lura

lura copied to clipboard

Is your feature request related to a problem? Please describe. For security reason i would like to hide the x-krakend and x-krakend-completed headers from the responses, in order none knows that i use krakend and the version.

Describe the solution you'd like A boolean in the config hide_krakend_headers

Describe alternatives you've considered Maybe a plugin to remove these headers but i didn"t find. I tried with martian but did'nt figure out how to do it.

Additional context

+1

+1

I think you can add nginx as reverse proxy krakend.

I'd like to use this feature as well. It sounded easy enough to try to create a PR for this. After reviewing the code, it seems like the methods that set these headers only have easy access to the EndpointConfig whereas the suggested config flag would (I'm assuming) preferably reside in the ServiceConfig. It looks like there would be quite some forwarding necessary to get the flag to where it's needed. Therefore, I'd like to ask if you're interested in a PR at all and secondly what would be the preferred way from an architecture standpoint to bridge this gap and to make service-level configuration accessible.

+1

Is your feature request related to a problem? Please describe. For security reason i would like to hide the x-krakend and x-krakend-completed headers from the responses, in order none knows that i use krakend and the version.

Describe the solution you'd like A boolean in the config hide_krakend_headers

Describe alternatives you've considered Maybe a plugin to remove these headers but i didn"t find. I tried with martian but did'nt figure out how to do it.

Additional context

+1

Started using Krakend. Very easy to integrate. This is one of the features I am looking for.

If you're building the binary yourself, you can remove (basically rename) the KrakenD headers by overriding those values by passing in LDFLAGS in the build command.

go build \
  -ldflags="-X github.com/devopsfaith/krakend/core.KrakendVersion=1.0 \
  -X github.com/devopsfaith/krakend/core.KrakendHeaderName=X-API-Gateway \
  -X github.com/devopsfaith/krakend/transport/http/server.CompleteResponseHeaderName=X-API-Gateway-Completed" \
  -o krakend ./cmd/krakend-ce

But, the header X-Krakend would not be renamed because that is defined with a const. If it were var, it can be modified via the LDFLAGS. @kpacha can we change that to var to enable developers to rename the header during build?

+1

Wouldn't it make more sense to have the info in the Server response header? Eg: Server: kragend/version

+1

This headers is an advertising with low efficiency but great help for the hacker. +1 for replacing with Server: krakend

+1

+1

+1

This issue was marked as resolved a long time ago and now has been automatically locked as there has not been any recent activity after it. You can still open a new issue and reference this link.