nmaier/mod_xsendfile — Issue #9: Can't hide X-Sendfile header in apache
Author: pmontrasio
Created: 2011-12-08 10:18:58+00:00
State: open

I don't want to leak the full path of my files to http clients so I tried to remove it using mod_headers with

Headers always unset X-Sendfile

Unfortunately mod_xsendfile doesn't work anymore after that. It seems that the header is removed before xsendfile starts doing its work.
Is it possible to make mod_xsendfile start before mod_headers or add an option to remove the X-Sendfile header from the response? After all the purpose of that header is to pass information to mod_xsendfile and it should stop there and not go to the http client.

The behavior I'm experiencing might depend on the old version I'm using, which was installed by the debian 6 package manager

$ dpkg -l libapache2-mod-xsendfile
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name Version Description
+++-==============-==============-============================================
ii libapache2-mod 0.9-2 Serve large static files efficiently from we

If newer version fix that problem I can try to build the module from source. Thanks.