Can't remove X-Powered-By header

[ghost]

Call $response->headers->remove('X-Powered-By') doesn't remove this header. Must fallback to header_remove('x-powered-by').

[ben29]

why not remove by apache/nginx config? it's better to do it...

Header unset "X-Powered-By"

[ghost]

why not remove by apache/nginx config? it's better to do it...

Hi, because I cannot apply any logic to it, and feel uncomfy setting it in such off-code place - if I can at all.

I can imagine this issue is very minor and not harmful (but don't have to be).
But why this function for seemingly simple task brings another case to the table:

1. removing header that PHP is able to remove
2. removing header that PHP is not able to remove
3. removing header that PHP is able to remove but Symfony doesn't handle that.

[ben29]

set it by .htaccess.

[Tobion]

Instead of removing the header afterwards, you should disable it being set at all: http://php.net/manual/en/ini.core.php#ini.expose-php

[stof]

$response->headers->remove('X-Powered-By') does not remove the header, because the header is not part of the response object, given that it is not set by the Symfony application but by PHP itself.

Making this method call the header_remove function directly would break the encapsulation of the Response in the component, which would cause more harm.
The valid solution for your problem is indeed to forbid PHP to add this header in the first place, as explained by @Tobion.

And if you don't have access to your change your php.ini (and your ops team does not accept to use a more secure config), you can call header_remove('x-powered-by') in your code to workaround the issue (in the waiting for changing to a host allowing you to have a secure config)

[ghost]

Thanks. Perhaps one would expect such great explanation in API documentation.