Uploaded image for project: 'Knative Serving'
  1. Knative Serving
  2. SRVKS-1252

Remove "Server: envoy" that is included in the response header when making http request to knative serving route

XMLWordPrintable

    • Icon: Feature Feature
    • Resolution: Unresolved
    • Icon: Normal Normal
    • 1.37.0
    • None
    • None
    • None

      server: envoy is getting added to response header of knative service and need ways to remove it as security finding is blocking release of one of our customer.

      [admin@bastion][09:40:34] ~ $ oc get ksvc
      NAME URL LATESTCREATED LATESTREADY READY REASON
      sample https://sample-hello.apps.osh4dev.tatrabanka.sk sample-00001 sample-00001 True

      1. Case reproduction:
        [admin@bastion][09:44:21] ~ $ curl -s -D - -o /dev/null https://sample-hello.apps.osh4dev.tatrabanka.sk
        HTTP/1.1 200 OK
        accept-ranges: bytes
        content-length: 1517
        content-type: text/html
        date: Mon, 13 May 2024 07:44:36 GMT
        last-modified: Mon, 07 Jan 2019 10:18:28 GMT
        x-envoy-upstream-service-time: 4
        server: envoy
        set-cookie: 5f7ec6d803ff56a625d47ddb20abf22a=67bbc0206e6812f6fa31cec82df0578f; path=/; HttpOnly
        cache-control: private
        Strict-Transport-Security: max-age=31536000; includeSubDomains

      Ongoing Slack thread: https://redhat-internal.slack.com/archives/CF5ANN61F/p1716353064399079

      Links for known issue: https://github.com/envoyproxy/envoy/issues/14421

              skontopo@redhat.com Stavros Kontopoulos
              hepatil Hemant Patil (Inactive)
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated: