We have an external company PEN testing out api gateway and one of suggestion was to disable kong specific headers.
There are two types of those:
via: kong/0.13.0 - we removed it by using server_tokens = off this is good
other two can be disabled but I find those very useful, ideally we would rename those :
x-kong-proxy-latency: 77
x-kong-upstream-latency: 320
to something more like:
x-gateway-proxy-latency: 77
x-gateway-upstream-latency: 320
I do the same thing, drop in my own constants.lua just because better to not expose what software is running your gateway . But for Kong to make it generic would remove some of the βKongβ brand, so I think it makes sense why they do it like so.