How do you change the server header returned by ng

Question

There's an option to hide the version so it will display only nginx, but is there a way to hide that too so it will not show anything or change the header?

Answer 1

Install Nginx Extras

sudo apt-get update
sudo apt-get install nginx-extras

Server details can be removed from response by adding following two lines in the nginx.conf (under http section)

more_clear_headers Server;
server_tokens off;

Answer 2

There is a special module: http://wiki.nginx.org/NginxHttpHeadersMoreModule

This module allows you to add, set, or clear any output or input header that you specify.

This is an enhanced version of the standard headers module because it provides more utilities like resetting or clearing "builtin headers" like Content-Type, Content-Length, and Server.

It also allows you to specify an optional HTTP status code criteria using the -s option and an optional content type criteria using the -t option while modifying the output headers with the more_set_headers and more_clear_headers directives...

Answer 3

If you're okay with just changing the header to another string five letters or fewer, you can simply patch the binary.

sed -i 's/nginx\r/thing\r/' `which nginx`

Which, as a solution, has a few notable advantages. Namely, that you can allow your nginx versioning to be handled by the package manager (so, no compiling from source) even if nginx-extras isn't available for your distro, and you don't need to worry about any of the additional code of something like nginx-extras being vulnerable.

Of course, you'll also want to set the option server_tokens off, to hide the version number, or patch that format string as well.

I say "five letters or fewer" because of course you can always replace:

nginx\r\0

with

bob\r\0\r\0

leaving the last two bytes unchanged.

If you actually want more than five characters, you'll want to leave server_tokens on, and replace the (slightly longer) format string, although again there's an upper limit on that length imposed by the length of the format string - 1 (for the carriage return).

...If none of the above makes sense to you, or you've never patched a binary before, you may want to stay away from this approach, though.

Answer 4

Simple, edit /etc/nginx/nginx.conf and remove comment from

#server_tokens off;

Search for http section.

Answer 5

Are you asking about the Server header value in the response? You can try changing that with an add_header directive, but I'm not sure if it'll work. http://wiki.codemongers.com/NginxHttpHeadersModule