Server Leaks Information via 'X-Powered-By' HTTP Response Header Field(s)

The 'X-Powered-By' HTTP response header is a standard header that web servers include in their responses. It contains information about the technology or software that the server is running. This header can also reveal sensitive information about the server's configuration, which can be exploted attackers. In this guide, we will discuss how to fix this vulnerability in your web application.

‍

Step 1: Disable the 'X-Powered-By' header

The first step to fix this vulnerability is to disable the 'X-Powered-By' header. This can be done by modifying the server configuration. The exact steps for this will depend on the web server software that you are using.

Apache HTTP Server:

If you are using the Apache HTTP Server, you can disable the 'X-Powered-By' header by adding the following line to your server configuration file:

ServerTokens Prod

This configuration directive tells Apache to only include the minimum information in the 'Server' HTTP response header. This will remove the 'X-Powered-By' header from the response.

Nginx:

If you are using Nginx, you can disable the 'X-Powered-By' header by adding the following line to your server configuration file:

server_tokens off;

This configuration directive tells Nginx to not include the server software version information in the 'Server' HTTP response header. This will remove the 'X-Powered-By' header from the response.

‍

Step 2: Remove the 'X-Powered-By' header manually

If you are unable to disable the 'X-Powered-By' header through the server configuration, you can remove the header manually. This can be done by adding the following line to your web application code:

header_remove('X-Powered-By');

This line of code will remove the 'X-Powered-By' header from the HTTP response.

‍

Step 3: Test the changes

Once you have made the changes to your server configuration or web application code, you should test the changes to ensure that they have been applied correctly. You can use a web application vulnerability scanner to verify that the 'X-Powered-By' header is no longer being included in the HTTP response.

‍

Conclusion:

In this guide, we have discussed how to fix the vulnerability of 'Server Leaks Information via 'X-Powered-By' HTTP Response Header Field(s)'. We have covered two methods for disabling or removing the 'X-Powered-By' header: modifying the server configuration and removing the header manually in the web application code. It is important to ensure that these changes have been applied correctly by testing the web application. By following these steps, you can reduce the amount of sensitive information that is leaked through your web application.

‍