7 ms·
I gone through his previous blog post and found the changing Server: header field. Why have to waste time for rebuilding nginx from source for that? Why not jus
by A010 11y ago
I gone through his previous blog post and found the changing Server: header field. Why have to waste time for rebuilding nginx from source for that? Why not just insert 'server_tokens off' in your nginx.conf?
- nly 11y agoBecause it doesn't eliminate the Server header, "off" will return "Server: nginx". Just one of several "fuck you" features in nginx.
- A010 11y agoServer: header makes people gone mad?
- JoshTriplett 11y agoIt wastes space, and reveals unnecessary information about your server infrastructure.
- FooBarWidget 11y agoAs if turning it off helps. Nginx is so popular, attackers would just try Nginx-specific exploits right after trying Apache ones even if they don't know for sure whether you are running Nginx.
- Scott_Helme_ 11y agoSadly nly is right. The only other option to change this is the ngx_headers_more module, but that still requires a rebuild. I suppose that way you at least get a little more functionality for your troubles.
- nly 11y agoYou also need that module to do per URI/path/regex match headers properly, because add_header + location blocks are woefully insufficient thanks to the way they are processed. This is one reason I gave up on CSP under nginx.