Skip to content

docs: clarify uvicorn server header limitation (fixes #7) - #15

Merged
aletgdev merged 2 commits into
aletgdev:mainfrom
slopgobblercobbler:docs-uvicorn-server-header-limitation
Oct 21, 2026
Merged

aletgdev merged 2 commits into
aletgdev:mainfrom
slopgobblercobbler:docs-uvicorn-server-header-limitation

Conversation

@slopgobblercobbler

@slopgobblercobbler slopgobblercobbler commented Oct 20, 2026 •

Copy link
Copy Markdown
Contributor

Closes #7.

Summary of Changes

  • Documented in \README.md\ that \strip_server_headers=True\ operates at the ASGI middleware layer and cannot strip the \Server\ header appended downstream by Uvicorn.
  • Documented instructions for properly disabling Uvicorn's wire-level header via programmatic configuration (\server_header=False) and CLI flag (--no-server-header).
  • Positioned the documentation cleanly within the \Custom Configuration\ section.
  • Added comprehensive unit tests in \ ests/test_middleware.py\ verifying \strip_server_headers\ when enabled, disabled by default, and configured via \SecurityHeadersConfig.

Verification

  • 23/23 pytest tests passing.

@aletgdev
aletgdev merged commit 4f184d8 into aletgdev:main Oct 21, 2026
5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

strip_server_headers does not remove the uvicorn Server header

2 participants