A JS Foundation Project

Disallow certain HTTP headers

Disallow certain HTTP headers (@sonarwhal/rule-no-disallowed-headers)

no-disallowed-headers warns against responding with certain HTTP headers.

Why is this important?

There are certain HTTP headers that should not be sent:

  1. Headers that are often set by servers, frameworks, and server-side languages (e.g.: ASP.NET, PHP), that by default have values that contain information about the technology that set them: its name, version number, etc.

    Sending these types of HTTP headers does not provide any value to users, contributes to header bloat, and just gives more information to any potential attackers about the technology stack being used.

  2. Headers that have limited support, require a lot of knowledge to make them work correctly, and can easily create more problems then they solve.

    One example here is the Public-Key-Pins header. It has limited support and usage, it’s being deprecated (along with the related Public-Key-Pins-Report-Only header), and can easily create a lot of problems if not done correctly.

What does the rule check?

By default, the rule checks if responses include one of the following HTTP headers:

  • Public-Key-Pins
  • Public-Key-Pins-Report-Only
  • X-AspNet-Version
  • X-AspNetMvc-version
  • X-Powered-By
  • X-Runtime
  • X-Version

or the Server header with a value that provides a lot of information, and is not limited to the server name.

Examples that trigger the rule

HTTP/... 200 OK

Server: Apache/2.2.27 (Unix) mod_ssl/2.2.27 OpenSSL/1.0.1e-fips mod_bwlimited/1.4
X-Powered-By: PHP/5.3.28
HTTP/... 200 OK


Examples that pass the rule

HTTP/... 200 OK

Server: apache
HTTP/... 200 OK


How to configure the server to pass this rule

How to configure Apache

If the headers are sent, in most cases, to make Apache stop sending them requires just removing the configurations that tells Apache to add them (e.g. for the X-UA-Compatible header, that would be mean removing something such as Header set X-UA-Compatible "IE=edge"). However, if the headers are added from somewhere in the stack (e.g.: the framework level, language level such as PHP, etc.), and that cannot be changed, you can try to remove them at the Apache level, using the following:

<IfModule mod_headers.c>
Header unset Public-Key-Pins
Header unset Public-Key-Pins-Report-Only
Header unset X-AspNet-Version
Header unset X-AspNetMvc-version
Header unset X-Powered-By`
Header unset X-Runtime
Header unset X-Version

When it comes to the Server header, by default, Apache does not allow removing it (the only way to do that is by using an external module). However, Apache can be configured using the ServerTokens directive to provide less information thought the Server header.

Note: The following snippet will only work in the main Apache configuration file, so don’t try to include it in a .htaccess file!

# Prevent Apache from sending in the `Server` response header its
# exact version number, the description of the generic OS-type or
# information about its compiled-in modules.
# https://httpd.apache.org/docs/current/mod/core.html#servertokens

ServerTokens Prod

Note that:

  • The above snippets works with Apache v2.2.0+, but you need to have mod_headers enabled in order for them to take effect.

  • If you have access to the main Apache configuration file (usually called httpd.conf), you should add the logic in, for example, a <Directory> section in that file. This is usually the recommended way as using .htaccess files slows down Apache!

    If you don’t have access to the main configuration file (quite common with hosting services), just add the first snippets in a .htaccess file in the root of the web site/app.

How to configure IIS

To add or remove headers on IIS, you can use the <customHeader> element and <remove>/<add> depending on what you need.

The following snippet will remove the headers from all responses:

<remove name="Public-Key-Pins"/>
<remove name="Public-Key-Pins-Report-Only"/>
<remove name="X-Powered-By"/>
<remove name="X-Runtime"/>
<remove name="X-Version"/>
<!-- X-AspNet-Version, only needed if running an AspNet app -->
<httpRuntime enableVersionHeader="false" />

To remove the header X-AspNetMvc-version, open your Global.asax file and add the following to your Application_Start event:

MvcHandler.DisableMvcResponseHeader = true;

Removing the Server header is a bit more complicated and changes depending on the version.

In IIS 10.0 you can remove it using the [removeServerHeader attribute of requestFiltering][requestfiltering]:

<requestFiltering removeServerHeader ="true" />

For previous versions of IIS (7.0-8.5) you can use the following:

<outboundRules rewriteBeforeCache="true">
<rule name="Remove Server header">
<match serverVariable="RESPONSE_Server" pattern=".+" />
<action type="Rewrite" value="" />

The above snippet will use a URL rewrite rule to remove the Server header from any request that contains it.

Can the rule be configured?

Yes, you can use:

  • include to specify additional HTTP headers that should be disallowed
  • ignore to specify which of the disallowed HTTP headers should be ignored

E.g. The following rule configuration used in the .sonarwhalrc file will make the rule allow responses to be served with the Server HTTP header, but not with Custom-Header.

"connector": {...},
"formatters": [...],
"rules": {
"no-disallowed-headers": [ "warning", {
"ignore": ["Server"],
"include": ["Custom-Header"]