Remove headers that disclose internal details or software versions from HTTP responses.
Scrub Sensitive Headers
CCC.LB.CN07 · Networking
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.Core.CP14 | API Access | The service exposes a port enabling external actors to interact programmatically with the service and its resources using HTTP protocol methods such as GET, POST, PUT, and DELETE. |
| CCC.Core.CP27 | Configurable Network Ports | The service allows users to configure network ports for communication, enabling flexibility in network management and integration with other services. |
| CCC.Core.CP28 | Command-line Interface | The service includes a component that reads and translates text into commands that can be executed by the service. |
| CCC.LB.CP19 | Request and Response Header Transformations | The service can modify HTTP headers of both incoming requests and outgoing responses. |
Related Threats
| ID | Title | Description |
|---|---|---|
| CCC.Core.TH15 | Automated Enumeration and Reconnaissance by Non-human Entities | Automated processes may be used to gather details about service and child resource elements such as APIs, file systems, or directories. This information can reveal vulnerabilities, misconfigurations, and the network topology, which can be used to plan an attack against the system, the service, or its child resources. |
| CCC.LB.TH06 | Sensitive Metadata Is Exposed via HTTP Headers | Response headers may reveal software versions, internal IPs, or other metadata useful for reconnaissance. |
Assessment Requirements
| ID | Text | Applicability |
|---|---|---|
| CCC.LB.CN07.AR01 | When responses pass through the load balancer, the "Server" header MUST be removed or replaced with a generic value that does not identify the software or its version. | tlp-green, tlp-amber, tlp-red |