Uwebsockets header constitutes a security issue

[theninthsky]

The 'Uwebsockets' header is sent by default with any response.
As with the 'X-Powered-By' header, this gives a potential attacker a way to find out in which programming language (and even in which framework) the server was written:

https://blog.rapid7.com/2019/12/06/hidden-helpers-security-focused-http-headers-to-protect-against-vulnerabilities/#xpoweredby

While being a great marketing tool, there must be given a way to disable it.

Related: #150

[ghost]

You already have UWS_HTTPRESPONSE_NO_WRITEMARK to disable this, but you need to build your own binary with it. This software is free and you can do whatever you want with it but by default it does send this header, yes. I want users to keep this header so that's why I have it on by default.

I absolutely see no security issue in telling (roughly) what server is in use. Many, many projects and companies do similar things. Besides, it is not that hard to figure out what tech stack a company use - often times they list all their tech in Careers page, etc.

[theninthsky]

I understand, thank you for the thorough explaination.