Add expose-version-header setting to control X-Puppet-Version disclosure - #534
Open
slauger wants to merge 1 commit into
Open
Add expose-version-header setting to control X-Puppet-Version disclosure#534slauger wants to merge 1 commit into
slauger wants to merge 1 commit into
Conversation
The X-Puppet-Version response header is emitted from two places: the outermost wrap-with-puppet-version-header middleware (present on every response, including 401/403 to unauthenticated clients) and the JRuby request handler, which copies it from the Ruby master response. Either way the exact server version is disclosed to anyone able to reach the API.
Add a top-level expose-version-header setting (default true, so behaviour is unchanged). When set to false, the master and CA services pass an empty version to wrap-with-puppet-version-header, which then strips any X-Puppet-Version header from the response - covering the JRuby-handled endpoints as well.
The setting is deliberately top-level rather than under [:puppetserver ...]: that config section is assembled from core Puppet settings at runtime, and a HOCON puppetserver{} block would clobber it (breaking CA settings at boot). It is documented, commented out with its default, in the shipped puppetserver.conf.
Covered by a unit test for the middleware (add/strip/nil cases) and an integration test that boots the server and asserts the header over HTTP with the setting unset and false.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Simon Lauger <simon@lauger.de>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a new
expose-version-headersetting (defaulttrue) so operators can stop the server from sending theX-Puppet-Versionheader.Right now that header goes out on every response — including 401/403 to unauthenticated clients — so anyone who can reach the API can read the exact server version.
Usage (nothing changes unless you set it):
When
false, the header is stripped from all responses.Tested: unit test for the middleware, an integration test that boots the server and checks the header on/off over HTTP, plus a manual check against a running container.