a month ago
Hello Railway Support,
We are preparing our project for a security audit / DAST compliance scan. The scanner has flagged our custom domain with a low-severity Proxy Disclosure (CWE-204) vulnerability because the edge proxy leaks our hosting infrastructure.
We have already stripped our framework (X-Powered-By) headers in our Next.js application code, but the following platform-level headers are still being appended at the edge:
- server: railway-hikari
- x-railway-edge
- x-hikari-trace
Our Details:
- Project ID: 2eef73f5-3bf8-40b1-890c-234b1bb9fa41
- Custom Domain: usefern.ai
Could you please disable or suppress the generation of these public-facing routing headers for our project's custom domain so we can clear this security assessment?
Thank you!
3 Replies
a month ago
This thread has been opened as a public bounty so the community can help solve it. The thread and any further activity are now visible to everyone.
Status changed to Open Railway • about 1 month ago
a month ago
It's not possible to remove those headers, and those headers mean nothing to users outside of Railway. If anything, people can get the IP address of the server hosting your website if they run a simple DNS lookup.
a month ago
I have been trying to get this CASA AL1 assessment passed and this vulnerability is supported by them.
I cannot patch it from the code as its from railway.
Please review and suggest me the solution to it.
Below are the details.
Vulnerability: Proxy Disclosure
Severity: Low
CWE ID: 204
Status: Open
Description:
1 proxy server(s) were detected or fingerprinted. This information helps a potential attacker to determine:
A list of targets for an attack against the application.
Potential vulnerabilities on the proxy servers that service the application.
The presence or absence of any proxy-based components that might cause attacks against the application to be detected, prevented, or mitigated.
Vulnerable URL: https://usefern.ai
Remedies (as listed by the scanner):
Disable the 'TRACE' method on the proxy servers, as well as the origin web/application server.
Disable the 'OPTIONS' method on the proxy servers, as well as the origin web/application server, if it is not required for other purposes, such as 'CORS' (Cross Origin Resource Sharing).
Configure the web and application servers with custom error pages, to prevent 'fingerprintable' product-specific error pages being leaked to the user in the event of HTTP errors, such as 'TRACK' requests for non-existent pages.
Configure all proxies, application servers, and web servers to prevent disclosure of the technology and version information in the 'Server' and 'X-Powered-By' HTTP response headers.
Evidence (detected via TRACE, OPTIONS, and TRACK methods):
Proxy servers between scanner and app server: Unknown
Web/application server identified as: railway-hikari [Next.js]
Affected paths:
Reference: RFC 7231 §5.1.2 (HTTP TRACE method) — https://datatracker.ietf.org/doc/html/rfc7231#section-5.1.2
a month ago
You can try using Cloudflare Transform to remove those headers. You'd need to migrate your DNS to Cloudflare's though. (https://developers.cloudflare.com/dns/zone-setups/full-setup/setup/)