How to remove Next-Router-State-Tree, Next-Router-Prefetch from Vary Headers

[srikanth912]

Summary

Hello Everyone,

Is there a way to disable below header from response headers ? Our security team don't typically like headers that expose the framework/tech used to build and suggested we remove it. I totally get it view source will immediately give it away it's Next.js.

RSC, Next-Router-State-Tree, Next-Router-Prefetch

Example of the header from nextjs website:

✗ curl -I https://nextjs.org/
HTTP/2 200
accept-ranges: bytes
access-control-allow-origin: *
age: 85509
cache-control: public, max-age=0, must-revalidate
content-disposition: inline
content-type: text/html; charset=utf-8
date: Sun, 02 Jun 2024 13:50:15 GMT
etag: "430f106530b094eb45965e7082c55e3d"
server: Vercel
strict-transport-security: max-age=63072000
vary: RSC, Next-Router-State-Tree, Next-Router-Prefetch
x-matched-path: /
x-vercel-cache: HIT
x-vercel-id: bom1::v6gpc-1717336215891-288de8b878cf
content-length: 284938

Additional information

No response

Example

No response

[lomocc]

Similarly, using next/link gives us a 500 server error on the page. Returns to normal when Next-Router-State-Tree is removed.

[naruto3315]

How did you remove this header parameter?

[arvinxx]

Not for the safety reason but we need a custom vary header for fine-grained control of CDN Cache. Hope it can be move forward as soon as possible!