Skip to content

server.md

Latest commit

 

History

History
76 lines (47 loc) · 2.65 KB

server.md

File metadata and controls

76 lines (47 loc) · 2.65 KB

Server Header

What it does

The Server header can reveal details about the software handling the request. In secure, the builder defaults to an empty string so your application can avoid adding identifying detail when the surrounding stack allows it.

Minimal example

from secure import Secure, Server

secure_headers = Secure(
    server=Server().set("")
)

Resulting header

Server:

Practical note

Application code can only control this header if the surrounding stack does not re-add its own value. Check your ASGI server, WSGI server, proxy, or CDN settings too.

Best Practices

  • Set an empty value or custom string: Use an empty or generic value when you want secure to control the header.
  • Avoid exposing server information: Avoid leaving the default server response, which may expose sensitive version information.
  • Check upstream defaults: Proxies, ASGI servers, and framework middleware may still add their own Server header unless you disable that behavior.

Configuration with Secure

Use Server to control the Server header value. Its default value is an empty string.

Methods Available

  • set(value): Set a custom value for the Server header.
  • clear(): Clear any custom value and revert the header to its default secure value (an empty string).

Example Usage

To set up the Server header and hide the server information:

from secure import Server

server_header = Server().set("")
print(server_header.header_name)   # Output: 'Server'
print(server_header.header_value)  # Output: ''

Then pass it into Secure:

from secure import Secure

secure_headers = Secure(server=server_header)

Special Considerations for Frameworks

Some frameworks like Uvicorn automatically inject a Server header. If you're using Uvicorn and need to override or remove this header, refer to the framework integration guide for specific instructions on how to disable Uvicorn's default Server header.

Resources

Attribution

This library implements security recommendations from trusted sources: