Implement an option to customize or hide the "Server" http response header in the user-facing services
- Dominant language
- Python
- Stars
- 670
- Forks
- 183
- Avg merge
- 17h 7m
- Merged PRs (30d)
- 358
Description
Security policies in some organizations often require hiding the "Server" HTTP response headers for public-facing services.
We can implement this by adding an extra middleware to aiohttp application objects like below:
```python
from aiohttp import web
async def server_header_middleware(app, handler):
async def middleware(request):
response = await handler(request)
response.headers['Server'] = 'Custom Server Name'
return response
return middleware
app = web.Application(middlewares=[server_header_middleware])
web.run_app(app)
```
Let's add a local configuration option to configure a custom header value.Currently the default behavior is to say "Python/3.11 aiohttp/3.8.5" (for 23.09 release).
We need to cover:
- [ ] manager
- [ ] webserver
- [ ] storage proxy
- [ ] app proxy
- [ ] control panel?
JIRA Issue: BA-138
Contributor guide
Assessment
This issue has not been assessed yet.