How to remove Next-Router-State-Tree, Next-Router-Prefetch from Vary Headers

[srikanth912]

Summary

Hello Everyone,

Is there a way to disable below header from response headers ? Our security team don't typically like headers that expose the framework/tech used to build and suggested we remove it. I totally get it view source will immediately give it away it's Next.js.

RSC, Next-Router-State-Tree, Next-Router-Prefetch

Example of the header from nextjs website:

✗ curl -I https://nextjs.org/
HTTP/2 200
accept-ranges: bytes
access-control-allow-origin: *
age: 85509
cache-control: public, max-age=0, must-revalidate
content-disposition: inline
content-type: text/html; charset=utf-8
date: Sun, 02 Jun 2024 13:50:15 GMT
etag: "430f106530b094eb45965e7082c55e3d"
server: Vercel
strict-transport-security: max-age=63072000
vary: RSC, Next-Router-State-Tree, Next-Router-Prefetch
x-matched-path: /
x-vercel-cache: HIT
x-vercel-id: bom1::v6gpc-1717336215891-288de8b878cf
content-length: 284938

Additional information

No response

Example

No response

[lomocc]

Similarly, using next/link gives us a 500 server error on the page. Returns to normal when Next-Router-State-Tree is removed.

[naruto3315]

How did you remove this header parameter?

[arvinxx]

Not for the safety reason but we need a custom vary header for fine-grained control of CDN Cache. Hope it can be move forward as soon as possible!

[Djay77]

Yes, we need it !
Even in next.config (async headers()) we can't override/add a custom vary header.. :(

[nikushx]

For anyone coming across this - I had this same exact error and fixed it by checking the paths exported by getStaticPaths and ensuring there weren't any special symbols. The "circle R" symbol was in one of my paths.