Remove the X-generator header from the response

Question

I want to remove the CMS type and version disclosure , which Drupal is returning in the X-Generator:Drupal 8 (https://www.drupal.org) header.

I am using the following code, but it removes the x-generator header, but I can still see X-Generator:Drupal 8 (https://www.drupal.org) in the browser header response.

function xxx_page_attachments_alter(&$data, &$context1 = NULL, &$context2 = NULL) {
    foreach ($data['#attached']['html_head'] as $key => $attachment) {
        if ($attachment[1] == 'system_meta_generator') {
          unset($data['#attached']['html_head'][$key]);
        }
    }
}

How can I fix my code?

Answer 1

The simplest method is to remove the header in a custom EventSubscriber:

$response->headers->remove('X-Generator');

See https://drupal.stackexchange.com/a/201297/47547 for an example.

Answer 2

It's not exactly the question you are asking, but...

I wrote a detailed answer to the idea of How can I obscure what I am using to run my site? Adding it as an answer here in case it's useful to you as you consider working on this problem.

Answer 3

Please check below link, Created custom module to do that.

@https://github.com/vikrantrc/Remove-X-Generator

Answer 4

@gaurav should also be working. For me it seems to work

function THEMENAME_page_attachments_alter(&$data) {
  foreach ($data['#attached']['html_head'] as $key => $attachment) {
    if ($attachment[1] == 'system_meta_generator') {
      unset($data['#attached']['html_head'][$key]);
    }
  }
}

Answer 5

The easiest way to do this is to remove the response_generator_subscriber service responsible for adding X-Generator in the first place. It's all it does so nothing (other than Core's tests) should depend on it.

Simply drop in a Drupal\Core\DependencyInjection\ServiceProviderInterface implementation into your module like this:

my_module/src/MyModuleServiceProvider.php:

<?php

namespace Drupal\ws_main;

use Drupal\Core\DependencyInjection\ContainerBuilder;
use Drupal\Core\DependencyInjection\ServiceProviderBase;

/**
 * Remove the service adding the X-Generator header.
 */
class MyModuleServiceProvider extends ServiceProviderBase {

  /**
   * {@inheritdoc}
   */
  public function alter(ContainerBuilder $container) {
    $container->removeDefinition('response_generator_subscriber');
  }

}

Important to note is that the class (and filename) must be a CamelCased version of your module's machine name (First character capitalized, remove any underscore and capitalize the next character) as noted in the documentation on altering services. After clearing the cache - rebuilding the service registry - there should even be a tiny performance gain with this method, compared to adding and then removing the header on every response.

Answer 6

Without coding

Remove X-Generator is a common requirement for Drupal sites. The Mix module can deal with this and many other common situations without coding.

By checking the "Remove X-Generator" checkbox in /admin/config/mix, the following items can easily be removed:

• The meta tag <meta name="Generator" content="Drupal 10 (https://www.drupal.org)"> from the page source code.
• The "X-Generator" in the HTTP header.

Coding

These only take a few lines of code.

To remove the <meta name="Generator" content="Drupal 10 (https://www.drupal.org)">, implement this in [yourmodule].module file.

@see https://git.drupalcode.org/project/mix/-/blob/1.x/mix.module#L96

/**
 * Implements hook_page_attachments_alter().
 */
function HOOK_page_attachments_alter(array &$attachments) {
  foreach ($attachments['#attached']['html_head'] as $key => $attachment) {
    if ($attachment[1] == 'system_meta_generator') {
      unset($attachments['#attached']['html_head'][$key]);
    }
  }
}

To remove the "X-Generator" HTTP header, you can implement an EventSubscriber.

@see https://git.drupalcode.org/project/mix/-/blob/1.x/src/EventSubscriber/MixSubscriber.php#L113

  public function onKernelResponse(ResponseEvent $event) {
    $response = $event->getResponse();
    $response->headers->remove('X-Generator');
  }