I have a Rails application served using Apache 2 and Phusion Passenger. As a security measure I'm trying to supress all server-related HTTP headers. I've successfully turned off the Apache ones, but I'm having trouble using
mod_headers to supress the Passenger ones. I've enabled
mod_headers using the
a2enmod command and restarted the Apache process, but the
X-Runtime headers still appear.
This is my vhost file:
<VirtualHost *:80> ServerAdmin firstname.lastname@example.org ServerName example.com ServerAlias www.example.com DocumentRoot /home/deploy/public_html/railsapp/current/public LogLevel warn ErrorLog /home/deploy/public_html/railsapp/shared/log/error.log CustomLog /home/deploy/public_html/railsapp/shared/log/access.log combined # Suppress Phusion Passenger HTTP headers <Location *> <IfModule mod_headers.c> Header unset X-Runtime Header unset X-Powered-By </IfModule> </Location> </VirtualHost>
- What am I doing wrong?