Security: /api/hello health endpoint leaks server version via Actix default headers

[anshul23102]

Security Bug: Health Endpoint Discloses Actix Web and Rust Version Information

Description

The /api/hello health check endpoint is accessible without authentication and
returns response headers including Server: actix-web/X.Y.Z. This discloses
the exact web framework version to any caller. An attacker scanning for
vulnerable Actix Web versions can quickly identify whether this deployment is
running a version with known CVEs without any privileged access.

Steps to Reproduce

1. Send a request to the health endpoint:

   curl -I http://localhost:8000/api/hello

2. Observe the response headers:

   Server: actix-web/4.x.x
   

3. Cross-reference the version against the Actix Web CVE database.

Root Cause

Actix Web includes a Server header with the framework name and version by
default. No middleware removes or replaces this header.

Impact

Version disclosure enables targeted exploitation of known framework
vulnerabilities without any brute-force or active probing.

Proposed Fix

Disable or replace the default Server header:

use actix_web::{middleware, App, HttpServer};

HttpServer::new(|| {
    App::new()
        .wrap(middleware::DefaultHeaders::new()
            .add(("Server", "rust-tune"))  // Generic name, no version
        )
        .service(hello)
})
.disable_signals()
.bind("0.0.0.0:8000")?
.run()
.await

[anshul23102]

@KDeekshita Hi! I came across this issue and I would love to work on it as part of GSSoC '26.

I have reviewed the problem description carefully and am confident I can deliver a well-tested, production-ready fix within the contribution timeline. Please let me know if you need any additional context or have specific implementation preferences before I get started.

Could you please assign this issue to me?

/assign
/claim