5.2 Headers - Clarify X-Powered-By

[pnicolucci]

In section 5.2 it states the following:

It is recommended that containers use the X-Powered-By HTTP header to publish its
implementation information. The field value should consist of one or more
implementation types, such as "Servlet/4.0". Optionally, the supplementary
information of the container and the underlying Java platform can be added after the
implementation type within parentheses. The container should be configurable to
suppress this header.
Here’s the examples of this header.
X-Powered-By: Servlet/4.0
X-Powered-By: Servlet/4.0 JSP/2.3 (GlassFish Server Open Source
Edition 5.0 Java/Oracle Corporation/1.8)

I'd like to propose that we either remove the recommendation of adding the X-Powered-By header or at the very least clearly document that it should be disabled by default.

Often times this header is flagged as an information disclosure by security tools. I'd also like to
ensure that there are no compliance tests that check for this header as the spec only says it is
recommended rather than required.

My personal choice would be to remove this totally.

[stuartwdouglas]

+1 to removing this.

[gregw]

+2 as much as it's nice to see evidence of your handy work... most significant deployments turn it off

[michael-o]

Often times this header is flagged as an information disclosure by security tools.

Security by obscurity.