0

Can I remove default HTTP headers from a SOAPReply node?

I tried to Overwrite it in ESQL and tried removing it using HTTPHeader node, I succeded in creating new HTTP Headers but failed to remove the default ones (for example "Server: IBM App Connect Enterprise").

The weird thing is that the same code works with HTTPReply node but not with SOAPReply node. Any suggestions?

My ESQL code:

SET OutputRoot.HTTPReplyHeader."Server" = 'MyDummyValue';

Output of HTTPReply node:

HTTP/1.1 200 OK
Content-Type: text/xml
Server: MyDummyValue

Output of SOAPReply node:

HTTP/1.1 200 OK
Content-Type: text/xml
Server: IBM App Connect Enterprise
Diesel
  • 11
  • 3

3 Answers3

1

I tried to override it in the Integration Server YAML file (server.conf.yaml) and it worked as expected for both HTTP and SOAP flows.

The value you need to override is:

/ResourceManagers/HTTP[S]Connector/ServerName
Diesel
  • 11
  • 3
0

I checked this page: https://www.ibm.com/docs/en/app-connect/11.0.0?topic=node-local-environment-overrides-soapreply and I cannot see any local environment override that would suppress the default headers in a SOAPReply node.

kimbert
  • 2,376
  • 1
  • 10
  • 20
0

The Server header is in an internal list of headers that we don't allow you to set. I suspect it is to ensure that receiving clients know how to process the SOAP messages from ACE, we might have had a situation where it was overwritten and a client application failed, and it was added to the list.

Is there a particular reason why you need to modify the Server header?

andreasmartens
  • 96
  • 5
  • The reason is that it's identified as a common security issue, please check [WSTG-INFO-02](https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/01-Information_Gathering/02-Fingerprint_Web_Server) for reference. – Diesel Feb 08 '23 at 17:06
  • that's a very valid point! I see you found a workaround in the YAML. I'll raise this internally anyway, if you still think there should be a way to do so in-flow could you raise an "idea" here please: https://integration-development.ideas.ibm.com/ideas/project=APPC – andreasmartens Feb 10 '23 at 10:50