Ask HN: Why do web servers still reveal their type and version in headers?

#1

Post by johnsanders » Fri, Oct 21, 2022, 10:25 AM UTC

Isn't that inviting bad actors to scour the web for servers with just the right vulnerability? What's to gain by revealing that?

Re: Ask HN: Why do web servers still reveal their type and version in headers?

#2

Post by sylware » Fri, Oct 21, 2022, 11:05 AM UTC

Some sites may provide a default noscript/basic (x)html web interface.

Re: Ask HN: Why do web servers still reveal their type and version in headers?

#3

Post by LinuxBender » Fri, Oct 21, 2022, 12:52 PM UTC

There is no need to reveal this today. Long ago most daemons would advertise what they were and their version in the event clients might need to negotiate around specific behaviors, quirks or bugs.

In NGinx one can get rid of this without recompiling by adding the "nginx-mod-http-headers-more" module and adding to nginx.conf:

    more_set_headers 'Server: IIS/4.0'; # or whatever

HAProxy and most load balancer daemons can filter out or replace the Server header. Apache requires a recompile to drop the Server header unless one puts HAProxy in front of it due to the order in how headers are processed. In HAProxy:

    http-response set-header Server Silly

or

    http-response del-header Server

After making changes one can scan their headers in SecurityHeaders [1] to see what has changed, or use curl:

    curl --head https://some.tld/

As to why they still display this? Showing off in crawler stats who is dominate on the internet.

[1] - https://securityheaders.com/

Re: Ask HN: Why do web servers still reveal their type and version in headers?

#4

Post by johnsanders » Sat, Oct 22, 2022, 1:31 AM UTC

LinuxBender wrote: post #3

There is no need to reveal this today. Long ago most daemons would advertise what they were and their version in the event clients might need to negotiate around specific behaviors, quirks or bugs. In NGinx one can get rid of this without recompiling by adding the "nginx-mod-http-headers-more" module and adding to nginx.conf: more_set_headers 'Server: IIS/4.0'; # or whatever HAProxy and most load balancer daemons can…

Showing off in crawler stats who is dominate on the internet.

Had not thought of that.

Re: Ask HN: Why do web servers still reveal their type and version in headers?

#5

Post by LinuxBender » Sat, Oct 22, 2022, 1:17 PM UTC

johnsanders wrote: post #4

LinuxBender wrote: post #3

There is no need to reveal this today. Long ago most daemons would advertise what they were and their version in the event clients might need to negotiate around specific behaviors, quirks or bugs. In NGinx one can get rid of this without recompiling by adding the "nginx-mod-http-headers-more" module and adding to nginx.conf: more_set_headers 'Server: IIS/4.0'; # or whatever HAProxy and most load balancer daemons can…

Showing off in crawler stats who is dominate on the internet. Had not thought of that.

Here is a survey [1] from October of 2022 or just the graph [2] as that page has some odd CSS menus for me that block half of the page. This page uses an additional source. [3]

[1] - https://news.netcraft.com/archives/category/web-server-surve...

[2] - https://news.netcraft.com/images/2022/10/wss-share.png

[3] - https://www.stackscale.com/blog/top-web-servers/

Re: Ask HN: Why do web servers still reveal their type and version in headers?

#6

Post by pdevr » Sun, Oct 23, 2022, 12:20 AM UTC

LinuxBender wrote: post #3

There is no need to reveal this today. Long ago most daemons would advertise what they were and their version in the event clients might need to negotiate around specific behaviors, quirks or bugs. In NGinx one can get rid of this without recompiling by adding the "nginx-mod-http-headers-more" module and adding to nginx.conf: more_set_headers 'Server: IIS/4.0'; # or whatever HAProxy and most load balancer daemons can…

If I recall correctly: If you have control over the Apache server, you can install mod_security and use ServerTokens to unset headers. No need to recompile.