HCL Domino Ideas Portal
Welcome to the #dominoforever Product Ideas Forum! The place where you can submit product ideas and enhancement request. We encourage you to participate by voting on, commenting on, and creating new ideas. All new ideas will be evaluated by HCL Product Management & Engineering teams, and the next steps will be communicated. While not all submitted ideas will be executed upon, community feedback will play a key role in influencing which ideas are and when they will be implemented.
For more information and upcoming events around #dominoforever, please visit our Destination Domino Page
If core REST services are not needed, there should be an option to disable these services.
If the core services are necessary to the operation of the Domino http server, an option to suppress the exact version number should be available:
Accurately discovering the type of web server that an application runs on can enable attackers to determine if the application is vulnerable to attack. In particular, servers running older versions of software without up-to-date security patches can be susceptible to known version-specific exploits, making it easy for an attacker to exploit those vulnerabilities.
https://owasp.org/www-project-automated-threats-to-web-applications/assets/oats/EN/OAT-004_Fingerprinting
Suggested Threat-Specific Countermeasures:
Remove or mask system information leakages (e.g. HTTP headers, error messages, URL paths, and file extensions).
https://raw.githubusercontent.com/OWASP/www-project-automated-threats-to-web-applications/master/assets/files/EN/automated-threat-handbook-EN-1v20.pdf
Thomas, for internet facing servers would don't like to give out version numbers, which you easily can now by just going ot <url>/api.
The issue found is when http is enabled and REST is disabled then making the nonce call could prompt for authentication. A workaround can be to create a website redirection for the api url or when the REST API is disabled that none of the services are available.
Please explain why this should be done