Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

chore: Turn off server signature #7

Merged
merged 2 commits into from
Jun 6, 2024
Merged

chore: Turn off server signature #7

merged 2 commits into from
Jun 6, 2024

Conversation

microamp
Copy link
Contributor

@microamp microamp commented Jun 6, 2024 •
edited
Loading

Fixes #5

Testing locally with the existing settings, accessing a resource that doesn't exist

curl -XGET http\://localhost\:80/hello.txt

returns 404 with the following content

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>404 Not Found</title>
</head><body>
<h1>Not Found</h1>
<p>The requested URL was not found on this server.</p>
<hr>
<address>Apache/2.4.52 (Ubuntu) Server at localhost Port 8080</address>
</body></html>

However, with ServerSignature Off explicitly set, it returns

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>404 Not Found</title>
</head><body>
<h1>Not Found</h1>
<p>The requested URL was not found on this server.</p>
</body></html>

without

<hr>
<address>Apache/2.4.52 (Ubuntu) Server at localhost Port 8080</address>

It appears to me that ServerSignature wasn't Off before, even though that is the default value according to https://httpd.apache.org/docs/current/mod/core.html#serversignature.

Default:  ServerSignature Off

If the issue persists after this change, we may need to configure custom error responses for 403, 404, etc. See also: https://httpd.apache.org/docs/current/custom-error.html

P.S. The second commit is only optional, as in our case, it's going to be server: cloudflare in the response header. It's a good practice nonetheless.

EDIT: Syntax highlight for HTML blocks.

@microamp microamp requested review from kesara and NGPixel June 6, 2024 11:00
kesara
kesara approved these changes Jun 6, 2024
View reviewed changes
Copy link
Member

@kesara kesara left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If we want to take an extra step forward we should have a custom 404 page. From the 404 template it is easy to guess that server is running Apache.

@microamp
Copy link
Contributor Author

microamp commented Jun 6, 2024

If we want to take an extra step forward we should have a custom 404 page. From the 404 template it is easy to guess that server is running Apache.

Thanks. We can do something very generic like

ErrorDocument 403 "Forbidden"
ErrorDocument 404 "Not Found"

@microamp microamp merged commit 49117af into main Jun 6, 2024
1 check passed
@microamp microamp deleted the chore/server-sig-off branch June 6, 2024 21:14
@microamp microamp mentioned this pull request Jun 6, 2024
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@kesara kesara kesara approved these changes

@rjsparks rjsparks rjsparks approved these changes

@NGPixel NGPixel Awaiting requested review from NGPixel

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Disable Apache server signature
3 participants
@microamp @kesara @rjsparks