Disclose server header

Projects NGINX Gateway Fabric
,
1

My issue:

I need a way to disclose the response Server header, not just the version.

I know that with nginx plus I can use ‘server_tokens ““; ‘
But, at this stage, of evaluating a solution to replace ingress-nginx, I want to avoid:
1. subscriptions

  1. build a custom nginx image with e.g. headers-more module

How I encountered the problem:

Solutions I’ve tried:

server_tokens off;

Version of NGF and/or NGINX:

nginx gateway fabric v2.4.2

Deployment environment:

Kubernetes AWS EKS

Any help would be very much appreciated.

1 Like
2

If you want to avoid a subscription and do not want to build a custom NGINX image, using server_tokens off; is the best available option. This removes the version information from the Server header while still returning Server: nginx.

3

Thanks salonichf5 for the help.
I’m already using server_tokens off.
But I realy need to not have the Server header, or at least have it generic, e.g. Server: “webserver”.

4

Unfortunately custom strings are only supported for NGINX Plus users. Let me know if I can help you with anything else.

5

To follow up, server_tokens configurability may expand in NGINX OSS in the future, but as of today, Saloni is correct about custom strings being Plus only.

6

OK,
thank you both.

7

FYI, even with headers-more Nginx also sends an HTML file disclosing the server in use with errors, and redirects:

<html>
<head><title>301 Moved Permanently</title></head>
<body>
<center><h1>301 Moved Permanently</h1></center>
<hr><center>nginx</center>
</body>
</html>
8

Correct, correct.

And for that use case I’ve setup custom error pages.

9

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.