0

In my Django application, the following settings ensure that the response headers have the standard key-value pairs enabled.

However, the 'Server' name and version information is still visible by default which needs to be hidden (exposed server name and version is an OWASP vulnerability).

middleware.py

class MyAppMiddleware:

    def __init__(self, get_response):
        self.get_response = get_response

    def __call__(self, request):
        response = self.get_response(request)
        response['X-XSS-Protection'] = "1; mode=block"
        return response


class RemoveHeaders(object):           # this method invocation throws error
    def process_response(self, request, response):
        response['Server'] = ''
        return response

Also as suggested in other posts, this middleware.py is declared in the first order of middlewares in settings.py:

MIDDLEWARE = [
    'MyApp.middleware.RemoveHeaders',
    'MyApp.middleware.MyAppMiddleware',
    'django.middleware.security.SecurityMiddleware',
    'django.contrib.sessions.middleware.SessionMiddleware',
    'django.middleware.common.CommonMiddleware',
    'django.middleware.csrf.CsrfViewMiddleware',
    'django.contrib.auth.middleware.AuthenticationMiddleware',
    'django.contrib.messages.middleware.MessageMiddleware',
    'django.middleware.clickjacking.XFrameOptionsMiddleware',
]

The RemoveHeaders() method throws error: TypeError: RemoveHeaders() takes no arguments. This is because I am unsure which object is being passed to this method.

Update: importing the following worked for me.

from django.utils.deprecation import MiddlewareMixin


# class to import in RemoveHeaders--

class RemoveHeaders(MiddlewareMixin):
     # rest of the code
3
  • 1
    Is this being followed stackoverflow.com/questions/50493701/…? Commented Feb 28, 2020 at 4:28
  • Yes I did. The code snipped above has been updated. However the 'RemoveHeaders' method separately created for dealing with hiding response headers, throws an error on method invocation Commented Feb 28, 2020 at 4:40
  • In the __call__, I added this line print('Response has Server header', response.has_header('Server')) which printed False. This means that Server header is not even set at that point. I am not sure where is it set and why does second method work. Commented Feb 28, 2020 at 5:59

2 Answers 2

0

@stackoverflowusrone I find this from django v3.7 source code, the server header is from here : enter image description here

however i don't know how to del it

Sign up to request clarification or add additional context in comments.

Comments

0

If you are using GUNICORN in production here is answer for you.

1- Create a file gunicorn.config.py in same directory where settings.py file exist.

2- Write following code in gunicorn.conf.py file

import gunicorn
gunicorn.SERVER_SOFTWARE = "My Own Server"

3- update django app entrypoint

gunicorn --config python:MYAPP.gunicorn pelocal_rm_api.wsgi --bind 0.0.0.0

Please upvote if it's works for you.

Comments

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.