Is there a way to hide Jira version from webpages?

[Corey Mahoney]

Hi everyone,

Our security groups wants us to hide version information from Jira webpages. We can hide it from the footer but all the info is accessible when someone views the page source. I tried the instructions at https://confluence.atlassian.com/jirakb/hiding-the-jira-version-number-from-page-markup-1056673381.html but it doesn’t work. Does anyone know how to hide this info when viewing the page source?

Thanks,

Corey

[Sunny Ape]

Hello @Corey Mahoney 

The many limitations of that workaround are specifically described on that page:

Limitations of this workaround include:

1. This workaround does not prevent your system's version from being fingerprinted in other ways

2. This workaround does not include hiding other version number occurrences not listed in Workaround outcome. Other known areas include:

   1. Static caches asset build number, eg:

      <link rel="shortcut icon" href="/s/-xz3veb/713011/7aff4cd5e4b16e3f7ba7202ed02129c6/_/jira-favicon-hires.png">

   2. The <BaseURL>/secure/AboutPage.jspa page.

So, given that the 'security group' has asked to achieve an outcome that isn't impossible (the absolute removal of all evidence of the version number at all places), then tell them so.

Why not use this as an opportunity to turn the situation around and force your company to face up to the fact they're using a product that has been discontinued, is no longer licensed and all support ends in a few months? This is a much, much bigger security problem in the long term.

Personally speaking, if any 'security group' told our IT team that we needed to remove the version number from the GUI of a system to improve its security, they'd be laughed out of the building for suggesting such a thing.

[Corey Mahoney]

Just to clarify, we are currently using Jira version 9.4.1 and will be upgrading to 9.7.1 within the next few days.