Is your feature request related to a problem? Please describe.
Hello SFTPGo team,
Thank you for the excellent work on SFTPGo.
I'm using SFTPGo Community Edition v2.7.3 with two HTTP bindings:
9443 (Public): WebClient only (enable_web_client: true, enable_web_admin: false, enable_rest_api: false, render_openapi: false)
9444 (Internal): WebAdmin, REST API, and Swagger enabled for internal administration only.
Everything works as expected. Accessing:
https://our-server:9443/openapi/swagger-ui
correctly returns:
{"message":"Not Found"}
However, the response still includes the header:
Server: SFTPGo/2.7.3
Is there a supported way to:
Remove the Server header,
Replace it with a generic value, or
Disable version disclosure for the public HTTP binding?
I couldn't find a related configuration option in the documentation.
If this isn't currently supported, would you consider adding it as a future hardening feature? It would be valuable for security-conscious deployments where minimizing information disclosure is a best practice.
Thank you!
Describe the solution you'd like
please if any one has a solution for that i would appreciated
Describe alternatives you've considered
No response
What are you using SFTPGo for?
Professional user, 1 person business
Additional context
No response
Is your feature request related to a problem? Please describe.
Hello SFTPGo team,
Thank you for the excellent work on SFTPGo.
I'm using SFTPGo Community Edition v2.7.3 with two HTTP bindings:
9443 (Public): WebClient only (enable_web_client: true, enable_web_admin: false, enable_rest_api: false, render_openapi: false)
9444 (Internal): WebAdmin, REST API, and Swagger enabled for internal administration only.
Everything works as expected. Accessing:
https://our-server:9443/openapi/swagger-ui
correctly returns:
{"message":"Not Found"}
However, the response still includes the header:
Server: SFTPGo/2.7.3
Is there a supported way to:
Remove the Server header,
Replace it with a generic value, or
Disable version disclosure for the public HTTP binding?
I couldn't find a related configuration option in the documentation.
If this isn't currently supported, would you consider adding it as a future hardening feature? It would be valuable for security-conscious deployments where minimizing information disclosure is a best practice.
Thank you!
Describe the solution you'd like
please if any one has a solution for that i would appreciated
Describe alternatives you've considered
No response
What are you using SFTPGo for?
Professional user, 1 person business
Additional context
No response