probeo

How to prevent framework leaks via the Vary header?

vary-header-framework-leak global

The issue

A Vary header listing framework-specific request headers, such as X-Requested-With, can hint at the technology behind a site. The hint is weak on its own, but it is on every cached response.

The cause is a framework that returns different content for the same URL depending on a non-standard request header, and so has to name that header in Vary for caches to work.

Scope

Vary is set per response. Probeo treats Vary as a standard header and doesn’t flag its values; this page is for teams reducing fingerprints by hand.

How to check you have it

  • By hand: run curl -sI https://example.com/ and read the vary header. Standard values are request headers such as Accept, Accept-Encoding and Accept-Language.

The fix

Stop varying the response on a framework’s request header.

If a URL returns a fragment for scripted requests and a full page otherwise, give the fragment its own URL. The response then no longer depends on X-Requested-With, and Vary no longer needs to name it.

Done when: Vary lists only the request headers the response really depends on, and the check above comes back clean.

Do not

  • Do not drop a value from Vary while the response still depends on it; caches will serve the wrong version.
  • Do not replace one custom header with another.

FAQ

Does removing framework headers from Vary break caching?

Only if the response still depends on them. Remove the dependency first, then the value.

Can the Vary header reveal other information beyond framework choice?

Unusual combinations of values can point to particular middleware or platforms. The signal is weak compared with Server or X-Powered-By.

What makes a Vary value framework-specific versus standard?

Standard values are request headers defined by HTTP, such as Accept and Accept-Encoding. X-Requested-With is a convention set by JavaScript libraries, not by browsers.

Does removing Vary headers entirely solve the problem?

No. A response that differs by a request header needs Vary to say so, or caches will serve one version to everyone.

How do CDNs affect Vary header information leakage?

CDNs pass on the origin’s Vary and may change it. Check the header on the response the CDN delivers, not only at the origin.

When does Vary-based framework detection matter operationally?

Rarely on its own. It matters as part of reducing every fingerprint, after versioned headers are gone.

Which product detects this

Probeo checks this on every page of your site as part of Site Clarity. This page explains one instance; the product tells you every page that has it.