Most of the HTTP Servers I know send their application name and version in response http headers as default behaviour. (Nginx, IIS, Apache etc.) Of course we can change the default behaviour but I wonder why they send these information? Does it matter which HTTP Servers we use to the requesters?The only reason I can think of is to allow analytics services to keep track of which HTTP Servers are widely used by websites but otherwise these information are unnecessary for most of the requests and when an attacker figures out a specific version of a HTTP Server has a bug, he can easily find websites which uses that version and use that information against these websites.
Why HTTP Servers send information about themselves in HTTP Headers?
http;apache;iis;http response;web servers
Back in the early days of the internet, server operators didn't have to worry about hordes of random attackers trying to break into their web site. The server name/version information was provided as a courtesy, and perhaps as a form of advertising as well.Early versions of the Netscape web browser had an address bar with a label that read Location:. However, when connecting to a server using software produced by the same company, the word Location: would change to Netsite:[1] (the server software was called Netsite). This was made possible by the server header field.Happy Run Some Old Web Browsers Day!