How to hide the nextjs version from the "build code" in production?
Unanswered
Lanceolated Warbler posted this in #help-forum
14 Replies
@Lanceolated Warbler https://github.com/vercel/next.js/discussions/59337
can i ask why you want to do this?
@riský can i ask why you want to do this?
Lanceolated WarblerOP
The security team says that if the hacker knows the version of the framework they could exploit vulnerabilities in that particular version
1. Keep yourself up to date
2. Even if that version is hidden, the bundles and things will still make it easy to tell the version
2. Even if that version is hidden, the bundles and things will still make it easy to tell the version
Also personal oppinion, I think they are making a bigger deal out of it unless you use old versions (as team is very fast for fixing security things and such)
hmm, is there any particular reason next needed to embed its version tho? just wondering
If a hacker knows you use nextjs
(Pretty easy to tell even without the version number)
They can just iterate through all versions of nextjs with known vulnerabilities
And try their scripts or whatever against each version
@Lanceolated Warbler The security team says that if the hacker knows the version of the framework they could exploit vulnerabilities in that particular version
if a nextjs version has a security vulnerability, it will be listed [here](https://github.com/vercel/next.js/security). other versions don't have known security vulnerabilities so this argument is no longer applicable.
if you are using a vulnerable nextjs version, upgrade nextjs as soon as possible.
if you are using a vulnerable nextjs version, upgrade nextjs as soon as possible.
@linesofcode If a hacker knows you use nextjs
Silver
yeah but the idea is to make it harder or at least more inconvenient for a hacker (security standpoint). like yeah it honestly wont make a huge difference but the best security practice is to not make it easy for a hacker to know what software and version you are using.
no it's impossible to hide the version and/or the fact that you use nextjs
@joulev no it's impossible to hide the version and/or the fact that you use nextjs
Silver
But that can be seen as a security concern. For example, you can easily hide the fact you are using php as long as you dont expose the extension (.php)
well i answered your question. if you want to change that you need to tell the maintainers who are not going to read this thread.