Set a standards-compliant HTTP User-Agent, including version number. #3065
Conversation
|
Do you think leaking the version in the clear is a good move from an op-sec perspective? |
|
Not sure if including the version number is that much worse than just telling whoever may be interested just the product name. To be honest, I was mainly thinking about client/server communication. For all other HTTP usage, we may as well not set a UA at all. |
|
@scudette what do you think about leaving out the User-Agent altogether for "external" communication? |
|
Happy to drop it completely and expose it though the http client plugin parameter https://docs.velociraptor.app/vql_reference/plugin/http_client/ But probably if we dropped it now it would allow fingerprinting the version to identify newer clients? Maybe we need to have it configurable? |
hillu
force-pushed
the
user-agent
branch
2 times, most recently
from
e6bb903 to
4bada97
Compare
- Add optional user_agent parameter for http_client and upload_webdav - Don't set UA for other HTTP connections (DynDNS, inventory access, LogScale) By default, Go's net/http would set its own user-agent string.
Done for |
No description provided.