php / php/php-src

Add expose_php option with reduced precision

Open
#12,080 2 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Category: SAPI Feature
Dominant language
C
Stars
40.4k
Forks
8.1k
Avg merge
2d 13h
Merged PRs (30d)
96

Description

Description

As @krakjoe pointed out at https://github.com/php/php-src/pull/3335, the popular default configurations are decided by package managers and hosting providers, and the default already has expose_php enabled.

But, we also know that those same package managers and hosting providers feel their only option is to turn this off as a sort of security through obscurity. This in turn can deminish global statistics (e.g. W3 Techs).

Perhaps we could offer a middleground that would appeal to some of the package managers (e.g. Debian, Fedora), and major hosting providers to no longer turn it off completely. For example:

X-Powered-By: PHP/8.2.9

… could be reduced to:

X-Powered-By: PHP

One could instead consider preserving major or major+minor version. But, I think an option that controls simply whether the version is obscured is more likely to receive broad adoption, and keeps the API simpler to maintain and to consume (also crawlers interpreting and aggregating this information).

/cc @Slamdunk @petk

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by tracing the existing expose_php configuration and the response path that generates the X-Powered-By header. Compare the proposed reduced-precision behavior with the current enabled and disabled cases, then identify the relevant configuration and test entry points. Done means a supported option can retain the header while omitting its version.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
backend
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.