HTTP header information disclosure on Qlik Sense entreprise

[JMAROUF]

Hello everyone,

During a recent security audit, a test was performed using Burp Suite by sending requests to our Qlik Sense server. The response headers revealed information such as:

Server: Microsoft-HTTPAPI/2.0
WWW-Authenticate: NTLM

What is the best way to configure Qlik Sense (or the underlying web server) to suppress or modify HTTP response headers like Server and X-Powered-By?

Any guidance on whether this should be done ? Note that there is no virtual proxy configured, except for the default one."

Thanks in advance!

[David_Friend · Accepted solution]

@JMAROUF see if this helps:

https://community.qlik.com/t5/Official-Support-Articles/Disabling-Server-Header/ta-p/1716182

If this helps please click on 'accept as solution' button!

[Alan_Slaughter]

Hi JMAROUF, maybe this would be helpful:
https://community.qlik.com/t5/Official-Support-Articles/Server-Information-In-HTTP-Header-Microsoft-...