Add an option to hide version for anonymous users

[JurrianFahner]

When visiting concourse web the version of concourse is displayed including fly cli download. This shares the version with not logged in users. If concourse is installed on an internal trusted network, it is of course an accepted (low) risk.

However if you want to deploy concourse in zero trust network, it can be advisable to hide this version and the download link to the fly cli download. This version should only be shared with logged-in users.

Is a solution to this concern on the roadmap for the future of concourse?

[taylorsilva]

First time seeing this mentioned. Anyone is free to submit a PR to make this change as I don't see anything wrong with wanting this behaviour. Won't be on the roadmap for me to implement though, too many other things to prioritize.

[taylorsilva]

FWIW, I don't know how far the security theatre goes in a zero trust network. There are a few ways one could get the version of any Concourse cluster without logging in:

• From the web UI, as you observed
• By download the FLY cli. The endpoint for that is not authenticated and is the same on any cluster
• By hitting api/v1/info, which is another unauthenticated endpoint

The hardest of those three to update would be the fly download, as we want to make it easy for users to download fly from their terminal. Would need to update the command there to somehow include a users token.

[JurrianFahner]

To clarify the motivation a bit more: the concern isn’t so much about achieving perfect secrecy in a zero‑trust environment (as you mentioned, there will always be other ways to infer the version), but rather about reducing the surface area of unauthenticated information exposure. Even small reductions can help meet certain compliance requirements or internal security guidelines.

Hiding the version in the web UI would already cover the most visible and user‑facing leak. The unauthenticated api/v1/info endpoint and the fly download endpoint are definitely trickier, but even addressing just the UI portion would be a meaningful improvement for some deployments.

Because hiding the fly CLI could impact usability, it might make sense to introduce it only when a feature toggle is enabled.