testssl/testssl.sh

[BUG] Server-Timing header being reported as Server Banner

Closed this issue · 3 comments

gooseleggs commented

I am running version: testssl.sh version 3.2.0 from https://testssl.sh/ (just pulled latest version)

Command line / docker command to reproduce

testssl.sh glueware.co.nz

Expected behavior

I would expect the Server-Banner response to be empty as this is not being returned by the website. However, the Server Banner is displaying the Server-Timing header results.

Server banner Server-Timing: cache;desc=hit, varnish;desc=hit, dc;desc=blahblah

Your system (please complete the following information):

  • OS: Kali GNU/Linux Rolling
  • Platform: Linux 6.12.20-amd64 x86_64
  • OpenSSL + bash:
  Using OpenSSL 1.0.2-bad (Mar 28 2025)  [~183 ciphers]
  Using bash 5.2.37

Additional context

Not sure that there is anything else to add.

bhargavakappala commented

use this line " http-response del-header Server "
inside the haproxy server

gooseleggs commented

I don’t think this is relevant. It is a test against a server where I don’t control the infrastructure. There is no server-banner yet testssl.sh is saying that the server-timing header is the server-banner.

drwetter commented

Thanks for filing the issue! The parser for the server header isn't quite correct

Image

Will be fixed next occasion.