Hiding of NextJS framework info and version in production deployed app
Answered
Siberian posted this in #help-forum
SiberianOP
Nextjs framework info and version are seen in the source files in the developer tools. How can I hide those information? btw, these are raise on pen testing and considered low risk.
10 Replies
@Siberian Nextjs framework info and version are seen in the source files in the developer tools. How can I hide those information? btw, these are raise on pen testing and considered low risk.
where exactly in the source file? if it's in the
<head> i think you can use the metadata api to override itif it is the x-powered-by header, then see this https://nextjs.org/docs/app/api-reference/next-config-js/poweredByHeader
SiberianOP
Thanks for the response. some of it is inside /_next/static/chunks/main-s1231ds.js . I've attached images on how is it appearing on those js files
@Siberian Thanks for the response. some of it is inside /_next/static/chunks/main-s1231ds.js . I've attached images on how is it appearing on those js files
this one then i doubt you can remove them. it's part of the nextjs runtime code itself
and if you go to popular sites that use nextjs, you should be able to see it too
it's not a security issue
Answer
for example, https://www.notion.so/_next/static/chunks/main-fc726222eea0f7c9.js from Notion also features those "Next.js" strings
it's not a security issue at all
SiberianOP
Thanks!. They told me it's an informational risk and tagged as Low risk. cause attackers may obtain information of our underlying structure. But I really think it's not that serious or an issue at all. Thanks @joulev for clearing things!
@Siberian Thanks!. They told me it's an informational risk and tagged as Low risk. cause attackers may obtain information of our underlying structure. But I really think it's not that serious or an issue at all. Thanks <@484037068239142956> for clearing things!
obtaining the information on the underlying structure is very easy for many frameworks, for example if you see
/_next it is 99.99% a nextjs app, /_nuxt it is 99.99% a nuxt app. but attackers can't go further than this, so you can rest assured about the security related to this issue and can tell them what i told you here