Friday, June 1, 2018

How to Hide Apache Server ETag Header Information Disclosure?

<Directory /usr/local/httpd/htdocs>
    FileETag MTime Size
</Directory>

However, most of the websites that we tested don't bother configuring their ETags,
so a simpler solution is to turn off ETags entirely and rely on Expires or Cache-Control
headers to enable efficient caching of resources. 
To turn off ETags, add the following lines to one of your configuration files in Apache 
(this requires mod_headers, which is included in the default Apache build):

Header unset Etag
FileETag none
Then Restart https services like below:-
service httpd restart

No comments:

Post a Comment