We are about to deploy a web application to a web farm of quite a few web servers. During our testing we have found issues happening in one of the servers but not in others. Most of them because of misconfiguration in the web servers.
Identifying the server that is misbehaving turns out to be time consuming. I thought about adding an HTTP Header to the response with a server identifier. That way we can quickly see from the browser what server processed the request.
Say our web servers are named following the pattern:
- and so on
The response HTTP header for prodweb1 would be:
and for prodweb2:
Is there a security vulnerability in specifying in the response the server that processed the request? Could someone take advantage of this in some way for an attack?