1

I run nikto on a server, let's say www.example.com and it says the following:

OSVDB-630: The web server may reveal its internal or real IP in the Location header via a request to / over HTTP/1.0. The value is "A.B.C.D".

I have nginx as a reverse proxy with ip "A.B.C.D" and behind a few web servers. Is really risky revealing the private address?

If so, how can I prevent that http client gets the nginx private IP address?

2

It is but information leaking. So on its own and at face value, don't worry about it*.

On its own it's not something that could be turned into an attack. It is, however, information that an attacker could use to leverage other vectors.

On the other hand, it's normally not at all difficult to mitigate, so best to pick up a few resources and start trying to omit this information;

(*) some auditors might disagree to this conclusion;

| improve this answer | |
  • How can I prevent that nginx reveals their private IP address? – sebelk May 7 at 17:59
  • Depends on where the IP leaks (which header) and what makes it happen. You usually have the option to remove the header (possibly easiest) if you don't need it, or to change its content (could be slightly trickier). I'm sure a quick search for "remove nginx forwarding header" will deliver. – Pedro May 8 at 8:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.