"Addressing Server Exposure in Azure Web App: Concealing Details in DAST Reports

Question

Hi, we have deployed our Python (Flask) based application on Azure Web App(Linux based). During the DAST report, it was highlighted that server details are exposed. We attempted to address this issue by modifying the Flask code, but it didn't work. Additionally, we lack control over the server. Is there a way to hide or remove the server name and details within the Azure portal?.

Answer 1

@A Aathithya , Based on my understanding of your issue descripition, on App Service when you perform any security testing, the result response is received from the frontends and never arrive to the actual worker (for example, invalid request). Currently, if your requirement fits, you can App Gateway/WAF similar proxy in front and strip out the response header there. If it’s an enterprise app, it’s a good practice to have the WAF either way.

Please check this doc - Common scenarios for header rewrite

We have a UserVoice post on a similar request, ‘remove server header from the front end servers’ - you may wish to up-vote.

Kindly let me know how it goes, or share more details about your requirement.

Answer 2

We have resolved the issue by following these steps: Created a 'config.py' file with the following lines: 'import gunicorn' and 'gunicorn.SERVER = "undisclosed"'. Additionally, specified this as the application startup command: 'gunicorn --config python:config.py app:app'.

Answer 3

To benefit the community, summarizing the solution shared by @A Aathithya

Requirement:
Hide or remove server details exposed on Azure App Service WebApp.

Scenario:
After deploying our Python (Flask) based application on Azure Web App (Linux based), DAST report highlighted the exposure of server details.

Despite attempting to address the issue by modifying the Flask code, the resolution was unsuccessful.

(Posting the solution shared by @A Aathithya )

Resolved: The issue has been successfully resolved through the following steps:

• Created a 'config.py' file with the following lines: 'import gunicorn' and 'gunicorn.SERVER = "undisclosed"'.
• Specified this file as the application startup command: 'gunicorn --config python:config.py app:app'.

---

If the answer helped (pointed you in the right direction) > please click Accept Answer