CODEWITHSUNDEEP
envoyproxy
Brian Luong
Brian Luong

Reputation: 588

Remove "server" header from Envoy Proxy responses

I'm currently trying to configure an Envoy route to remove the server header placed there by Envoy.

I've tried using the response_headers_to_remove[1] field. It works for many fields (x-content-type-options, x-powered-by, etc), but not with server.

I'm using Envoy Proxy 1.7.0.

[1] https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/route/v3/route_components.proto#config-route-v3-route

Upvotes: 2

Views: 3063

Answers (2)

Brian Luong
Brian Luong

Reputation: 588

I found that this is possible.

The HTTPConnectionManager has a setting called ServerHeaderTransformation:

OVERWRITE
(DEFAULT) ⁣Overwrite any Server header with the contents of server_name.

APPEND_IF_ABSENT
⁣If no Server header is present, append Server server_name If a Server header is present, pass it through.

PASS_THROUGH
⁣Pass through the value of the server header, and do not append a header if none is present.

By changing this to PASS_THROUGH, Envoy won't add this header.

To address the scenario when the backend service adds this header, use the Route's response_headers_to_remove field.

Upvotes: 2

nak3
nak3

Reputation: 116

Envoy adds the server header by itself to the response, so it seem to be impossible by response_headers_to_remove. You can also refer to the envoy/issues/14421 which is the same question and one possible workaround was mentioned.

Upvotes: 0

Related Questions