Enterprise Security: DAST reports multiple information disclosure issues from Streamlit internal endpoints

Deployment
1

Hi Streamlit Team,

We recently completed Enterprise DAST review for an application deployed on Azure App Service using Streamlit.

The application itself returns generic errors.

However the following findings originate from Streamlit internal endpoints.

  1. Tornado Server header exposed

Server: TornadoServer/6.x.x

  1. browser_websocket_handler.py disclosed

  2. Linux version disclosed over websocket

  3. /_stcore/host-config exposes allowedOrigins

  4. Websocket Origin header is not validated

  5. Internal websocket errors expose filesystem paths

Has anyone successfully mitigated these?

Are there any configuration options or roadmap to suppress these disclosures?

Thanks.

2

Welcome to the community and thanks for your detailed security question! :shield: You’re right—several of these findings are known issues with Streamlit’s Tornado-based server, especially regarding HTTP headers, origin validation, and error disclosures.

As of Streamlit 1.53+, you can add custom HTTP security headers (including suppressing the Server header) using the new experimental ASGI/Starlette integration. This allows you to add middleware to control headers and error handling. For example, you can suppress or modify the Server header and add security headers like so:

from streamlit.starlette import App
from starlette.middleware import Middleware
from starlette.middleware.base import BaseHTTPMiddleware

class SecurityHeadersMiddleware(BaseHTTPMiddleware):
    async def dispatch(self, request, call_next):
        response = await call_next(request)
        response.headers["Server"] = "Hidden"
        response.headers["X-Frame-Options"] = "DENY"
        response.headers["X-Content-Type-Options"] = "nosniff"
        # Add more headers as needed
        return response

app = App("main.py", middleware=[Middleware(SecurityHeadersMiddleware)])

Origin validation for WebSockets and suppression of internal error details are not fully configurable in Tornado, but Starlette will become the default server in Streamlit 1.57, making these mitigations easier. For now, deploying Streamlit behind a secure reverse proxy (like Nginx) is recommended to filter headers and restrict access to internal endpoints. There is active development in this area, and you can track progress or provide feedback in the Streamlit Starlette/ASGI feedback thread and security header issues.

Sources: