Is it possible to hide the Server response header on a public HTTP binding?

[proactive-its]

Is your feature request related to a problem? Please describe.

Hello SFTPGo team,

Thank you for the excellent work on SFTPGo.

I'm using SFTPGo Community Edition v2.7.3 with two HTTP bindings:

9443 (Public): WebClient only (enable_web_client: true, enable_web_admin: false, enable_rest_api: false, render_openapi: false)
9444 (Internal): WebAdmin, REST API, and Swagger enabled for internal administration only.

Everything works as expected. Accessing:

https://our-server:9443/openapi/swagger-ui

correctly returns:

{"message":"Not Found"}

However, the response still includes the header:

Server: SFTPGo/2.7.3

Is there a supported way to:

Remove the Server header,
Replace it with a generic value, or
Disable version disclosure for the public HTTP binding?

I couldn't find a related configuration option in the documentation.

If this isn't currently supported, would you consider adding it as a future hardening feature? It would be valuable for security-conscious deployments where minimizing information disclosure is a best practice.

Thank you!

Describe the solution you'd like

please if any one has a solution for that i would appreciated

Describe alternatives you've considered

No response

What are you using SFTPGo for?

Professional user, 1 person business

Additional context

No response

[lohr-abis]

You could do this with
SFTPGO_COMMON__SERVER_VERSION: "short"
It will only return SFTPGo from now on.