I just received a blackbox pentesting report where the security company recommended to hide the version number from the page (be it returned to the user as a text or used as a cache-buster in the css/js/img urls, like
I gave it some thought and could not think of a good solution that would comply with their recommendation and keep those resources fresh and cached on the client's devices.
These days browsers and proxies do crazy things about caching resources (sometimes when they even should not have). So urls must be unique between releases.
But if they are - then really does not matter whether it's a version number in the url, or a file contents hash, or a random value. If it's stable it still allows to uniquely identify a version.
I can invent some dirty way (which I'm not sharing at the moment, but later when I see any feedbacks), but what industry is doing these days to comply with the similar recommendations?
UPD: as promised, here is a workaround that would "keep" caching and hide the version number:
instead of version component in the url use the hash derived as:
hash(version_str + year_str + week_number_str + secret_str). That way the value would naturally change every week and leak nothing.