this header

@thornjad thornjad merged commit 1f994c0 into master Aug 7, 2021
@thornjad thornjad deleted the no_server_headers branch August 9, 2021 12:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
minor version non-breaking, non-trivial change
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Server exposing headers from underlying ecstatic
2 participants