Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove kbn-version from the response headers #20573

Closed
joshbressers opened this issue Jul 9, 2018 · 4 comments
Closed

Remove kbn-version from the response headers #20573

joshbressers opened this issue Jul 9, 2018 · 4 comments
Assignees
Labels
Team:Security Team focused on: Auth, Users, Roles, Spaces, Audit Logging, and more!

Comments

@joshbressers
Copy link

Today Kibana has a header called kbn-version that returns the version of Kibana.

kbn-version: 5.6.0

This is often flagged by automated security scanners as disclosing too much information. While we do not consider this a security problem, and removing it doesn't increase security, it will cut down on the false positive rate from automated scanners.

The PR for this change can be found here
#20551

@kobelb kobelb self-assigned this Jul 9, 2018
@kobelb kobelb added the Team:Security Team focused on: Auth, Users, Roles, Spaces, Audit Logging, and more! label Jul 9, 2018
@kobelb
Copy link
Contributor

kobelb commented Jul 13, 2018

We've gone ahead with this change, as the response header isn't currently used for anything.

@Erni
Copy link

Erni commented Jul 25, 2018

A customer is asking when would be this change applied. They have a very strict security policy, and they need to know more or less the date when this change is gonna be available.

@kobelb
Copy link
Contributor

kobelb commented Jul 25, 2018

@Erni this change will be in 6.4

@Erni
Copy link

Erni commented Jul 26, 2018

Thank you very much @kobelb I will inform the customer right now.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Team:Security Team focused on: Auth, Users, Roles, Spaces, Audit Logging, and more!
Projects
None yet
Development

No branches or pull requests

3 participants