Server Information In HTTP Header - Microsoft-HTTPAPI/2.0

[Sonja_Bauernfeind]

HTTP Response Header exposes Microsoft-HTTPAPI/2.0 as the server source. An attacker could use this information to expose known vulnerabilities for the server source.

 

Resolution

This header is included in the HTTP header by .NET framework, which means it can not be directly controlled by Qlik software. 

The header is only added in Qlik software that runs in Windows environment, for example Qlik Sense Enterprise for Windows and QlikView Web Server. 

There are two main approaches to removing this HTTP header;

1. Disable the server header for WCF Services in the Windows registry, as described in https://blogs.msdn.microsoft.com/dsnotes/2017/12/18/wswcf-remove-server-header/
2. Suppress the HTTP header through a reverse proxy if this exists in front of Qlik Sense in the current deployment. For option details on this option, consult reverse proxy documentation. If you require assistance implementing the solution, our professional services are happy to be engaged.

Environment

Qlik Sense Enterprise on Windows, all version
QlikView, all versions
Qlik NPrinting, all versions

Internal Investigation IDs:

• QLIK-90522

[Luck]

Hi @Sonja_Bauernfeind ,

is this article still relevant for qlik sense August 2022 Patch 5 on windows server 2019?

If so,how to proceed disabling the server header for WCF Services in Windows registry if the deployment is on a multi-node qlik sense site?

as the registry update usually need a server restart, do we restart from the rim nodes, or the central node when the registry is updated, or is there a specific step to follow?

[Sonja_Bauernfeind]

Hello @Luck 

This topic relates to the operating system itself rather than Qlik Sense, so the Qlik Sense Enterprise on Windows version is irrelevant in these situations.

You would need to make this change on whichever node you use to host the hub (so, the proxy nodes).

As for restarting, see How to restart the Qlik Sense Enterprise on Windows services 

Rim nodes will not have all services installed. Rim node services can be stopped or started in any order after the central node has been stopped or started. 

All the best,
Sonja