From a440bea56736fa4a0970836827f2904b3e466e9e Mon Sep 17 00:00:00 2001 From: bcmmbaga Date: Wed, 5 Aug 2026 15:48:08 +0300 Subject: [PATCH] Strip the Server header, drop the HSTS preload directive --- infrastructure_files/getting-started-enterprise.sh | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/infrastructure_files/getting-started-enterprise.sh b/infrastructure_files/getting-started-enterprise.sh index 04b9e032c..1d6cceb51 100755 --- a/infrastructure_files/getting-started-enterprise.sh +++ b/infrastructure_files/getting-started-enterprise.sh @@ -455,11 +455,13 @@ render_compose_common() { # every router referencing it whenever that container restarts. - traefik.http.middlewares.nb-security.headers.stsSeconds=3600 - traefik.http.middlewares.nb-security.headers.stsIncludeSubdomains=true - - traefik.http.middlewares.nb-security.headers.stsPreload=true - traefik.http.middlewares.nb-security.headers.contentTypeNosniff=true - traefik.http.middlewares.nb-security.headers.browserXssFilter=true - traefik.http.middlewares.nb-security.headers.referrerPolicy=strict-origin-when-cross-origin - traefik.http.middlewares.nb-security.headers.customResponseHeaders.X-Frame-Options=SAMEORIGIN + # Empty value strips the header. Only the dashboard's nginx sets one; the + # server emits none. Do not quote it — "" would send a literal Server: "". + - traefik.http.middlewares.nb-security.headers.customResponseHeaders.Server= dashboard: <<: *default