Server Version Disclosure On Error Page

[marcoAntonioNina]

=## Issue & Reproduction Steps
Server Version Disclosure On Error Page

Solution

• Add middleware hide server headers

How to Test

Review the headers returned by requests to ensure they do not contain relevant information about the server or the technologies used.

Note:
Since this is a change that involves all endpoints, it is suggested that a full test be performed, checking that when the HIDE_SERVER_HEADERS variable is set to true by default, the server name will change to ProcessMaker Server and when it is set to false, the normal header will remain.

HIDE_SERVER_HEADERS=false

HIDE_SERVER_HEADERS=true

Related Tickets & Packages

• FOUR-26915

Code Review Checklist

• I have pulled this code locally and tested it on my instance, along with any associated packages.
• This code adheres to ProcessMaker Coding Guidelines.
• This code includes a unit test or an E2E test that tests its functionality, or is covered by an existing test.
• This solution fixes the bug reported in the original ticket.
• This solution does not alter the expected output of a component in a way that would break existing Processes.
• This solution does not implement any breaking changes that would invalidate documentation or cause existing Processes to fail.
• This solution has been tested with enterprise packages that rely on its functionality and does not introduce bugs in those packages.
• This code does not duplicate functionality that already exists in the framework or in ProcessMaker.
• This ticket conforms to the PRD associated with this part of ProcessMaker.

[gustavobascope]

Approved

[cursor]

This is the final PR Bugbot will review for you during this billing cycle

Your free Bugbot reviews will reset on November 21

Details

Your team is on the Bugbot Free tier. On this plan, Bugbot will review limited PRs each billing cycle for each member of your team.

To receive Bugbot reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial.

[cursor]

Bug: Middleware Conflict Breaks Load Balancer Functionality

The HideServerHeaders middleware removes proxy/forwarding headers essential for applications behind load balancers. This prevents the TrustProxies middleware (running earlier) from correctly identifying the client's true IP, protocol, and host, breaking functionality like IP-based access control, HTTPS detection, and URL generation.

 

[processmaker-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
No data about Duplication

See analysis details on SonarQube