[KNOX-2285] Change gateway.server.header.enabled default to false

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.4.0
• Component/s: Server
• Assignee: Kevin Risden
• Reporter: Kevin Risden
• Created: 10/Mar/20 20:21
• Updated: 10/Mar/20 20:58
• Resolved: 10/Mar/20 20:58

Description

KNOX-932 added gateway.server.header.enabled with the default set to true. Its been ~2 years and many security scanners are reporting issues if servers report internal versions.

We should set the default of gateway.server.header.enabled to false to prevent this information from leaking.

Issue Links

• relates to: KNOX-932 Option to remove the server-name from HTTP-header response
• relates to: KNOX-2257 Documentation for KNOX-932 / KNOX-2285 gateway.server.header.enabled
• links to: GitHub Pull Request #286