Forum Discussion
Mike_Singer_599
Nimbostratus
NimbostratusRemoving server header from http to https redirect
We have been asked to remove this by a client based on a pentest. I can find referernces to the noserver option in other posts but not the complete irule that incorrpates that w/ the redirected comma...
To clarify, the iRule portion of Nitass post above is just:
when HTTP_REQUEST {
HTTP::respond 302 noserver Location "https://[HTTP::host][HTTP::uri]"
}
And he's right on, as usual. The idea is that you are setting a very specific response rather than using the pre-formatted redirect. The other option would be to specifically remove the header in question somewhere later down the line, like HTTP_REQUEST_SEND or the like, which is probably more involved.
Colin