[PATCH 2/4] httpd: Don't add Date header to response

[Guillermo Rodriguez Garcia]

Hi,

El sáb., 29 ago. 2020 a las 21:37, Sergey Ponomarev
(<stokito at gmail.com>) escribió:
>
> > I have seen clients set the local date from there when ntp was not available.
>
> I'm just curious, could you please provide more details. What was the type of clients? Embedded devices or something else.

Embedded devices.

> Why wasn't ntp available for them? How often does this happen in the wild?

Not sure. Some examples:

https://www.snbforums.com/threads/ntp-blocked-alternatives-to-ntpd-for-updating-time.46541/page-3#post-404882
https://askubuntu.com/questions/1035525/set-date-and-time-from-http-header-in-router-with-curl-or-wget

> Can clients fetch the date from some website on the internet?
> Anyways this is a hack but if someone really needs and control webserver then it they can use a CGI script:

Well, that's the problem; this only works if you control *both* the
server (so you can setup a script) and the client.

But clients that you don't control may just assume that the Date
header is present (since it is mandated by RFC2616) and disabling this
would break them.

Guillermo Rodriguez Garcia
guille.rodriguez at gmail.com