It was not until recently that I began to question the use for the
Server field in the HTTP Response-Header.
I did some research:
RFC 2616 states:
The Server response-header field contains information about the software used by the origin server to handle the request. The field can contain multiple product tokens (section 3.8) and comments identifying the server and any significant subproducts. The product tokens are listed in order of their significance for identifying the application.
Server = "Server" ":" 1*( product | comment )
Server: CERN/3.0 libwww/2.17
If the response is being forwarded through a proxy, the proxy application MUST NOT modify the Server response-header. Instead, it SHOULD include a Via field (as described in section 14.45).
Note: Revealing the specific software version of the server might allow the server machine to become more vulnerable to attacks against software that is known to contain security holes. Server implementors are encouraged to make this field a configurable
This, however, makes no mention of the purpose of this field. This seems like information disclosure to me. These server strings give away a lot of information that is great for anyone trying to fingerprint the server. Automated scanning tools would quickly identify unpatched or vulnerable servers. Having my web server present version information for itself and modules like OpenSSL seems like a bad idea.
- Is this field needed... for anything? If so, what?
- Is it already best practice / common place to disable or change this field on servers?
I would think that, from a security perspective, we would want to give the enemy (ie: Everyone) as little information as possible while still allowing business to continue. Here is an interesting write-up on information warfare.