Take the 2-minute tour ×

Hi in my rails application I am using nginx/1.0.6 , Phusion Passenger to host my rails application. But for the security issue I want to stop the display of headers on public network. Now when I run the following curl command. `

curl -I http://domain.name

it give me the following trace:

HTTP/1.1 200 OK
Connection: keep-alive
Status: 200
ETag: "b7da2b7b2fa6349"
X-Runtime: 1.193656
Set-Cookie: demand_session=BAh7ByIQX2NzcmZfdG9rZW4iMUVMREdHRDJGcHhnVzhWNTNsRGhGSWRyNmRQbWZZSnpyZGcwbFYx3D%3D--eb470df0951aac0e6612861ef30ed7a699d073a0; path=/; HttpOnly
Server: nginx/1.0.6 + Phusion Passenger 3.0.9 (mod_rails/mod_rack)

But I want to hide these headers: Server,Set-Cookie,X-Powered-By,X-UA-Compatible,ETag,Cache-ControlCache-Control to be display.

share|improve this question
I can understand wanting to hide X-Powered-By and maybe Server, but you'll probably find your apps crippled to the point of uselessness and/or very inefficient if you shut off cookies and cache control, and there's really no good reason to do that anyway. Unfortunately I don't have an actual answer to your question. –  Jim Stewart Jan 25 '13 at 6:21
The main thing which I want to hide is server version's because precise software versions might aid an attacker in mounting tailored attacks on the server. –  vidur punj Jan 25 '13 at 6:31
Yeah, it's a legitimate concern, especially after the recent Rails problems. I don't know that it's worth it or will actually help, but I appreciate the attempt. :) –  Jim Stewart Jan 25 '13 at 6:33
ok Jim thanks.. –  vidur punj Jan 25 '13 at 6:39

2 Answers 2

up vote 2 down vote accepted

If you are using proxy you can use and configure directive proxy_hide_header from proxy module by that:

proxy_hide_header X-Powered-By;
proxy_hide_header X-UA-Compatible;
proxy_hide_header X-Runtime;
proxy_hide_header ETag;

# and so on...

But this directive allow you only to hide headers coming from proxy server. For response headers coming from main server not proxy you can use directive set and variable $sent_http_HEADER where HEADER means header name you would like to set. Here an example:

set $sent_http_x_powered_by your_value;
set $sent_http_etag your_value;
set $sent_http_cache_control your_value;

# and so on...

But take in consideration two things: 1. Set directive works only in server,location and if blocks, 2. As you can read in comments to your question it's not realy good idea to hide or change some headers like Cache-Control because they aren't only information but have impact on browser and user clients work.

share|improve this answer
can you please tell me where I can set these values. –  vidur punj Jan 25 '13 at 7:22
I think in server block and then it will work for all location blocks or in some location blocks where you need those directives –  emka86 Jan 25 '13 at 7:24

Use passenger_show_version_in_header off and server_tokens off.

share|improve this answer
passenger_show_version_in_header will remove the passenger version but not passenger it self, regrettably. –  Jason D. Nov 20 '13 at 7:24

Your Answer


