Skip to content

Implement an option to customize or hide the "Server" http response header in the user-facing services #1942

Open
@achimnol

Description

@achimnol

Security policies in some organizations often require hiding the "Server" HTTP response headers for public-facing services.

We can implement this by adding an extra middleware to aiohttp application objects like below:

from aiohttp import web

async def server_header_middleware(app, handler):
    async def middleware(request):
        response = await handler(request)
        response.headers['Server'] = 'Custom Server Name'
        return response
    return middleware

app = web.Application(middlewares=[server_header_middleware])

web.run_app(app)

Let's add a local configuration option to configure a custom header value.Currently the default behavior is to say "Python/3.11 aiohttp/3.8.5" (for 23.09 release).

We need to cover:

  • manager
  • webserver
  • storage proxy
  • app proxy
  • control panel?

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    Projects

    No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions