how to hide the server name for APISIX on the response header

[michaelh1355]

hello !

I have already hide the APISIX version on my APISIX server. we need to hide the server name for APISIX on the response header too .please advise how to do this. thanks!

[tokers]

See https://github.com/apache/apisix/blob/master/conf/config-default.yaml#L45

[michaelh1355]

您好， enable_server_tokens: true # Whether the APISIX version number should be shown in Server header. 这个参数能关闭 版本号，但我还想隐藏APISIX标识，请问怎么修改？

…

------------------ 原始邮件 ------------------ 发件人: "apache/apisix" ***@***.***>; 发送时间: 2022年9月28日(星期三) 下午5:46 ***@***.***>; ***@***.******@***.***>; 主题: Re: [apache/apisix] how to hide the server name for APISIX on the response header (Discussion #8011) See https://github.com/apache/apisix/blob/master/conf/config-default.yaml#L45 — Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you authored the thread.Message ID: ***@***.***>

[tzssangglass]

Only by modifying the source code, ref:

apisix/apisix/init.lua

Line 641 in 61afafd

core.response.set_header("Server", ver_header)

[michaelh1355]

您好， 请问源代码修改APISIX标识，需要修改哪几个参数？谢谢！

…

------------------ 原始邮件 ------------------ 发件人: "apache/apisix" ***@***.***>; 发送时间: 2022年10月8日(星期六) 下午2:39 ***@***.***>; ***@***.******@***.***>; 主题: Re: [apache/apisix] how to hide the server name for APISIX on the response header (Discussion #8011) Only by modifying the source code, ref: https://github.com/apache/apisix/blob/61afafdd46fe40c03955b6cb058df3e6fad5db45/apisix/init.lua#L641 — Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you authored the thread.Message ID: ***@***.***>

[tzssangglass]

I've pointed you to the source code where to set the APISIX response header, you can just remove that line.

[tokers]

Why not just use the response-rewrite plugin to rewrite the Server header?

[michaelh1355]

您好， 您提供这个解决方案比重装编译apisix更加简单，我只想将响应头的Server: APISIX改成Server: APP或者删除 Server: APISIX标识，如何编写response-rewrite plugin 配置文件？ 我看了帮助文档（https://apisix.apache.org/zh/docs/apisix/plugins/response-rewrite），始终还是没看明白语法怎么编写。 感谢！

…

------------------ 原始邮件 ------------------ 发件人: "apache/apisix" ***@***.***>; 发送时间: 2022年10月8日(星期六) 晚上7:56 ***@***.***>; ***@***.******@***.***>; 主题: Re: [apache/apisix] how to hide the server name for APISIX on the response header (Discussion #8011) Why not just use the response-rewrite plugin to rewrite the Server header? — Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you authored the thread.Message ID: ***@***.***>

[tokers]

Then you need to learn from the getting-started and the core concepts, before you actually configure this plugin.

[michaelh1355]

APISIX标识可以隐藏了，感谢您的建议。

…

------------------ 原始邮件 ------------------ 发件人: "apache/apisix" ***@***.***>; 发送时间: 2022年10月9日(星期天) 上午9:52 ***@***.***>; ***@***.******@***.***>; 主题: Re: [apache/apisix] how to hide the server name for APISIX on the response header (Discussion #8011) Then you need to learn from the getting-started and the core concepts, before you actually configure this plugin. — Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you authored the thread.Message ID: ***@***.***>

[SilentEntity]

one can edit the value for Server header in response by using global_rules.

Below is the example for standalone mode yaml configuration:

global_rules:
      - id: 1
        plugins:
          response-rewrite:
            headers:
              set:
                Server: "we purple you"

If someone using the admin:

curl http://127.0.0.1:9180/apisix/admin/routes/1 \
-H 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1' -X PUT -d '
{
    "methods": ["GET"],
    "uri": "/test/index.html",
    "plugins": {
        "response-rewrite": {
            "body": "{\"code\":\"ok\",\"message\":\"new json body\"}",
            "headers": {
                "set": {
                    "Server": "we purple you"
                }
            },
            "vars":[
                [ "status","==",200 ]
            ]
        }
    },
    "upstream": {
        "type": "roundrobin",
        "nodes": {
            "127.0.0.1:80": 1
        }
    }
}'

[grlicky]

Just for a reference, the Server header can be removed completely using the headers.remove attribute of the response-rewrite plugin:

global_rules:
      - id: 1
        plugins:
          response-rewrite:
            headers:
              remove:
                - Server

[cbbntla]

apisix set response header Server at header_filter phase.

apisix/apisix/init.lua

Line 641 in 61afafd

core.response.set_header("Server", ver_header)

I tried to re-set Server header with serverless-post-function plugin, choose header_filter phase, and it works.

{
  "plugins": {
    "serverless-post-function": {
      "functions": [
        "return function() local core = require(\"apisix.core\"); core.response.set_header(\"Server\", \"foo bar\") end"
      ],
      "phase": "header_filter"
    }
  }
}