Hi all, Does anyone have any thoughts about removing MapServer version information from any errors/responses sent to client applications?
A few relevant online discussions [1] [2]. As MapServer falls more in the generic server category I'd be +1 on removing the details from responses (and leaving them in the client applications). See https://github.com/MapServer/MapServer/pull/6794 for some more details. I added in Proj and GDAL versions which are handy for admins/debugging, but provide more information to a malevolent party looking to attack a MapServer instance. Seth [1] https://softwareengineering.stackexchange.com/questions/345072/is-my-app-version-a-sensitive-information [2] https://security.stackexchange.com/questions/170352/is-it-safe-to-display-version-information-on-a-public-webpage-of-your-web-app -- web:https://geographika.net twitter: @geographika _______________________________________________ MapServer-dev mailing list [email protected] https://lists.osgeo.org/mailman/listinfo/mapserver-dev
