How to remove or hide Server and X-Version HTTP response headers?
We are running IceWarp 14.3.0.11 on Linux and during a security audit we noticed that the web server exposes version information in HTTP response headers:
$ curl -sI http://127.0.0.1/ | grep -iE "server|x-version" Server: IceWarp/14.3.0.11 X-Version: 14.3.0.11
We tried to hide the version by setting the c_webservice_customhttpincludetext parameter:
$ /opt/icewarp/tool.sh set system c_webservice_customhttpincludetext "Web Server" Settings updated. $ curl -sI http://127.0.0.1/ | grep -iE "server|x-version" Server: IceWarp/14.3.0.11 Web Server X-Version: 14.3.0.11
As you can see, this only appends text to the Server header; it does not replace or remove the original IceWarp/14.3.0.11 part. Also, the X-Version header remains completely untouched.
We have searched the API documentation (tool.v4.11.help) and the webserver.dat configuration file, but we could not find any parameter to remove or replace these headers.
Could you please advise:
-
Is there a native IceWarp setting to completely remove or replace the
Serverheader? -
Is there a way to remove the
X-Versionheader entirely? -
If this is not possible in the current version, is it a known limitation or is there a plan to address it in a future release?
This is important for security hardening (information disclosure) and we would prefer a native solution without using a reverse proxy.
Thank you for your help.
Please sign in to leave a comment.
Comments
0 comments