Suppose I reconfigure my HTTP server to add the following HTTP header into every reply:
X-Hello: Hello!
or some other presumably funny text.
Can this have any negative effect on the server security?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this communitySuppose I reconfigure my HTTP server to add the following HTTP header into every reply:
X-Hello: Hello!
or some other presumably funny text.
Can this have any negative effect on the server security?
It depends what the header is.
Assuming it is a made-up, X-
-prefixed, custom header, with a static value, then @Polynomial's answer is correct - it has absolutely no effect.
If you build the header value based on something else - e.g. the user's password - then that obviously would be A Bad Thing™.
As long as you don't disclose info potentially valuable to a would be attacker you are fine. X-our-awesome-stack: Software vX.YZ, Anothersoft vX.YZ, we dont believe in input santiziation!
could disclose info that you might not want to advertise. X-Hello: What's up
type of headers are absolutely harmless.