unexpose php version

[ghost]

Request to disable php_expose. Because when enabled it discloses information about the system that could indicate vulnerabilities or help malicious individuals otherwise.

php_expose is a core INI directive, hence it can only be configured in the primary php.ini.

The main reason for myself is that several penetration testing tools indicate it as a (low) security risk. E.g.:

• https://www.beyondsecurity.com/scan_pentest_network_vulnerabilities_php_expose_php_information_disclosure
• https://www.virtuesecurity.com/kb/php-easter-eggs-enabled/
• http://blog.x1622.com/2016/12/twelve-low-hanging-fruits-application.html

Tradeoff: I am proud to be hosting my app at Azure which means I can leave the security patching to the people who like it, are good at it and make it their responsibility. Bu now there is no longer a header on the HTTP responses showing off my app's high PHP version.