Skip to content

Latest commit

 

History

History
59 lines (37 loc) · 2.49 KB

server.md

File metadata and controls

59 lines (37 loc) · 2.49 KB

Server Header

Purpose

The Server header provides information about the server software handling the request. By default, this header exposes the server's technology stack, which can increase the risk of targeted attacks. For enhanced security, it is recommended to obscure or remove this header to prevent unnecessary exposure of server details.

Best Practices

  • Set an empty value or custom string: It's generally advisable to set the Server header to an empty value ("") or use a non-informative value to avoid revealing specific details about the server software.
  • Avoid exposing server information: Avoid leaving the default server response, which may expose sensitive version information.

Configuration in secure.py

The Server class in secure.py allows you to easily control the Server header value, with the default value set to an empty string to enhance security.

Example Configuration

secure_headers = Secure(
    server=Server().set("")
)

Methods Available

  • set(value): Set a custom value for the Server header.
  • clear(): Clear any custom value and revert the header to its default secure value (an empty string).

Example Usage

To set up the Server header and hide the server information:

server_header = Server().set("")
print(server_header.header_name)   # Output: 'Server'
print(server_header.header_value)  # Output: ''

This can then be applied as part of your Secure headers configuration:

secure_headers = Secure(server=server_header)

Special Considerations for Frameworks

Some frameworks like Uvicorn automatically inject a Server header. If you're using Uvicorn and need to override or remove this header, refer to the framework integration guide for specific instructions on how to disable Uvicorn's default Server header.

Resources

Attribution

This library implements security recommendations from trusted sources: