For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

ryan_111816's avatar
ryan_111816
Icon for Nimbostratus rankNimbostratus
Dec 16, 2009

Strip HTTP Server Header

I'm trying to find an iRule which will strip out the Server header from my server's HTTP responses. I've found the following rule under the samples section: http://devcentral.f5.com/wiki/default.aspx...
application delivery
dev
devops
iRules
hoolio's avatar
hoolio
Icon for Cirrostratus rankCirrostratus
Dec 16, 2009
Hi Ryan,

That would be pretty straightforward: 

 
 when HTTP_RESPONSE { 
  
     Remove all instances of the Server header 
    HTTP::header remove Server 
  
 }

You might also want to remove the X- headers as they can contain app identifying signatures (like x-powered-by for example). 

 
 when HTTP_RESPONSE { 
  
     Remove all instances of the Server header 
    HTTP::header remove Server 
  
     Remove all headers starting with x- 
    foreach header_name [HTTP::header names] { 
  
       if {[string match -nocase x-* $header_name]}{ 
  
          HTTP::header remove $header_name 
       } 
    } 
 }

Aaron