Add expose_php option with reduced precision
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 40.4k
- Forks
- 8.1k
- Avg merge
- 2d 13h
- Merged PRs (30d)
- 96
Description
Description
As @krakjoe pointed out at https://github.com/php/php-src/pull/3335, the popular default configurations are decided by package managers and hosting providers, and the default already has expose_php enabled.
But, we also know that those same package managers and hosting providers feel their only option is to turn this off as a sort of security through obscurity. This in turn can deminish global statistics (e.g. W3 Techs).
Perhaps we could offer a middleground that would appeal to some of the package managers (e.g. Debian, Fedora), and major hosting providers to no longer turn it off completely. For example:
X-Powered-By: PHP/8.2.9
… could be reduced to:
X-Powered-By: PHP
One could instead consider preserving major or major+minor version. But, I think an option that controls simply whether the version is obscured is more likely to receive broad adoption, and keeps the API simpler to maintain and to consume (also crawlers interpreting and aggregating this information).
/cc @Slamdunk @petk
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing the existing expose_php configuration and the response path that generates the X-Powered-By header. Compare the proposed reduced-precision behavior with the current enabled and disabled cases, then identify the relevant configuration and test entry points. Done means a supported option can retain the header while omitting its version.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- backend
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100