Troubleshooting Tip: How to validate the HTTP header leaking signatures are hidden the information of the server

[jcastellanos]

Description	This article describes how the user could verify if the server information in the HTTP header is hidden by the signatures of the FortiWeb.
Scope	FortiWeb v7.4.x
Solution	The user does not want the information from the server could be visible to the end client. The information could be visible in the HTTP response sent to the end client. To hide the server information signature needs to be enabled and the category in information disclosure in action 'erase' in the signature profile corresponding to the server policy.   An attack log will be visible with the match of the signature. It is possible to validate the result through a scanning tool or the web browser using developer tools and looking for the HTTP response header. The result should server field is hidden xxxx.