5

I want to remove the CMS type and version disclosure , which Drupal is returning in the X-Generator:Drupal 8 (https://www.drupal.org) header.

I am using the following code, but it removes the x-generator header, but I can still see X-Generator:Drupal 8 (https://www.drupal.org) in the browser header response.

function xxx_page_attachments_alter(&$data, &$context1 = NULL, &$context2 = NULL) {
    foreach ($data['#attached']['html_head'] as $key => $attachment) {
        if ($attachment[1] == 'system_meta_generator') {
          unset($data['#attached']['html_head'][$key]);
        }
    }
}

How can I fix my code?

  • You have to override the \Drupal\Core\EventSubscriber\ResponseGeneratorSubscriber which is response_generator_subscriber service via ServiceProviderBase. Also check the \Drupal\Core\Mail\MailManager::doMail – user21641 Feb 2 '17 at 14:35
  • 1
    Drupal is not giving any hint about the exact version, and they can know if you are using Drupal 8 or Drupal 7 in other ways. Removing that tag is doing what they call securing by obscuring which is never a good idea. – kiamlaluno Feb 2 '17 at 16:20
5

The simplest method is to remove the header in a custom EventSubscriber:

$response->headers->remove('X-Generator');

See https://drupal.stackexchange.com/a/201297/47547 for an example.

0

It's not exactly the question you are asking, but...

I wrote a detailed answer to the idea of How can I obscure what I am using to run my site? Adding it as an answer here in case it's useful to you as you consider working on this problem.

0

Please check below link, Created custom module to do that.

@https://github.com/vikrantrc/Remove-X-Generator

0

@gaurav should also be working. For me it seems to work

function THEMENAME_page_attachments_alter(&$data) {
  foreach ($data['#attached']['html_head'] as $key => $attachment) {
    if ($attachment[1] == 'system_meta_generator') {
      unset($data['#attached']['html_head'][$key]);
    }
  }
}
0

The easiest way to do this is to remove the response_generator_subscriber service responsible for adding X-Generator in the first place. It's all it does so nothing (other than Core's tests) should depend on it.

Simply drop in a Drupal\Core\DependencyInjection\ServiceProviderInterface implementation into your module like this:

my_module/src/MyModuleServiceProvider.php:

<?php

namespace Drupal\ws_main;

use Drupal\Core\DependencyInjection\ContainerBuilder;
use Drupal\Core\DependencyInjection\ServiceProviderBase;

/**
 * Remove the service adding the X-Generator header.
 */
class MyModuleServiceProvider extends ServiceProviderBase {

  /**
   * {@inheritdoc}
   */
  public function alter(ContainerBuilder $container) {
    $container->removeDefinition('response_generator_subscriber');
  }

}

Important to note is that the class (and filename) must be a CamelCased version of your module's machine name (First character capitalized, remove any underscore and capitalize the next character) as noted in the documentation on altering services. After clearing the cache - rebuilding the service registry - there should even be a tiny performance gain with this method, compared to adding and then removing the header on every response.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.