{"maintainers":[{"name":"anonymous","email":"leolee@microsoft.com"},{"name":"anonymous","email":"vidorteg@microsoft.com"},{"name":"anonymous","email":"flynnolivia@microsoft.com"},{"name":"anonymous","email":"amolleda@gmail.com"},{"name":"anonymous","email":"antross@gmail.com"}],"keywords":["no-disallowed-headers","no-disallowed-headers-hint","webhint","webhint-hint","webhint-recommended"],"dist-tags":{"latest":"3.1.22"},"description":"hint that that checks if disallowed response headers are sent","readme":"# Disallowed HTTP headers (`no-disallowed-headers`)\n\n`no-disallowed-headers` warns against responding with certain HTTP\nheaders.\n\n## Why is this important?\n\nThere are certain HTTP headers that should not be sent:\n\n1) Headers that are often set by servers, frameworks, and server-side\n languages (e.g.: ASP.NET, PHP), that by default have values that\n contain information about the technology that set them: its name,\n version number, etc.\n\nSending these types of HTTP headers:\n\n* does not provide any value to the user experience\n* contributes to header bloat\n* exposes information to potential attackers about\n the technology stack being used\n\n2) Uncommon or esoteric headers that have limited support, require\n a lot of knowledge to use correctly, and can create more problems\n than they solve.\n\n One example here is the `Public-Key-Pins` header. It has [limited\n support and usage, it’s being deprecated (along with the related\n `Public-Key-Pins-Report-Only` header) and can easily create a lot\n of problems if not done correctly][hpkp deprecation].\n\n## What does the hint check?\n\nBy default, the hint checks if responses include one of the following\nHTTP headers:\n\n* `Expires`\n* `Host`\n* `P3P`\n* `Pragma`\n* `Public-Key-Pins`\n* `Public-Key-Pins-Report-Only`\n* `X-AspNet-Version`\n* `X-AspNetMvc-version`\n* `X-Frame-Options`\n* `X-Powered-By`\n* `X-Runtime`\n* `X-Version`\n\nor the `Server` header with a value that provides a lot of information\nand is not limited to the server name.\n\n### Examples that **trigger** the hint\n\n```text\nHTTP/... 200 OK\n\n...\nServer: Apache/2.2.27 (Unix) mod_ssl/2.2.27 OpenSSL/1.0.1e-fips mod_bwlimited/1.4\nX-Powered-By: PHP/5.3.28\n```\n\n```text\nHTTP/... 200 OK\n\n...\nPublic-Key-Pins-Report-Only:\n pin-sha256=\"MoScTAZWKaASuYWhhneDttWpY3oBAkE3h2+soZS7sWs=\";\n pin-sha256=\"C5HTzCzM3elUxkcjR2S5P4hhyBNf6lHkmjAHKhpGPWE=\";\n includeSubDomains;\n report-uri=\"https://www.example.com/hpkp-report\"\n```\n\n### Examples that **pass** the hint\n\n```text\nHTTP/... 200 OK\n\n...\nServer: apache\n```\n\n```text\nHTTP/... 200 OK\n\n...\n```\n\n## How to configure the server to pass this hint\n\nHow to configure Apache
\n\nIf the headers are sent, in most cases, to make Apache stop sending\nthem requires removing the configurations that tells Apache to add\nthem (e.g. for the `X-UA-Compatible` header, that would be mean\nremoving something such as `Header set X-UA-Compatible \"IE=edge\"`).\nHowever, if the headers are added from somewhere in the stack (e.g.:\nthe framework level, language level such as PHP, etc.), and that cannot\nbe changed, you can try to remove them at the `Apache` level, using\nthe following:\n\n```apache\n\n Header unset Expires\n Header unset Host\n Header unset P3P\n Header unset Pragma\n Header unset Public-Key-Pins\n Header unset Public-Key-Pins-Report-Only\n Header unset Via\n Header unset X-AspNet-Version\n Header unset X-AspNetMvc-version\n Header unset X-Frame-Options\n Header unset X-Powered-By\n Header unset X-Runtime\n Header unset X-Version\n\n```\n\nWhen it comes to the `Server` header, by default, [Apache does not\nallow removing it][apache issue 40026] (the only way to do that is\nby using an external module). However, Apache can be configured using\nthe [`ServerTokens` directive][servertokens] to provide less\ninformation thought the `Server` header.\n\nNote: The following snippet will only work in the main Apache\nconfiguration file, so don't try to include it in a `.htaccess` file!\n\n```apache\n# Prevent Apache from sending in the `Server` response header its\n# exact version number, the description of the generic OS-type or\n# information about its compiled-in modules.\n#\n# https://httpd.apache.org/docs/current/mod/core.html#servertokens\n\nServerTokens Prod\n```\n\nNote that:\n\n* The above snippets work with Apache `v2.2.0+`, but you need to have\n [`mod_headers`][mod_headers] [enabled][how to enable apache modules]\n for them to take effect.\n\n* If you have access to the [main Apache configuration file][main\n apache conf file] (usually called `httpd.conf`), you should add\n the logic in, for example, a [``][apache directory]\n section in that file. This is usually the recommended way as\n [using `.htaccess` files slows down][htaccess is slow] Apache!\n\n If you don't have access to the main configuration file (quite\n common with hosting services), add the first snippets in a\n `.htaccess` file in the root of the web site/app.\n\nHow to configure IIS
\n\nTo add or remove headers on IIS, you can use the\n[` element`][customheader] and `/`\ndepending on what you need.\n\nThe following snippet will remove the headers from all responses:\n\n```xml\n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n\n```\n\nTo remove the header `X-AspNetMvc-version`, open your `Global.asax`\nfile and add the following to your `Application_Start` event:\n\n```c#\nMvcHandler.DisableMvcResponseHeader = true;\n```\n\nRemoving the `Server` header is a bit more complicated and changes\ndepending on the version.\n\nIn IIS 10.0 you can remove it using the [`removeServerHeader` attribute\nof `requestFiltering`][request filtering]:\n\n```xml\n\n \n \n \n \n \n\n```\n\nFor previous versions of IIS (7.0-8.5) you can use the following:\n\n```xml\n\n \n \n \n \n \n \n \n \n \n \n\n```\n\nThe above snippet will use a [`URL rewrite`][url rewrite] rule to\nremove the `Server` header from any request that contains it.\n\n