Conversation
| if (!k) return -1; | ||
| k = safestrdup (errornbuf); | ||
| if (!k) | ||
| return -1; |
There was a problem hiding this comment.
there's no chance getting this merged with random whitespace changes all over the place. change so the result of git diff is identical to git diff -w
There was a problem hiding this comment.
Sorry, before pushing, I ran tinyproxy-indent.sh on the files I changed.
fa09b39 to
47ca873
Compare
Allow operators to control the Server response header sent on error pages. ServerName sets a custom value, DisableServerHeader suppresses the header entirely, hiding the proxy software identity from clients. Signed-off-by: Nicolas Gillen <[email protected]>
47ca873 to
301ef8f
Compare
|
this will also need src/conf-tokens.gperf adapted essentially this is pretty similar to the ViaProxyName/DisableViaHeader pair, one could argue that someone setting those would also want the new directives you add to kick in. if someone sets DisableViaHeader to true, that indicates a pretty clear intention to not leak any identifying data. |
|
rather than adding new configuration knobs, i lean towards just not sending the server name in the error messages at all. we recently also removed all version number leaks, so this would not be unprecedented. thoughts? |
The
Server:HTTP response header was hardcoded totinyproxyin error responses, disclosing the proxy software identity to clients:ServerNamedirective to set a custom value for theServerheaderDisableServerHeaderdirective to suppress the header entirely