Issue
- Sometimes when using a tool that identifies a site's web technologies, versions of Javascript libraries (jQuery and YUI, for example) are displayed.
Environment
- Liferay DXP.
Resolution
- It is not possible to hide the version of Javascript libraries in the Liferay portal. Here are some reasons why:
- Liferay does not consider exposing third-party libraries version a vulnerability security. However, we'll update any library containing reported security vulnerabilities.
- If we hide this information, other libraries and plug-ins that depend on these libraries may experience errors.
-
In the case of jQuery, for example, even if we remove the headers it would be easy to get the version. It could be done by comparing the code with minimal processing. But in addition to this, the library itself offers several ways to obtain the version, such as executing one of these commands in the browser console:
jQuery().jquery
or$.fn.jquery
orjQuery.fn.jquery
.