I run nikto on a server, let's say www.example.com and it says the following:

OSVDB-630: The web server may reveal its internal or real IP in the Location header via a request to / over HTTP/1.0. The value is "A.B.C.D".

I have nginx as a reverse proxy with ip "A.B.C.D" and behind a few web servers. Is really risky revealing the private address?

If so, how can I prevent that http client gets the nginx private IP address?

1 Answer 1


It is but information leaking. So on its own and at face value, don't worry about it*.

On its own it's not something that could be turned into an attack. It is, however, information that an attacker could use to leverage other vectors.

On the other hand, it's normally not at all difficult to mitigate, so best to pick up a few resources and start trying to omit this information;

(*) some auditors might disagree to this conclusion;

  • How can I prevent that nginx reveals their private IP address?
    – sebelk
    May 7, 2020 at 17:59
  • Depends on where the IP leaks (which header) and what makes it happen. You usually have the option to remove the header (possibly easiest) if you don't need it, or to change its content (could be slightly trickier). I'm sure a quick search for "remove nginx forwarding header" will deliver.
    – Pedro
    May 8, 2020 at 8:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .