javascript - Cloudfront 和 Lambda@Edge : Remove response header

Question

我正在尝试在 ViewerResponse 事件上使用 Lambda@Edge 从 Cloudfront 响应中删除一些 header 。源是一个 S3 存储桶。

我已经成功地改变了这样的标题:

exports.handler = (event, context, callback) => {
    const response = event.Records[0].cf.response;
    response.headers.server = [{'key': 'server', 'value': 'bunny'}];
    callback(null, response);
};

但是，将 header 全部删除似乎不起作用，例如像这样。

exports.handler = (event, context, callback) => {
    const response = event.Records[0].cf.response;
    delete response.headers.server;
    // or response.header.server = null;
    // or response.headers.server = [{'key': 'server', 'value': null}];
    callback(null, response);
};

此代码段不会删除，而是将服务器 header 从 server: AmazonS3 更改为至 server: CloudFront .所以我假设服务器 header 可能是强制性的并且会自动填充。但我也无法删除 CloudFront 生成的其他 header 。在 lambda 测试 Pane 中，该函数按预期工作。所以在 Lambda 函数完成后发生了一些事情。

作为背景，我想更改标题，因为该站点在重要客户的网络中被阻止，并显示它是在线存储或备份位置的消息。

我错过了什么？

Answer 1

不幸的是，根据 AWS 支持，CloudFront 目前不支持此功能:

It is not possible to completely remove the Server Header, we can either set it to None or even if we try to delete the server header field altogether, CloudFront will add a 'Server:CloudFront' to the viewer response.

既然您提到了一个政府机构，您可能想问一下他们遵循什么政策。其中大部分可能基于 CIS benchmarks对于像 Apache 这样的东西，它们通常有一个“信息泄露”的目标，比如:

Information is power and identifying web server details greatly increases the efficiency of any attack, as security vulnerabilities are extremely dependent upon specific software versions and configurations. Excessive probing and requests may cause too much "noise" being generated and may tip off an administrator. If an attacker can accurately target their exploits, the chances of successful compromise prior to detection increase dramatically. Script Kiddies are constantly scanning the Internet and documenting the version information openly provided by web servers. The purpose of this scanning is to accumulate a database of software installed on those hosts, which can then be used when new vulnerabilities are released.

我看到的推荐建议通常是允许通用 Server标题除了删除它。例如，Apache 指南允许 Server: Apache :

Configure the Apache ServerTokens directive to provide minimal information. By setting the value to Prod or ProductOnly. The only version information given in the server HTTP response header will be Apache rather than details on modules and versions installed.

如果您删除 Server header ，CloudFront 添加自己的 header 不会泄漏有关后端服务器的信息，也不会向攻击者提供新信息，因为他们已经知道他们正在连接到 CloudFront IP 地址。