1

The Sitecore GraphQL API endpoint is returning Server HTTP Header in its response which has information on the hosting web server (IIS). This is a security issue as it gives the attacker information to focus on specific infrastructure.

Server Header

I tried to remove the header using a Web.config transform as suggested in Sitecore documentation below.

https://doc.sitecore.com/xp/en/developers/102/platform-administration-and-architecture/remove-header-information-from-responses-sent-by-your-website.html

However, this doesn't work for GraphQL endpoint. The Server header is not included in the responses from other Sitecore endpoints like Layout service or page routes. Do anyone know how to remove the Server header from GraphQL endpoint response?

1
  • Is there a chance that your CD sits behind a CDN ? A really quick way is to remove the header on the CDN. Jan 18, 2023 at 1:21

2 Answers 2

0

Alternatively you can use a reverse proxy, such as IIS or Nginx, to remove the "Server" header from the response before it reaches the client. Hope it helps.

0

I know it's been almost a year since I asked this question but answering it myself as it might be useful to others. Because Sitecore's GeaphQL api is a asp.net core web api implementation you need to add the below web.config transform to set the removeServerHeader attribute on requestFiltering to true to remove the server header from response.

<?xml version="1.0" encoding="utf-8"?>
<configuration xmlns:xdt="http://schemas.microsoft.com/XML-Document-Transform">
  <system.webServer>
    <security>
      <requestFiltering removeServerHeader="true" xdt:Transform="SetAttributes" />
    </security>
  </system.webServer>
</configuration>

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.