---
title: "X-Debug-Token Information Leak"
description: "HawkScan test information for plugin 10056: X-Debug-Token Information Leak"
url: https://docs.stackhawk.com/vulnerabilities/10056/
---

[Back to Index](https://docs.stackhawk.com/vulnerabilities/)

# X-Debug-Token Information Leak

###### Reference

- **Plugin ID:** 10056
- [**CWE:** 200](https://cwe.mitre.org/data/definitions/200.html)
- **Risk:** Unknown
- **Type:** Passive
- **Category:**

### Remediation

To remediate the vulnerability "X-Debug-Token Information Leak," you should take the following steps:

1. **Disable Symfony's Profiler in production:** Ensure that Symfony's Profiler is disabled in your production environment to prevent the exposure of sensitive data. This can be done by setting the `profiler` option to `false` in your Symfony configuration file (`config/packages/profiler.yaml`):

   ```yaml
   # config/packages/profiler.yaml
   profiler:
       enabled: false
   ```

2. **Remove X-Debug-Token and X-Debug-Token-Link headers:** Remove any occurrences of the `X-Debug-Token` and `X-Debug-Token-Link` headers from your server's response. This can be done by modifying your web server configuration (e.g., Apache or Nginx) to exclude these headers. For example, in an Apache `.htaccess` file, you can use the `Header` directive to unset these headers:

   ```apache
   # .htaccess
   Header unset X-Debug-Token
   Header unset X-Debug-Token-Link
   ```

### About

The vulnerability "X-Debug-Token Information Leak" occurs when the server's response contains the `X-Debug-Token` or `X-Debug-Token-Link` header. These headers are typically used by Symfony's Profiler, a development tool that provides detailed information about the application's performance and debugging data. However, exposing these headers in a production environment can lead to the leakage of sensitive information.

### Risks

The risks associated with the "X-Debug-Token Information Leak" vulnerability include:

- **Exposure of sensitive data:** The presence of the `X-Debug-Token` or `X-Debug-Token-Link` header in the server's response can expose sensitive information, such as database credentials, API keys, or other confidential data.
- **Information disclosure:** Attackers can exploit this vulnerability to gain insights into the application's internal workings, potentially aiding them in further attacks or exploitation.
- **Violation of compliance requirements:** Depending on the nature of the exposed data, the vulnerability may lead to non-compliance with data protection regulations, industry standards, or internal security policies.